adaptiqai 0.1.0 → 0.2.0

package/lib/index.js

@@ -2,14 +2,14 @@
 
 // src/entry.ts
 import { homedir } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { parseArgs } from "node:util";
 
 // src/apps/claude-code.ts
-import { access, chmod as chmod2, constants as constants2, mkdir as mkdir2, readdir } from "node:fs/promises";
-import { existsSync as existsSync2 } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { access, chmod as chmod2, constants as constants2, mkdir as mkdir3, readdir } from "node:fs/promises";
+import { existsSync as existsSync3 } from "node:fs";
+import { dirname as dirname2, join as join6 } from "node:path";
 
 // src/context.ts
 import { hostname } from "node:os";
@@ -57,7 +57,7 @@ function checkedAddress(raw, variable) {
 }
 
 // src/files.ts
-import { chmod, lstat, mkdir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join as join2 } from "node:path";
 
 // src/output.ts
@@ -99,6 +99,25 @@ var Output = class {
 };
 
 // src/files.ts
+var KEY_SHAPE = /ak_(?:live|test)_[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{8,}/u;
+var PIECE = 1 << 20;
+async function fileHoldsKey(path) {
+  const handle = await open(path, "r").catch(() => void 0);
+  if (handle === void 0) return false;
+  try {
+    const piece = Buffer.alloc(PIECE);
+    let carried = "";
+    for (; ; ) {
+      const { bytesRead } = await handle.read(piece, 0, PIECE, null);
+      if (bytesRead === 0) return false;
+      const text = carried + piece.toString("latin1", 0, bytesRead);
+      if (KEY_SHAPE.test(text)) return true;
+      carried = text.slice(-256);
+    }
+  } finally {
+    await handle.close();
+  }
+}
 async function readText(path) {
   try {
     return await readFile(path, "utf8");
@@ -123,8 +142,8 @@ async function readJson(path) {
 }
 var Backups = class {
   /** @param dir - this run's folder, made when the first copy is. */
-  constructor(dir3) {
-    this.dir = dir3;
+  constructor(dir2) {
+    this.dir = dir2;
   }
   saved = [];
   seen = /* @__PURE__ */ new Map();
@@ -219,6 +238,40 @@ async function removeFile(path, backups) {
   return true;
 }
 
+// src/node.ts
+var ADAPTIQ_NODE_BIN = "$HOME/.adaptiq/node/current/bin";
+var HandedOver = class extends Error {
+  constructor(exitCode) {
+    super("handed over");
+    this.exitCode = exitCode;
+  }
+};
+function atLeast(version2, minimum) {
+  const have = version2.replace(/^v/u, "").split(".").map(Number);
+  const need = minimum.split(".").map(Number);
+  for (let index = 0; index < 3; index++) {
+    const a = have[index] ?? 0;
+    const b = need[index] ?? 0;
+    if (a !== b) return a > b;
+  }
+  return true;
+}
+async function needNode(context2, minimum, what, args) {
+  if (atLeast(context2.node, minimum)) return;
+  const said = `${what} needs Node.js ${minimum} or newer, and this runs on ${context2.node}.`;
+  const script = `${context2.origin}/v1/install.sh`;
+  const command2 = `curl -fsSL '${script}' | ADAPTIQ_NODE_MIN=${minimum} ADAPTIQ_INSTALL_NODE=1 sh -s -- ${args.join(" ")}`;
+  const windows2 = context2.platform === "win32";
+  if (windows2 || !await context2.confirm(`${said} Install a newer Node.js for AdaptiqAI, in your home folder? It needs no admin password.`)) {
+    throw new Problem("node_too_old", `${said} Install it from nodejs.org${windows2 ? "" : `, or have AdaptiqAI install one: ${command2}`}`, {
+      node: context2.node,
+      needs: minimum,
+      ...windows2 ? {} : { install: command2 }
+    });
+  }
+  throw new HandedOver(await context2.handOver(command2));
+}
+
 // src/run.ts
 import { spawn } from "node:child_process";
 import { accessSync, constants, statSync } from "node:fs";
@@ -228,10 +281,10 @@ var FLUSH_MS = 150;
 function which(name2, env, platform = process.platform) {
   const windows2 = platform === "win32";
   const extensions = windows2 ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  for (const dir3 of (env.PATH ?? env.Path ?? "").split(windows2 ? ";" : delimiter)) {
-    if (dir3 === "") continue;
+  for (const dir2 of (env.PATH ?? env.Path ?? "").split(windows2 ? ";" : delimiter)) {
+    if (dir2 === "") continue;
     for (const extension of ["", ...extensions]) {
-      const found = join3(dir3, name2 + extension);
+      const found = join3(dir2, name2 + extension);
       try {
         accessSync(found, windows2 ? constants.F_OK : constants.X_OK);
         if (statSync(found).isFile()) return found;
@@ -246,12 +299,39 @@ function launch(command2, args, platform) {
   const quoted = [command2, ...args].map((word) => `"${word.replace(/"/gu, '""')}"`).join(" ");
   return ["cmd.exe", ["/d", "/s", "/c", `"${quoted}"`], { windowsVerbatimArguments: true }];
 }
+function ownEnv(env, platform) {
+  const own = Object.fromEntries(Object.entries(env).filter(([name2]) => !/^npm_/iu.test(name2) && name2 !== "INIT_CWD" && !["ADAPTIQ_CONNECT", "ADAPTIQ_HELLO", "ADAPTIQ_KEY"].includes(name2)));
+  const path = Object.keys(own).find((name2) => name2.toUpperCase() === "PATH");
+  if (env.npm_lifecycle_event === void 0 || path === void 0) return own;
+  const separator = platform === "win32" ? ";" : delimiter;
+  const dirs = (own[path] ?? "").split(separator);
+  const first = dirs.findIndex((dir2) => !/(?:node_modules[\\/]\.bin|node-gyp-bin)[\\/]?$/u.test(dir2));
+  return { ...own, [path]: dirs.slice(first < 0 ? dirs.length : first).join(separator) };
+}
+function handOver(base, platform = process.platform) {
+  return async (command2) => {
+    if (holdsKey(command2)) throw new Problem("key_on_command_line", "Refused to put a key on a command line.");
+    const [file3, args] = platform === "win32" ? ["cmd.exe", ["/d", "/s", "/c", `"${command2}"`]] : ["/bin/sh", ["-c", command2]];
+    const keep = () => {
+    };
+    process.on("SIGINT", keep);
+    try {
+      return await new Promise((resolve) => {
+        const child = spawn(file3, args, { env: ownEnv(base, platform), stdio: "inherit", windowsVerbatimArguments: platform === "win32" });
+        child.on("error", () => resolve(1));
+        child.on("exit", (code) => resolve(code ?? 1));
+      });
+    } finally {
+      process.off("SIGINT", keep);
+    }
+  };
+}
 function runner(base, platform = process.platform) {
   return async (command2, args, options = {}) => {
     if (args.some(holdsKey) || holdsKey(command2)) throw new Problem("key_on_command_line", "Refused to put a key on a command line.");
-    const [file4, words, extra] = launch(command2, args, platform);
+    const [file3, words, extra] = launch(command2, args, platform);
     return await new Promise((resolve, reject) => {
-      const child = spawn(file4, [...words], {
+      const child = spawn(file3, [...words], {
         env: { ...base, ...options.env },
         stdio: [options.input === void 0 ? "ignore" : "pipe", "pipe", "pipe"],
         ...options.cwd === void 0 ? {} : { cwd: options.cwd },
@@ -296,6 +376,7 @@ import { mkdtemp, rm as rm2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join as join4 } from "node:path";
 var QUESTION = "AdaptiqAI connection check: reply with the single word connected.";
+var shellWord = (text) => `'${text.replace(/'/gu, "'\\''")}'`;
 var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 function macApp(context2, name2) {
   if (context2.platform !== "darwin") return void 0;
@@ -318,6 +399,14 @@ async function emptyFolder(work) {
     await rm2(folder2, { recursive: true, force: true });
   }
 }
+async function forgetGrant(context2, folder2) {
+  const grant = join4(folder2, "grant.json");
+  try {
+    if (JSON.parse(await readText(grant) ?? "{}").apiBase === context2.origin && await removeFile(grant)) return grant;
+  } catch {
+  }
+  return void 0;
+}
 async function running(context2, name2) {
   if (context2.platform === "win32") return false;
   const seen = await context2.run("pgrep", ["-x", name2], { timeoutMs: 5e3 }).catch(() => void 0);
@@ -325,25 +414,57 @@ async function running(context2, name2) {
 }
 async function quitMacApp(context2, bundleId) {
   const script = `application id "${bundleId}" is running`;
-  const open2 = async () => (await context2.run("osascript", ["-e", script], { timeoutMs: 5e3 }).catch(() => void 0))?.stdout.trim() === "true";
-  if (!await open2()) return true;
+  const open3 = async () => (await context2.run("osascript", ["-e", script], { timeoutMs: 5e3 }).catch(() => void 0))?.stdout.trim() === "true";
+  if (!await open3()) return true;
   await context2.run("osascript", ["-e", `quit application id "${bundleId}"`], { timeoutMs: 35e3 }).catch(() => void 0);
-  for (let tries = 0; tries < 60 && await open2(); tries++) await context2.sleep(500);
-  return !await open2();
+  for (let tries = 0; tries < 60 && await open3(); tries++) await context2.sleep(500);
+  return !await open3();
 }
 var openMacApp = async (context2, path) => {
   await context2.run("open", [path], { timeoutMs: 15e3 }).catch(() => void 0);
 };
-var modelWindow = (model2) => ({
-  ...model2.input.includes("image") ? { input: ["text", "image"] } : {},
-  contextWindow: CONVERSATION_TOKENS,
-  ...model2.output > 0 ? { maxTokens: model2.output } : {}
-});
+
+// src/apps/mcp.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { mkdir as mkdir2 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+var PACKAGE = "@adaptiqai/mcp";
+var mcpDir = (context2) => join5(configDir(context2.env, context2.home), "mcp");
+var mcpServer = (context2) => join5(mcpDir(context2), "node_modules", ".bin", context2.platform === "win32" ? "adaptiqai-mcp.cmd" : "adaptiqai-mcp");
+var mcpPlugin = (context2) => join5(mcpDir(context2), "node_modules", "@adaptiqai", "mcp", "claude-code");
+var mcpHasHook = (context2) => existsSync2(join5(mcpPlugin(context2), "hooks", "hooks.json"));
+var mcpEnv = (context2) => context2.origin === PRODUCTION_API ? void 0 : { ADAPTIQAI_API_BASE: context2.origin, ADAPTIQAI_CONSOLE_URL: context2.console };
+var MCP_UPDATE = `U="$D/mcp/.checked"; if [ -x "$X" ] && command -v npm >/dev/null 2>&1 && [ -z "$(find "$U" -mtime -1 2>/dev/null)" ]; then touch "$U"; N="$D/mcp.next.$$"; O="$D/mcp.old.$$"; rm -rf "$N"; if B=$(node -e 'process.stdout.write(new Date(Date.now()-172800000).toISOString())' 2>/dev/null) && npm install --prefix "$N" --no-audit --no-fund --fetch-retries=0 --fetch-timeout=10000 --before="$B" ${PACKAGE}@latest </dev/null >/dev/null 2>&1 && [ -x "$N/node_modules/.bin/adaptiqai-mcp" ] && node --check "$N/node_modules/@adaptiqai/mcp/lib/index.js" >/dev/null 2>&1; then touch "$N/.checked"; mv "$D/mcp" "$O" && { mv "$N" "$D/mcp" || mv "$O" "$D/mcp"; }; fi; rm -rf "$N" "$O"; fi`;
+async function installMcp(context2, app) {
+  const had = existsSync2(mcpServer(context2));
+  const npm = command(context2, "npm");
+  if (npm === void 0) {
+    if (had) return;
+    throw new Problem("tools_not_installed", `AdaptiqAI's knowledge tools for ${app} need npm, which comes with Node.js. Install Node.js from nodejs.org, then run this again.`, { app });
+  }
+  context2.say.note(`Installing AdaptiqAI's knowledge tools for ${app}...`);
+  await mkdir2(mcpDir(context2), { recursive: true });
+  const done = await context2.run(npm, ["install", "--prefix", mcpDir(context2), "--no-audit", "--no-fund", PACKAGE], { timeoutMs: 3e5 });
+  if (done.code === 0 && existsSync2(mcpServer(context2)) || had) return;
+  const said = `${done.stderr}
+${done.stdout}`.trim().split("\n").pop() ?? "";
+  throw new Problem("tools_not_installed", `AdaptiqAI's knowledge tools for ${app} could not be installed, so ${app} was left as it was. Check the connection, then run this again.${said === "" ? "" : ` npm said: ${said}`}`, { app });
+}
 
 // src/apps/claude-code.ts
 var LAUNCHER = "adaptiq-claude";
-var ALIASES = ["ANTHROPIC_DEFAULT_FABLE_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL", "CLAUDE_CODE_SUBAGENT_MODEL"];
-var MOST_OUTPUT = 128e3;
+var ALIASES = ["ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL", "CLAUDE_CODE_SUBAGENT_MODEL"];
+var MOST_OUTPUT = 16e3;
+var KEEP_JS = [
+  'const fs=require("fs"),e=process.env,file=e.AQ_USER,',
+  'read=(f)=>{try{return JSON.parse(fs.readFileSync(f,"utf8"))}catch(x){return x.code==="ENOENT"?{}:null}},',
+  "ours=((read(e.AQ_MODELS)||{}).options||[]).map((o)=>o.model),s=read(file);",
+  'if(!s||typeof s!=="object"||Array.isArray(s))process.exit(0);',
+  'if(!ours.includes(s.model)){if(process.argv[2]==="start")fs.writeFileSync(e.AQ_WAS,JSON.stringify({model:s.model??null}));process.exit(0)}',
+  "const was=(read(e.AQ_WAS)||{}).model;if(was==null||ours.includes(was))delete s.model;else s.model=was;",
+  'const tmp=file+".adaptiq";fs.writeFileSync(tmp,JSON.stringify(s,null,2)+"\\n",{mode:fs.statSync(file).mode&0o777});',
+  "fs.renameSync(tmp,file)"
+].join("\n");
 var SETTINGS = [
   // AdaptiqAI keeps the whole conversation in native memory, so Claude Code does not compact it by itself; /compact still does.
   ["DISABLE_AUTO_COMPACT", "1"],
@@ -353,20 +474,24 @@ var SETTINGS = [
   ["CLAUDE_CODE_SUBAGENT_MODEL_FORCE", "1"],
   ["CLAUDE_CODE_AUTO_MODE_SERVER", "0"],
   // Each request says whether it is the chat's, an agent's or a side request, so the gateway keeps one session per chat.
-  ["CLAUDE_CODE_GATEWAY_HINT_HEADERS", "1"]
+  ["CLAUDE_CODE_GATEWAY_HINT_HEADERS", "1"],
+  // Behind a gateway Claude Code hides MCP tools behind its tool search, so the model would see AdaptiqAI's knowledge tools by name only.
+  ["ENABLE_TOOL_SEARCH", "false"]
 ];
+var ALLOW = ["mcp__adaptiqai__adaptiq_knowledge", "mcp__adaptiqai__adaptiq_memory"];
 var folder = (context2) => configDir(context2.env, context2.home);
-var keyFile = (context2) => join5(folder(context2), "claude-code.key");
-var bin = (context2) => join5(context2.home, ".local", "bin");
+var keyFile = (context2) => join6(folder(context2), "claude-code.key");
+var bin = (context2) => join6(context2.home, ".local", "bin");
 var name = (context2) => context2.platform === "win32" ? `${LAUNCHER}.cmd` : LAUNCHER;
 async function launcherDir(context2) {
   const claude = which("claude", context2.env, context2.platform);
   if (claude === void 0) return bin(context2);
   return await access(dirname2(claude), constants2.W_OK).then(() => dirname2(claude), () => bin(context2));
 }
-var installed = (context2) => which(LAUNCHER, context2.env, context2.platform) ?? [join5(bin(context2), name(context2))].find(existsSync2);
+var installed = (context2) => which(LAUNCHER, context2.env, context2.platform) ?? [join6(bin(context2), name(context2))].find(existsSync3);
 function posix(context2, model2) {
   const output = Math.min(model2.output, MOST_OUTPUT);
+  const env = mcpEnv(context2);
   return [
     "#!/bin/sh",
     "# Claude Code on AdaptiqAI, from `npx -y adaptiqai connect claude-code`. Running it again writes this again.",
@@ -376,27 +501,61 @@ function posix(context2, model2) {
     `M=$(printf %s "\${ADAPTIQ_MODEL:-${model2.id}}" | tr -cd 'A-Za-z0-9._:/-')`,
     `S='{"env":{"ANTHROPIC_BASE_URL":"${context2.origin}"'`,
     `for A in ${ALIASES.join(" ")}; do S="$S,\\"$A\\":\\"$M\\""; done`,
+    // The window and the answer length are the launcher's model's: another one in ADAPTIQ_MODEL has its own.
+    `[ "$M" = '${model2.id}' ] && S="$S"',"CLAUDE_CODE_MAX_CONTEXT_TOKENS":"${CONVERSATION_TOKENS}"'`,
     ...output > 0 ? [`[ "$M" = '${model2.id}' ] && S="$S"',"CLAUDE_CODE_MAX_OUTPUT_TOKENS":"${output}"'`] : [],
-    `S="$S"',"CLAUDE_CODE_MAX_CONTEXT_TOKENS":"${CONVERSATION_TOKENS}"${SETTINGS.map(([key, value]) => `,"${key}":"${value}"`).join("")}'`,
+    // The plugin's hook reads Claude Code's own environment for an AdaptiqAI other than production.
+    `S="$S"'${[...SETTINGS, ...Object.entries(env ?? {})].map(([key, value]) => `,"${key}":"${value}"`).join("")}'`,
+    // A Node.js AdaptiqAI installed comes last, for the MCP server, the guard below and a Claude Code npm put there.
+    `PATH="$PATH:${ADAPTIQ_NODE_BIN}"`,
+    // Once a day /model takes the models the workspace has now, in place of Anthropic's lineup, so a model added later
+    // shows up by itself. The first start waits up to 5 seconds. The key goes to curl on its input, never in its
+    // arguments. Only one line of ASCII shaped as the list is kept: a failure, or any other answer, keeps the list there was.
+    'L="$D/claude-code-models.json"; V="$L.checked"',
+    `aq_list() { case "$1" in '{"options":[{"model":'*'}],"replaceBuiltInOptions":true}') ;; *) return 1 ;; esac; ! printf %s "$1" | LC_ALL=C grep -q '[^ -~]'; }`,
+    `aq_models() { printf 'Authorization: Bearer %s\\n' "$K" | curl -fsS --max-time "$1" -H @- '${context2.origin}/v1/cli-auth/claude-code/models' -o "$L.new" 2>/dev/null && aq_list "$(cat "$L.new")" && mv -f "$L.new" "$L"; rm -f "$L.new"; }`,
+    'if command -v curl >/dev/null 2>&1 && [ -z "$(find "$V" -mtime -1 2>/dev/null)" ]; then touch "$V"; if [ -s "$L" ]; then ( aq_models 20 ) </dev/null >/dev/null 2>&1 & else aq_models 5; fi; fi',
+    'Q=$(cat "$L" 2>/dev/null); aq_list "$Q" || Q=',
+    // A pick in /model is saved as the person's own default, where plain claude would then ask Anthropic for an
+    // AdaptiqAI model. So the list goes in only with Node.js to undo that, as the session ends and at the next start.
+    "command -v node >/dev/null 2>&1 || Q=",
+    'export AQ_KEEP="$D/claude-code-keep.js" AQ_MODELS="$L" AQ_WAS="$D/claude-code-own-model.json" AQ_USER="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"',
+    `[ -z "$Q" ] || { cat >"$AQ_KEEP" <<'KEEP'`,
+    KEEP_JS,
+    "KEEP",
+    'node "$AQ_KEEP" start; }',
+    `[ -n "$Q" ] && Q=",\\"modelPicker\\":$Q"',"hooks":{"SessionEnd":[{"hooks":[{"type":"command","command":"node \\"$AQ_KEEP\\" end"}]}]}'`,
     `F="$D/claude-code-$(printf %s "$M" | tr '/:' '__').json"`,
-    `( umask 077; printf '%s,"ANTHROPIC_AUTH_TOKEN":"%s","ANTHROPIC_API_KEY":""}}' "$S" "$K" >"$F" && chmod 600 "$F" ) || exit 1`,
+    `( umask 077; printf '%s,"ANTHROPIC_AUTH_TOKEN":"%s","ANTHROPIC_API_KEY":""},"permissions":{"allow":${JSON.stringify(ALLOW)}}%s}' "$S" "$K" "$Q" >"$F" && chmod 600 "$F" ) || exit 1`,
     // Claude Code's own local install is often only an alias, which a script does not see.
     'command -v claude >/dev/null 2>&1 || PATH="$HOME/.claude/local:$HOME/.local/bin:$PATH"',
     "unset ANTHROPIC_API_KEY",
     'export ANTHROPIC_AUTH_TOKEN="$K"',
+    // The server takes its key from Claude Code's environment. Its config comes before --settings: --mcp-config takes every word after it up to the next option.
+    'X="$D/mcp/node_modules/.bin/adaptiqai-mcp"; C="$D/claude-code-mcp.json"',
+    // Beside Claude Code, never before it: a slow npm delays no start, and the update takes effect at the next.
+    `( ${MCP_UPDATE} ) </dev/null >/dev/null 2>&1 &`,
+    // The server's Claude Code plugin, where the server installed carries one; --plugin-dir must name one.
+    'P="$D/mcp/node_modules/@adaptiqai/mcp/claude-code"',
+    `if [ -x "$X" ] && printf '{"mcpServers":{"adaptiqai":{"command":"%s"${env === void 0 ? "" : `,"env":${JSON.stringify(env)}`}}}}\\n' "$X" >"$C"; then`,
+    '  [ -f "$P/.claude-plugin/plugin.json" ] && exec claude --model "$M" --plugin-dir "$P" --mcp-config "$C" --settings "$F" "$@"',
+    '  exec claude --model "$M" --mcp-config "$C" --settings "$F" "$@"',
+    "fi",
     'exec claude --model "$M" --settings "$F" "$@"',
     ""
   ].join("\n");
 }
+var mcpConfig = (context2) => join6(folder(context2), "claude-code-mcp.json");
 function windows(context2, model2) {
-  const file4 = join5(folder(context2), "claude-code.json");
+  const file3 = join6(folder(context2), "claude-code.json");
+  const tools2 = existsSync3(mcpServer(context2)) ? ` --mcp-config "${mcpConfig(context2)}"` : "";
   return [
     "@echo off",
     "rem Claude Code on AdaptiqAI, from npx -y adaptiqai connect claude-code. Running it again writes this again.",
     "setlocal",
     'set "ANTHROPIC_API_KEY="',
     `set /p ANTHROPIC_AUTH_TOKEN=<"${keyFile(context2)}"`,
-    `claude --model "${model2.id}" --settings "${file4}" %*`,
+    `claude --model "${model2.id}"${tools2} --settings "${file3}" %*`,
     ""
   ].join("\r\n");
 }
@@ -411,7 +570,8 @@ function settingsJson(context2, model2, key) {
       ...Object.fromEntries(SETTINGS),
       ANTHROPIC_AUTH_TOKEN: key,
       ANTHROPIC_API_KEY: ""
-    }
+    },
+    permissions: { allow: ALLOW }
   }, null, 2)}
 `;
 }
@@ -420,10 +580,13 @@ var claudeCode = {
   aliases: ["claude"],
   name: "Claude Code",
   install: "npm install -g @anthropic-ai/claude-code",
-  does: "Added `adaptiq-claude`, which starts Claude Code on AdaptiqAI. Your own Claude Code stays as it is.",
+  does: "Added `adaptiq-claude`, which starts Claude Code on AdaptiqAI with your memory and knowledge. Your own Claude Code stays as it is.",
   // The console knows a setup that lasts by this name.
   signsInAs: async () => LAUNCHER,
-  found: async (context2) => command(context2, "claude", [join5(context2.home, ".claude", "local", "claude")]) !== void 0,
+  found: async (context2) => command(context2, "claude", [join6(context2.home, ".claude", "local", "claude")]) !== void 0,
+  async prepare(context2) {
+    await installMcp(context2, "Claude Code");
+  },
   async current(context2) {
     const path = installed(context2);
     const text = path === void 0 ? void 0 : await readText(path);
@@ -439,16 +602,19 @@ var claudeCode = {
   },
   async apply(context2, facts) {
     const [model2] = facts.models;
-    await mkdir2(folder(context2), { recursive: true, mode: 448 });
+    await mkdir3(folder(context2), { recursive: true, mode: 448 });
     await chmod2(folder(context2), 448).catch(() => {
     });
     await writeWhole(keyFile(context2), `${facts.key}
 `, null, { secret: true });
-    const dir3 = await launcherDir(context2);
-    await mkdir2(dir3, { recursive: true });
-    const launcher = join5(dir3, name(context2));
+    const dir2 = await launcherDir(context2);
+    await mkdir3(dir2, { recursive: true });
+    const launcher = join6(dir2, name(context2));
     if (context2.platform === "win32") {
-      await writeWhole(join5(folder(context2), "claude-code.json"), settingsJson(context2, model2, facts.key), null, { secret: true });
+      await writeWhole(join6(folder(context2), "claude-code.json"), settingsJson(context2, model2, facts.key), null, { secret: true });
+      const env = mcpEnv(context2);
+      if (existsSync3(mcpServer(context2))) await writeWhole(mcpConfig(context2), `${JSON.stringify({ mcpServers: { adaptiqai: { command: mcpServer(context2), ...env === void 0 ? {} : { env } } } })}
+`, null);
       await writeWhole(launcher, windows(context2, model2), context2.backups);
     } else {
       await writeWhole(launcher, posix(context2, model2), context2.backups, { mode: 493 });
@@ -460,217 +626,95 @@ var claudeCode = {
     if (path !== void 0) await removeFile(path);
     await removeFile(keyFile(context2));
     const left = await readdir(folder(context2)).catch(() => []);
-    for (const file4 of left.filter((entry2) => /^claude-code.*\.json$/u.test(entry2))) await removeFile(join5(folder(context2), file4));
+    for (const file3 of left.filter((entry2) => /^claude-code.*\.json$/u.test(entry2))) await removeFile(join6(folder(context2), file3));
+  },
+  async clean(context2) {
+    const settings = (await readdir(folder(context2)).catch(() => [])).filter((entry2) => /^claude-code.*\.json$/u.test(entry2)).map((entry2) => join6(folder(context2), entry2));
+    const removed = [];
+    if (await removeFile(keyFile(context2))) removed.push(keyFile(context2));
+    for (const file3 of settings) if (await fileHoldsKey(file3) && await removeFile(file3)) removed.push(file3);
+    return { removed, left: [] };
   },
   async start(context2) {
     if (which(LAUNCHER, context2.env, context2.platform) !== void 0) return LAUNCHER;
-    return installed(context2) ?? join5(await launcherDir(context2), name(context2));
-  }
-};
-
-// src/apps/cline.ts
-import { createHash, randomBytes } from "node:crypto";
-import { existsSync as existsSync3 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join7 } from "node:path";
-
-// src/record.ts
-import { join as join6 } from "node:path";
-import { mkdir as mkdir3 } from "node:fs/promises";
-var file = (context2, app) => join6(cliDir(context2), `${app.id}.json`);
-async function remember(context2, app, values) {
-  if (Object.keys(await readJson(file(context2, app))).length > 0) return;
-  await mkdir3(cliDir(context2), { recursive: true, mode: 448 });
-  await writeWhole(file(context2, app), `${JSON.stringify({ had: true, ...values }, null, 2)}
-`, null, { secret: true });
-}
-async function recall(context2, app) {
-  return await readJson(file(context2, app));
-}
-var forget = async (context2, app) => {
-  await removeFile(file(context2, app));
-};
-
-// src/apps/cline.ts
-var ID = "adaptiq";
-var dir = (context2) => join7(context2.env.CLINE_DATA_DIR ?? join7(context2.env.CLINE_DIR ?? join7(context2.home, ".cline"), "data"), "settings");
-var file2 = (context2, name2) => join7(dir(context2), name2);
-var HUB = "^[^ ]+ --cline-hub-daemon( |$)";
-function clineModel(model2) {
-  const { input, ...window } = modelWindow(model2);
-  return {
-    id: model2.id,
-    capabilities: ["streaming", "tools", ...model2.reasoning === null ? [] : ["reasoning"], ...input === void 0 ? [] : ["images"]],
-    ...model2.reasoning === null ? {} : { supportsReasoning: true },
-    ...window
-  };
-}
-async function apply(context2, facts) {
-  const base = apiBase(context2);
-  const entries = facts.models.map(clineModel);
-  const chosen = facts.models[0].id;
-  const { key } = facts;
-  const providers = record(await readJson(file2(context2, "providers.json")));
-  const settings = await readJson(file2(context2, "global-settings.json"));
-  await remember(context2, cline, { lastUsedProvider: providers.lastUsedProvider ?? null, compactionEnabled: settings.compactionEnabled ?? null });
-  await updateJson(file2(context2, "models.json"), (value) => {
-    const all = record(value.providers);
-    const had = record(record(all[ID]).models);
-    value.version = 1;
-    value.providers = {
-      ...all,
-      [ID]: {
-        provider: {
-          name: "AdaptiqAI",
-          baseUrl: base,
-          defaultModelId: chosen,
-          capabilities: ["streaming", "tools", ...facts.models.every((model2) => model2.reasoning !== null) ? ["reasoning"] : []],
-          modelsSourceUrl: `${base}/models`
-        },
-        models: Object.fromEntries(entries.map((entry2) => {
-          const id = String(entry2.id);
-          const own = record(had[id]);
-          return [id, { ...own, ...entry2, name: own.name ?? id }];
-        })),
-        discoveredModelIds: entries.map((entry2) => entry2.id)
-      }
-    };
-  }, context2.backups, { secret: true });
-  await updateJson(file2(context2, "providers.json"), (value) => {
-    const all = record(value.providers);
-    const was = record(all[ID]);
-    const wanted = { provider: ID, apiKey: key, baseUrl: base, model: chosen };
-    const same = sameJson(was.settings) === sameJson(wanted);
-    value.version = 1;
-    value.modes = value.modes ?? {};
-    value.providers = { ...all, [ID]: { settings: wanted, updatedAt: same ? was.updatedAt : new Date(context2.now()).toISOString(), tokenSource: "manual" } };
-    value.lastUsedProvider = ID;
-  }, context2.backups, { secret: true });
-  await updateJson(file2(context2, "global-settings.json"), (value) => {
-    value.compactionEnabled = false;
-  }, context2.backups, { secret: true });
-}
-var HEX = (text) => Buffer.from(text, "utf16le").toString("hex");
-async function appState(context2, facts) {
-  const root = join7(context2.home, "Library", "WebKit", "bot.cline.app", "WebsiteData", "Default");
-  const saltFile = join7(root, "salt");
-  await mkdir4(root, { recursive: true });
-  if (!existsSync3(saltFile)) await writeFile2(saltFile, randomBytes(8));
-  const folder2 = createHash("sha256").update(Buffer.concat([Buffer.from("tauri://localhost"), await readFile2(saltFile)])).digest("base64url");
-  const home3 = join7(root, folder2, folder2);
-  await mkdir4(join7(home3, "LocalStorage"), { recursive: true });
-  const part = (text) => {
-    const bytes = Buffer.from(text);
-    const size = Buffer.alloc(4);
-    size.writeUInt32LE(bytes.length);
-    return Buffer.concat([size, Buffer.from([1]), bytes]);
-  };
-  const one = Buffer.concat([part("tauri"), part("localhost"), Buffer.from([0])]);
-  const origin = join7(home3, "origin");
-  if (!existsSync3(origin)) await writeFile2(origin, Buffer.concat([one, one]));
-  const store = join7(home3, "LocalStorage", "localstorage.sqlite3");
-  const sql = async (text) => {
-    const done = await context2.run("sqlite3", [store, text], { timeoutMs: 1e4 });
-    if (done.code !== 0) throw new Error("sqlite3 failed");
-    return done.stdout.trim();
-  };
-  const blob = (value) => `X'${HEX(JSON.stringify(value))}'`;
-  const read = async (key) => {
-    try {
-      return record(JSON.parse(Buffer.from(await sql(`SELECT hex(value) FROM ItemTable WHERE key='${key}'`), "hex").toString("utf16le")));
-    } catch {
-      return {};
-    }
-  };
-  const SELECTION = "cline.code.model-selection.v1";
-  const EFFORT = "cline.code.reasoning-selection.v1";
-  await sql("CREATE TABLE IF NOT EXISTS ItemTable (key TEXT UNIQUE ON CONFLICT REPLACE, value BLOB NOT NULL ON CONFLICT FAIL)");
-  const selection = await read(SELECTION);
-  const chosen = { lastProvider: ID, lastModelByProvider: { ...record(selection.lastModelByProvider), [ID]: facts.models[0].id } };
-  if (sameJson(selection) !== sameJson(chosen)) {
-    await sql(`INSERT INTO ItemTable VALUES('${SELECTION}',${blob(chosen)});INSERT OR IGNORE INTO ItemTable VALUES('cline.code.onboarding.v1',${blob({ completedAt: new Date(context2.now()).toISOString() })})`);
-  }
-  const level = facts.models[0].reasoning?.defaultLevel ?? "";
-  const picked = await read(EFFORT);
-  if (["low", "medium", "high", "xhigh"].includes(level) && picked[ID] === void 0) {
-    await sql(`INSERT INTO ItemTable VALUES('${EFFORT}',${blob({ ...picked, [ID]: level })})`);
-  }
-}
-async function restart(context2) {
-  if (context2.platform === "darwin") await context2.run("osascript", ["-e", 'quit app "Cline"'], { timeoutMs: 35e3 }).catch(() => void 0);
-  else await context2.run("pkill", ["-x", "cline-app"], { timeoutMs: 5e3 }).catch(() => void 0);
-  await context2.run("pkill", ["-f", "--", HUB], { timeoutMs: 5e3 }).catch(() => void 0);
-  for (let tries = 0; tries < 10 && await busy(context2); tries++) await context2.sleep(500);
-  await context2.run("pkill", ["-x", "cline-app"], { timeoutMs: 5e3 }).catch(() => void 0);
-  return !await busy(context2);
-}
-async function busy(context2) {
-  if (context2.platform === "win32") return false;
-  if (await running(context2, "cline-app")) return true;
-  return (await context2.run("pgrep", ["-f", "--", HUB], { timeoutMs: 5e3 }).catch(() => void 0))?.code === 0;
-}
-var cline = {
-  id: "cline",
-  name: "Cline",
-  install: "npm install -g cline",
-  does: "Added AdaptiqAI to Cline and turned off its automatic compaction, for every model. Your other providers stay.",
-  signsInAs: async () => "Cline",
-  found: async (context2) => command(context2, "cline") !== void 0 || command(context2, "cline-app") !== void 0 || macApp(context2, "Cline") !== void 0 || existsSync3(dir(context2)),
-  async prepare(context2) {
-    await Promise.all(["providers.json", "models.json", "global-settings.json"].map((name2) => readJson(file2(context2, name2))));
-  },
-  async current(context2) {
-    const settings = record(record(record(await readJson(file2(context2, "providers.json"))).providers)[ID]).settings;
-    const { baseUrl, model: model2, apiKey } = record(settings);
-    return typeof baseUrl === "string" ? { base: baseUrl, ...typeof model2 === "string" ? { model: model2 } : {}, ...typeof apiKey === "string" ? { key: apiKey } : {} } : {};
+    return installed(context2) ?? join6(await launcherDir(context2), name(context2));
   },
-  async apply(context2, facts) {
-    await apply(context2, facts);
-    const notes = [];
-    if (await busy(context2) && !(await context2.confirm("Cline is running, and reads its settings when it starts. Quit it now?") && await restart(context2))) {
-      notes.push("Cline is running. Quit it and open it again to see AdaptiqAI.");
-    }
-    if (macApp(context2, "Cline") !== void 0 && !await busy(context2)) await appState(context2, facts).catch(() => {
-    });
-    return notes;
-  },
-  async remove(context2) {
-    const had = await recall(context2, cline);
-    await updateJson(file2(context2, "providers.json"), (value) => {
-      const all = record(value.providers);
-      delete all[ID];
-      value.providers = all;
-      if (value.lastUsedProvider === ID) {
-        if (typeof had.lastUsedProvider === "string") value.lastUsedProvider = had.lastUsedProvider;
-        else delete value.lastUsedProvider;
-      }
-    }, context2.backups, { secret: true });
-    await updateJson(file2(context2, "models.json"), (value) => {
-      const all = record(value.providers);
-      delete all[ID];
-      value.providers = all;
-    }, context2.backups, { secret: true });
-    if ("compactionEnabled" in had) {
-      await updateJson(file2(context2, "global-settings.json"), (value) => {
-        if (had.compactionEnabled === null) delete value.compactionEnabled;
-        else value.compactionEnabled = had.compactionEnabled;
-      }, context2.backups, { secret: true });
-    }
-    await forget(context2, cline);
-  },
-  start: async (context2) => macApp(context2, "Cline") === void 0 ? "cline" : "open -a Cline"
+  greet: async (context2, model2, hello2) => context2.platform === "win32" ? void 0 : `${shellWord(await claudeCode.start(context2, model2))} ${shellWord(hello2)}`
 };
 
 // src/apps/codex.ts
-import { chmod as chmod3, mkdir as mkdir5 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+import { chmod as chmod3, mkdir as mkdir4 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 var PROVIDER = "adaptiqai-connect";
-var home = (context2) => context2.env.CODEX_HOME ?? join8(context2.home, ".codex");
-var profile = (context2) => join8(home(context2), "adaptiq.config.toml");
-var catalog = (context2) => join8(home(context2), "adaptiq.models.json");
-var keyFile2 = (context2) => join8(configDir(context2.env, context2.home), "codex.key");
+var home = (context2) => context2.env.CODEX_HOME ?? join7(context2.home, ".codex");
+var profile = (context2) => join7(home(context2), "adaptiq.config.toml");
+var catalog = (context2) => join7(home(context2), "adaptiq.models.json");
+var keyFile2 = (context2) => join7(configDir(context2.env, context2.home), "codex.key");
+var wrapper = (context2) => join7(configDir(context2.env, context2.home), context2.platform === "win32" ? "codex-mcp.cmd" : "codex-mcp");
 var codexCommand = (context2) => command(context2, "codex") ?? "codex";
 var toml = (text) => JSON.stringify(text);
+var REFRESH_JS = [
+  'const fs=require("fs"),[file,body]=process.argv.slice(1),',
+  'now=JSON.parse(fs.readFileSync(file,"utf8")).models,got=JSON.parse(body).models;',
+  'if(Array.isArray(now)&&now.length&&Array.isArray(got)&&got.length&&got.every((m)=>m&&typeof m.slug=="string"&&m.slug&&typeof m.display_name=="string"',
+  "&&Number.isInteger(m.priority)&&Array.isArray(m.supported_reasoning_levels)&&Array.isArray(m.input_modalities))){",
+  "const{slug,display_name,priority,supported_reasoning_levels,default_reasoning_level,context_window,",
+  'max_context_window,effective_context_window_percent,input_modalities,...rest}=now[0],tmp=file+".adaptiq";',
+  "fs.writeFileSync(tmp,JSON.stringify({models:got.map((m)=>({...rest,...m}))}));fs.renameSync(tmp,file)}"
+].join("\n");
+var catalogUpdate = (context2) => [
+  'V="$D/codex-models.checked"; C="${CODEX_HOME:-$HOME/.codex}/adaptiq.models.json";',
+  ' if [ -f "$C" ] && command -v curl >/dev/null 2>&1 && command -v node >/dev/null 2>&1 && [ -z "$(find "$V" -mtime -1 2>/dev/null)" ]; then touch "$V";\n',
+  `T=$(printf 'Authorization: Bearer %s\\n' "$(tr -cd 'A-Za-z0-9._-' <"$D/codex.key")" | curl -fsS --max-time 20 -H @- '${context2.origin}/v1/cli-auth/codex/models') && node -e '
+`,
+  REFRESH_JS,
+  `' "$C" "$T"; fi`
+].join("");
+function wrapperText(context2) {
+  if (context2.platform === "win32") {
+    return [
+      "@echo off",
+      "rem AdaptiqAI's MCP server for Codex, from npx -y adaptiqai connect codex. Running it again writes this again.",
+      'set /p ADAPTIQAI_API_KEY=<"%~dp0codex.key"',
+      '"%~dp0mcp\\node_modules\\.bin\\adaptiqai-mcp.cmd" %*',
+      ""
+    ].join("\r\n");
+  }
+  return [
+    "#!/bin/sh",
+    "# AdaptiqAI's MCP server for Codex, from `npx -y adaptiqai connect codex`. Running it again writes this again.",
+    'D=$(dirname "$0"); X="$D/mcp/node_modules/.bin/adaptiqai-mcp"',
+    // A Node.js AdaptiqAI installed comes last: the server and npm run on it where there is no other.
+    `PATH="$PATH:${ADAPTIQ_NODE_BIN}"`,
+    `( ${MCP_UPDATE} ) </dev/null >/dev/null 2>&1 &`,
+    `( ${catalogUpdate(context2)} ) </dev/null >/dev/null 2>&1 &`,
+    'ADAPTIQAI_API_KEY=$(cat "$D/codex.key") exec "$X" "$@"',
+    ""
+  ].join("\n");
+}
+function tools(context2) {
+  if (!existsSync4(mcpServer(context2))) return [];
+  const env = mcpEnv(context2);
+  const windows2 = context2.platform === "win32";
+  const prefix = env === void 0 ? "" : Object.entries(env).map(([name2, value]) => `${name2}='${value}' `).join("");
+  return [
+    "[mcp_servers.adaptiqai]",
+    ...windows2 ? ['command = "cmd"', `args = ["/d", "/c", ${toml(wrapper(context2))}]`] : [`command = ${toml(wrapper(context2))}`],
+    'env_vars = ["CODEX_HOME"]',
+    ...env === void 0 ? [] : [`env = { ${Object.entries(env).map(([name2, value]) => `${name2} = ${toml(value)}`).join(", ")} }`],
+    "",
+    ...["adaptiq_knowledge", "adaptiq_memory"].flatMap((tool) => [`[mcp_servers.adaptiqai.tools.${tool}]`, 'approval_mode = "approve"', ""]),
+    ...windows2 || !mcpHasHook(context2) ? [] : [
+      "[[hooks.UserPromptSubmit]]",
+      "[[hooks.UserPromptSubmit.hooks]]",
+      'type = "command"',
+      `command = ${toml(`${prefix}ADAPTIQAI_API_KEY="$(cat '${keyFile2(context2)}')" exec '${mcpServer(context2)}' hook codex`)}`,
+      "timeout = 30",
+      ""
+    ]
+  ];
+}
 function config(context2, facts) {
   const [model2] = facts.models;
   const path = keyFile2(context2);
@@ -694,7 +738,8 @@ function config(context2, facts) {
     `[model_providers.${PROVIDER}.auth]`,
     `command = ${toml(read[0])}`,
     `args = [${read[1].map(toml).join(", ")}]`,
-    ""
+    "",
+    ...tools(context2)
   ].join("\n");
 }
 function catalogEntry(model2, priority, instructions2) {
@@ -736,11 +781,12 @@ var codex = {
   id: "codex",
   name: "Codex",
   install: "npm install -g @openai/codex",
-  does: "Added the `adaptiq` profile, which starts Codex on AdaptiqAI. Your own Codex stays as it is.",
+  does: "Added the `adaptiq` profile, which starts Codex on AdaptiqAI with your memory and knowledge. Your own Codex stays as it is.",
   signsInAs: async () => "Codex",
   found: async (context2) => command(context2, "codex") !== void 0,
   async prepare(context2) {
     await instructions(context2);
+    await installMcp(context2, "Codex");
   },
   async current(context2) {
     const text = await readText(profile(context2));
@@ -753,14 +799,14 @@ var codex = {
   async apply(context2, facts) {
     const prompt = await instructions(context2);
     const folder2 = configDir(context2.env, context2.home);
-    await mkdir5(folder2, { recursive: true, mode: 448 });
+    await mkdir4(folder2, { recursive: true, mode: 448 });
     await chmod3(folder2, 448).catch(() => {
     });
     await writeWhole(keyFile2(context2), `${facts.key}
 `, null, { secret: true });
-    await mkdir5(home(context2), { recursive: true });
-    await writeWhole(catalog(context2), `${JSON.stringify({ models: facts.models.map((model2, priority) => catalogEntry(model2, priority, prompt)) })}
-`, null);
+    await writeWhole(wrapper(context2), wrapperText(context2), null, { mode: 493 });
+    await mkdir4(home(context2), { recursive: true });
+    await writeWhole(catalog(context2), JSON.stringify({ models: facts.models.map((model2, priority) => catalogEntry(model2, priority, prompt)) }), null);
     await writeWhole(profile(context2), config(context2, facts), context2.backups, { secret: true });
     return [];
   },
@@ -768,15 +814,41 @@ var codex = {
     await removeFile(profile(context2));
     await removeFile(catalog(context2));
     await removeFile(keyFile2(context2));
+    await removeFile(wrapper(context2));
   },
-  start: async () => "codex --profile adaptiq"
+  // With Codex taken off this computer, or its profile, there was nothing to remove, and the key stayed in its file.
+  clean: async (context2) => ({ removed: await removeFile(keyFile2(context2)) ? [keyFile2(context2)] : [], left: [] }),
+  start: async () => "codex --profile adaptiq",
+  greet: async (context2, _model, hello2) => context2.platform === "win32" ? void 0 : `codex --profile adaptiq ${shellWord(hello2)}`
 };
 
 // src/apps/deepseek.ts
-import { chmod as chmod4, mkdir as mkdir6, mkdtemp as mkdtemp2, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import { existsSync as existsSync4 } from "node:fs";
+import { createHash } from "node:crypto";
+import { access as access2, chmod as chmod4, constants as constants3, mkdir as mkdir6, mkdtemp as mkdtemp2, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
+import { createWriteStream, existsSync as existsSync5 } from "node:fs";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { delimiter as delimiter2, join as join9 } from "node:path";
+
+// src/record.ts
+import { join as join8 } from "node:path";
+import { mkdir as mkdir5 } from "node:fs/promises";
+var file = (context2, app) => join8(cliDir(context2), `${app.id}.json`);
+async function remember(context2, app, values) {
+  if (Object.keys(await readJson(file(context2, app))).length > 0) return;
+  await mkdir5(cliDir(context2), { recursive: true, mode: 448 });
+  await writeWhole(file(context2, app), `${JSON.stringify({ had: true, ...values }, null, 2)}
+`, null, { secret: true });
+}
+async function recall(context2, app) {
+  return await readJson(file(context2, app));
+}
+var forget = async (context2, app) => {
+  await removeFile(file(context2, app));
+};
+
+// src/apps/deepseek.ts
 var PLUGIN = "@adaptiqai/deepseek-harness";
 var ITS = "AdaptiqAI's plugin for DeepSeek Harness";
 var BUNDLE = "com.deepseek.dsh";
@@ -788,6 +860,56 @@ var credentials = (context2) => join9(home2(context2), ".credentials.yaml");
 var appApp = (context2) => macApp(context2, "DeepSeek Harness");
 var appBinary = (app) => join9(app, "Contents", "MacOS", "DeepSeek Harness");
 var NPX = ["npx", "-y", "@deepseek-ai/dsh"];
+var TEAM = "NAN929V4UM";
+function feedField(feed, key) {
+  const lines = feed.split("\n");
+  const at = lines.findIndex((line) => line.startsWith(`${key}:`));
+  if (at < 0) return void 0;
+  const value = lines[at]?.slice(key.length + 1).trim() ?? "";
+  return (/^[>|]/u.test(value) ? lines[at + 1]?.trim() : value)?.split(/\s/u)[0] || void 0;
+}
+async function installMacApp(context2) {
+  const arm = (await context2.run("sysctl", ["-n", "hw.optional.arm64"], { timeoutMs: 5e3 }).catch(() => void 0))?.stdout.trim() === "1";
+  const feedUrl = `https://download.deepseek.com/dsh-desk/feeds/mac-${arm ? "arm64" : "x64"}/nightly-mac.yml`;
+  const temp = await mkdtemp2(join9(tmpdir2(), "adaptiq-dsh-"));
+  try {
+    const feed = await context2.fetch(feedUrl);
+    if (!feed.ok) return false;
+    const text = await feed.text();
+    const path = feedField(text, "path");
+    const sum = feedField(text, "sha512");
+    if (path === void 0 || sum === void 0) return false;
+    const url = new URL(path, feedUrl);
+    if (url.protocol !== "https:") return false;
+    context2.say.note("Downloading the DeepSeek Harness app...");
+    const zip = await context2.fetch(url.href);
+    if (!zip.ok || zip.body === null) return false;
+    const file3 = join9(temp, "app.zip");
+    const hash = createHash("sha512");
+    await pipeline(Readable.fromWeb(zip.body), async function* (chunks) {
+      for await (const chunk of chunks) {
+        hash.update(chunk);
+        yield chunk;
+      }
+    }, createWriteStream(file3));
+    if (hash.digest("base64") !== sum) return false;
+    const app = join9(temp, "DeepSeek Harness.app");
+    for (const [command2, args] of [
+      ["ditto", ["-x", "-k", file3, temp]],
+      ["spctl", ["-a", "-t", "exec", app]],
+      ["codesign", ["-v", `-R=anchor apple generic and certificate leaf[subject.OU] = ${TEAM}`, app]]
+    ]) {
+      if ((await context2.run(command2, [...args], { timeoutMs: 3e5 })).code !== 0) return false;
+    }
+    const folder2 = await access2("/Applications", constants3.W_OK).then(() => "/Applications", () => join9(context2.home, "Applications"));
+    if ((await context2.run("mkdir", ["-p", folder2], { timeoutMs: 1e4 })).code !== 0) return false;
+    return (await context2.run("mv", [app, `${folder2}/`], { timeoutMs: 12e4 })).code === 0;
+  } catch {
+    return false;
+  } finally {
+    await rm3(temp, { recursive: true, force: true });
+  }
+}
 var EDIT_APP = String.raw`
 const fs=require("fs"),path=require("path"),os=require("os");
 const [app,base,provider,root,site]=process.argv.slice(1),given=JSON.parse(provider),ids=given.models.map((m)=>m.id);
@@ -852,6 +974,21 @@ else patch.deleteIn([p])}}
 save(pf,patch)}
 }catch(e){quit(String(e&&e.message||e))}
 `;
+var CLEAN_APP = String.raw`
+const fs=require("fs"),path=require("path"),os=require("os");
+const [app,root]=process.argv.slice(1);
+const {parseDocument,isMap}=require(path.join(app,"Contents","Resources","app.asar","dsh","node_modules","yaml"));
+const home=process.env.DSH_HOME||path.join(os.homedir(),".dsh"),quit=(text)=>{console.error(text);process.exit(1)};
+try{
+const cf=path.join(home,".credentials.yaml");let text;
+try{text=fs.readFileSync(cf,"utf8")}catch(e){if(e.code==="ENOENT")process.exit(0);throw e}
+const keys=parseDocument(text,{customTags:[{tag:"tag:yaml.org,2002:js",resolve:(v)=>v}]});if(keys.errors.length)quit(cf+" is not valid YAML.");
+const refs=keys.get("refs");if(isMap(refs)){refs.delete("${APP_KEY}");if(!refs.items.length)keys.delete("refs")}
+if(keys.getIn(["records","adaptiq/workspace","payload","apiBase"])===root)keys.deleteIn(["records","adaptiq/workspace"]);
+if(String(keys)===text)process.exit(0);
+const tmp=cf+".adaptiq";fs.writeFileSync(tmp,String(keys),{mode:0o600});fs.chmodSync(tmp,0o600);fs.renameSync(tmp,cf);console.log("changed")
+}catch(e){quit(String(e&&e.message||e))}
+`;
 function dshModel(model2) {
   const { reasoning } = model2;
   return {
@@ -904,9 +1041,9 @@ async function withPnpm(context2, work) {
   if (which("pnpm", context2.env, context2.platform) !== void 0) return await work({});
   const bin2 = await mkdtemp2(join9(tmpdir2(), "adaptiq-pnpm-"));
   try {
-    if (context2.platform === "win32") await writeFile3(join9(bin2, "pnpm.cmd"), "@npx -y pnpm@11 %*\r\n");
+    if (context2.platform === "win32") await writeFile2(join9(bin2, "pnpm.cmd"), "@npx -y pnpm@11 %*\r\n");
     else {
-      await writeFile3(join9(bin2, "pnpm"), '#!/bin/sh\nexec npx -y pnpm@11 "$@"\n');
+      await writeFile2(join9(bin2, "pnpm"), '#!/bin/sh\nexec npx -y pnpm@11 "$@"\n');
       await chmod4(join9(bin2, "pnpm"), 493);
     }
     return await work({ PATH: `${bin2}${delimiter2}${context2.env.PATH ?? ""}` });
@@ -915,38 +1052,39 @@ async function withPnpm(context2, work) {
   }
 }
 async function makeAppProfile(context2, app) {
-  if (existsSync4(join9(profileDir(context2, "desktop"), "package.json"))) return;
+  if (existsSync5(join9(profileDir(context2, "desktop"), "package.json"))) return;
   const script = `(async()=>{const path=require("path"),url=require("url");const [app,prof]=process.argv.slice(1);
-const boot=await import(url.pathToFileURL(path.join(app,"Contents","Resources","app.asar","dsh","node_modules","@deepseek-ai","dsh-app-boot","lib","index.js")).href);
-boot.initProfile(prof,boot.PROFILE_TEMPLATES.web.bundles)})().catch((e)=>{console.error(String(e&&e.message||e));process.exit(1)})`;
+const lib=(pkg)=>import(url.pathToFileURL(path.join(app,"Contents","Resources","app.asar","dsh","node_modules","@deepseek-ai",pkg,"lib","index.js")).href);
+const boot=await lib("dsh-app-boot"),templates=boot.PROFILE_TEMPLATES||(await lib("dsh-official-bundles")).PROFILE_TEMPLATES;
+boot.initProfile(prof,templates.web.bundles)})().catch((e)=>{console.error(String(e&&e.message||e));process.exit(1)})`;
   const done = await context2.run(appBinary(app), ["-e", script, app, profileDir(context2, "desktop")], { env: { ELECTRON_RUN_AS_NODE: "1" }, timeoutMs: 6e4 });
   if (done.code !== 0) throw new Problem("app_refused", `DeepSeek Harness could not make its profile: ${done.stderr.trim().split("\n").pop() ?? ""}`);
 }
 async function applyApp(context2, facts, app, notes) {
-  const wasOpen = await open(context2);
+  const wasOpen = await open2(context2);
   const pluginThere = await installedVersion(context2, "desktop") !== "";
   const quit2 = wasOpen && await context2.confirm("DeepSeek Harness is open, and AdaptiqAI's plugin goes in while it is closed. Quit it now? It opens again after.");
   if (quit2 && !await quitMacApp(context2, BUNDLE)) throw new Problem("app_open", "DeepSeek Harness did not quit, so it was left as it was. Quit it, then run this again.");
   if (wasOpen && !quit2 && !pluginThere) throw new Problem("app_open", "DeepSeek Harness is open, and AdaptiqAI's plugin goes in while it is closed. Quit it, then run this again.");
   try {
-    if ((!wasOpen || quit2) && (!pluginThere || facts.deviceCode !== void 0)) {
+    if (!wasOpen || quit2) {
       await makeAppProfile(context2, app);
       await ensurePlugin(context2, [join9(app, "Contents", "Resources", "runtime", "cli", "bin", "dsh")], "desktop", {}, notes);
     }
     await rememberDefault(context2, "desktop");
     const files = [credentials(context2), join9(profileDir(context2, "desktop"), "cordis.patch.yml")];
-    for (const file4 of files) await context2.backups.keep(file4);
+    for (const file3 of files) await context2.backups.keep(file3);
     const edited = await context2.run(appBinary(app), ["-e", EDIT_APP, app, apiBase(context2), JSON.stringify(dshProvider(facts.models)), context2.origin, context2.console], {
       env: { ELECTRON_RUN_AS_NODE: "1", K: facts.key },
       timeoutMs: 6e4
     });
     if (edited.code !== 0) throw new Problem("app_refused", edited.stderr.trim().split("\n").pop() ?? "DeepSeek Harness's settings could not be changed.");
-    for (const file4 of files) await context2.backups.dropIfSame(file4);
+    for (const file3 of files) await context2.backups.dropIfSame(file3);
   } finally {
     if (quit2) await openMacApp(context2, app);
   }
 }
-var open = async (context2) => {
+var open2 = async (context2) => {
   const said = await context2.run("osascript", ["-e", `application id "${BUNDLE}" is running`], { timeoutMs: 5e3 }).catch(() => void 0);
   return said?.stdout.trim() === "true";
 };
@@ -960,7 +1098,7 @@ async function rememberDefault(context2, profile2) {
 async function applyWeb(context2, facts, notes) {
   const profile2 = profileDir(context2, "adaptiq");
   await withPnpm(context2, async (env2) => {
-    if (!existsSync4(profile2)) {
+    if (!existsSync5(profile2)) {
       const made = await context2.run(NPX[0], [...NPX.slice(1), "--profile", "adaptiq", "--from-default-profile", "web", "--dump-config"], { env: env2, timeoutMs: 6e5, cwd: context2.home });
       if (made.code !== 0) throw new Problem("app_refused", `DeepSeek Harness could not be fetched: ${made.stderr.trim().split("\n").pop() ?? ""}`);
     }
@@ -987,11 +1125,16 @@ var deepseek = {
   aliases: ["deepseek-harness", "dsh"],
   name: "DeepSeek Harness",
   install: "Get the app from deepseek.com.",
+  desktop: "https://www.deepseek.com/harness/",
+  installMacApp,
   does: "Installed AdaptiqAI's plugin in DeepSeek Harness, with your memory and knowledge. Your other providers stay.",
   fetched: true,
   // The app signs in under a name of its own, so the console knows it again.
   signsInAs: async (context2) => appApp(context2) === void 0 ? "DeepSeek Harness" : "DeepSeek Harness app",
-  found: async (context2) => appApp(context2) !== void 0 || existsSync4(home2(context2)),
+  found: async (context2) => appApp(context2) !== void 0 || existsSync5(home2(context2)),
+  async prepare(context2) {
+    if (appApp(context2) === void 0) await needNode(context2, "24.9.0", "DeepSeek Harness in the browser", ["connect", "deepseek"]);
+  },
   async current(context2) {
     const app = appApp(context2) !== void 0;
     const patch = await readText(join9(profileDir(context2, app ? "desktop" : "adaptiq"), "cordis.patch.yml")) ?? "";
@@ -1026,11 +1169,35 @@ var deepseek = {
     }
     await forget(context2, deepseek);
   },
+  async clean(context2) {
+    const removed = [];
+    const app = appApp(context2);
+    if (app !== void 0) {
+      await context2.backups.keep(credentials(context2));
+      const done = await context2.run(appBinary(app), ["-e", CLEAN_APP, app, context2.origin], { env: { ELECTRON_RUN_AS_NODE: "1" }, timeoutMs: 6e4 });
+      if (done.code !== 0) throw new Problem("app_refused", done.stderr.trim().split("\n").pop() ?? "DeepSeek Harness's credentials could not be changed.");
+      if (done.stdout.includes("changed")) removed.push(credentials(context2));
+      await context2.backups.dropIfSame(credentials(context2));
+    }
+    const env = join9(home2(context2), ".env");
+    const text = await readText(env);
+    if (text?.split("\n").some((line) => line.startsWith(`${WEB_KEY}=`)) === true) {
+      await writeWhole(env, `${text.split("\n").filter((line) => !line.startsWith(`${WEB_KEY}=`) && line !== "").join("\n")}
+`, context2.backups, { secret: true });
+      removed.push(env);
+    }
+    if (!await fileHoldsKey(credentials(context2))) return { removed, left: [] };
+    return {
+      removed,
+      left: [app === void 0 ? `DeepSeek Harness's credentials still hold an AdaptiqAI key (${credentials(context2)}), from a sign-in of AdaptiqAI's plugin. Start it (npx -y @deepseek-ai/dsh adaptiq) and type /adaptiq signout.` : `DeepSeek Harness's credentials still hold an AdaptiqAI key (${credentials(context2)}) that no setup of this AdaptiqAI wrote.`]
+    };
+  },
   start: async (context2) => appApp(context2) === void 0 ? "npx -y @deepseek-ai/dsh adaptiq" : 'open -a "DeepSeek Harness"'
 };
 
 // src/apps/hermes.ts
-import { join as join10 } from "node:path";
+import { readdir as readdir2 } from "node:fs/promises";
+import { dirname as dirname3, isAbsolute, join as join10 } from "node:path";
 var PLUGIN2 = "AdaptiqAI/hermes-plugin";
 var ENTRY = "adaptiqai-connect";
 var KEY_ENV = "ADAPTIQ_API_KEY";
@@ -1050,9 +1217,29 @@ async function envFile(context2) {
 }
 var envLine = new RegExp(`^\\s*(?:export\\s+)?${KEY_ENV}\\s*=`, "u");
 var withKey = (text, key) => {
-  const lines = text.split("\n").filter((line) => !envLine.test(line) && line !== "");
+  const lines = text.replace(/\n$/u, "").split("\n").filter((line) => !envLine.test(line));
+  if (lines.length === 1 && lines[0] === "") lines.pop();
   return [...lines, ...key === void 0 ? [] : [`${KEY_ENV}=${key}`], ""].join("\n");
 };
+async function gatewayRuns(file3) {
+  const pid = Number(/\d+/u.exec(await readText(join10(dirname3(file3), "gateway.pid")) ?? "")?.[0]);
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function hermesHome(context2) {
+  const file3 = await envFile(context2).catch(() => void 0);
+  return file3 === void 0 ? context2.env.HERMES_HOME ?? join10(context2.home, ".hermes") : dirname3(file3);
+}
+var SNAPSHOT = /^hermes-snap-[A-Za-z0-9]+\.sh(?:\.tmp\.[A-Za-z0-9]+)?$/u;
+var snapshotFolders = (context2, home3) => [.../* @__PURE__ */ new Set([
+  ...["TERMINAL_TEMP_DIR", "TMPDIR", "TMP", "TEMP"].map((name2) => context2.env[name2] ?? "").filter((path) => isAbsolute(path)),
+  join10(home3, "cache", "terminal")
+])];
 var modelBlock = async (context2) => {
   const said = await context2.run(hermes(context2), ["config", "get", "--json", "model"], { timeoutMs: 6e4 });
   if (said.code !== 0) return {};
@@ -1067,11 +1254,21 @@ var hermesApp = {
   id: "hermes",
   name: "Hermes Agent",
   install: "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash",
+  desktop: "https://hermes-agent.nousresearch.com/#downloads",
   does: "Added AdaptiqAI to Hermes as an endpoint of its own, and made it the main model. Your other providers stay.",
   signsInAs: async () => "Hermes Agent",
   found: async (context2) => command(context2, "hermes", [join10(context2.home, ".local", "bin", "hermes")]) !== void 0,
   async prepare(context2) {
     await envFile(context2);
+    const installed2 = await context2.run(hermes(context2), ["plugins", "list"], { timeoutMs: 6e4 });
+    const got = /adaptiq/iu.test(installed2.stdout) ? await context2.run(hermes(context2), ["plugins", "update", "adaptiq"], { timeoutMs: 18e4 }) : await context2.run(hermes(context2), ["plugins", "install", PLUGIN2, "--enable"], { timeoutMs: 18e4 });
+    if (await quietly(context2, "plugins", "enable", "adaptiq") !== 0) {
+      if (/could not read Username|Repository not found|Authentication failed/u.test(`${got.stdout}
+${got.stderr}`)) {
+        throw new Problem("tools_not_installed", "GitHub did not hand out AdaptiqAI's plugin for Hermes, so Hermes was left as it was. Running this again will not help until AdaptiqAI has fixed it: tell us under Help & support.");
+      }
+      throw new Problem("tools_not_installed", `AdaptiqAI's plugin for Hermes could not be installed, so Hermes was left as it was. Check the connection, then run this again, or install it yourself: hermes plugins install ${PLUGIN2} --enable`);
+    }
   },
   async current(context2) {
     const model2 = await modelBlock(context2);
@@ -1084,15 +1281,11 @@ var hermesApp = {
     const notes = [];
     const was = await modelBlock(context2);
     await remember(context2, hermesApp, { model: was.provider === ENTRY ? {} : Object.fromEntries(MODEL_FIELDS.map((field) => [field, was[field] ?? null])) });
-    const installed2 = await context2.run(hermes(context2), ["plugins", "list"], { timeoutMs: 6e4 });
-    if (!/adaptiq/iu.test(installed2.stdout)) {
-      const added = await context2.run(hermes(context2), ["plugins", "install", PLUGIN2], { timeoutMs: 18e4 });
-      if (added.code !== 0) notes.push("AdaptiqAI's plugin for Hermes could not be installed, so conversations have no memory of their own yet. Run: hermes plugins install AdaptiqAI/hermes-plugin");
-    }
+    await quietly(context2, "config", "set", "tools.tool_search.enabled", "off");
     const base = apiBase(context2);
     const [model2] = facts.models;
-    const file4 = await envFile(context2);
-    await writeWhole(file4, withKey(await readText(file4) ?? "", facts.key), context2.backups, { secret: true });
+    const file3 = await envFile(context2);
+    await writeWhole(file3, withKey(await readText(file3) ?? "", facts.key), context2.backups, { secret: true });
     await set(context2, `providers.${ENTRY}`, JSON.stringify({
       name: "AdaptiqAI",
       base_url: base,
@@ -1109,22 +1302,47 @@ var hermesApp = {
     await set(context2, "model.api_mode", "chat_completions");
     await set(context2, "model.key_env", KEY_ENV);
     await set(context2, "model.default", model2.id);
-    for (const entry2 of facts.models) await quietly(context2, "config", "set", `compression.model_thresholds.${entry2.id.replace(/\./gu, "\\.")}`, "1.0");
+    for (const entry2 of facts.models) await quietly(context2, "config", "set", `compression.model_thresholds.${entry2.id.replace(/\./gu, "\\.")}`, "0.99");
+    if (await gatewayRuns(file3)) {
+      const restarted = await context2.confirm("Restart Hermes' gateway now, so its chats get AdaptiqAI's plugin?") && await quietly(context2, "gateway", "restart", "--detach") === 0;
+      if (!restarted) notes.push("Hermes' chats get AdaptiqAI's plugin once its gateway restarts: hermes gateway restart");
+    }
     if (await hermesOpen(context2)) notes.push("Hermes is open. Quit it and open it again to read the new key, then start a new chat.");
     return notes;
   },
   async remove(context2) {
     const had = record((await recall(context2, hermesApp)).model);
     await quietly(context2, "config", "unset", `providers.${ENTRY}`);
-    const file4 = await envFile(context2);
-    const text = await readText(file4);
-    if (text !== void 0) await writeWhole(file4, withKey(text, void 0), context2.backups, { secret: true });
+    const file3 = await envFile(context2);
+    const text = await readText(file3);
+    if (text !== void 0) await writeWhole(file3, withKey(text, void 0), context2.backups, { secret: true });
     for (const field of MODEL_FIELDS) {
       const value = had[field];
       if (typeof value === "string" && value !== "") await set(context2, `model.${field}`, value);
       else await quietly(context2, "config", "unset", `model.${field}`);
     }
     await forget(context2, hermesApp);
+    const notes = [];
+    if (await gatewayRuns(file3)) {
+      const restarted = await context2.confirm("Restart Hermes' gateway now, so it lets go of the AdaptiqAI key?") && await quietly(context2, "gateway", "restart", "--detach") === 0;
+      if (!restarted) notes.push("Hermes' gateway keeps the AdaptiqAI key until it restarts: hermes gateway restart");
+    }
+    if (await hermesOpen(context2)) notes.push("Hermes is open, and keeps the AdaptiqAI key until it closes. Quit it, and open it again.");
+    return notes;
+  },
+  async clean(context2) {
+    const home3 = await hermesHome(context2);
+    const removed = [];
+    const env = join10(home3, ".env");
+    const text = await readText(env);
+    if (text?.split("\n").some((line) => envLine.test(line)) === true && await writeWhole(env, withKey(text, void 0), context2.backups, { secret: true })) removed.push(env);
+    for (const folder2 of snapshotFolders(context2, home3)) {
+      for (const name2 of (await readdir2(folder2).catch(() => [])).filter((entry2) => SNAPSHOT.test(entry2))) {
+        const path = join10(folder2, name2);
+        if (await fileHoldsKey(path) && await removeFile(path)) removed.push(path);
+      }
+    }
+    return { removed, left: [] };
   },
   start: async (context2) => macApp(context2, "Hermes") === void 0 ? "hermes" : "open -b com.nousresearch.hermes",
   async ask(context2) {
@@ -1138,7 +1356,7 @@ async function hermesOpen(context2) {
 }
 
 // src/apps/opencode.ts
-import { existsSync as existsSync5, readdirSync, readFileSync } from "node:fs";
+import { existsSync as existsSync6, readdirSync, readFileSync } from "node:fs";
 import { join as join11 } from "node:path";
 var KEY_ENV2 = "ADAPTIQ_API_KEY";
 var dataDir = (context2) => context2.env.XDG_DATA_HOME ?? join11(context2.home, ".local", "share");
@@ -1147,10 +1365,19 @@ async function signIns(context2, folder2) {
   return Object.fromEntries(Object.entries(all).filter(([, entry2]) => record(entry2).key === KEY_ENV2).map(([url, entry2]) => [url, record(entry2)]));
 }
 async function oneSignIn(context2, binary, folder2) {
-  for (const url of Object.keys(await signIns(context2, folder2))) {
-    if (url !== apiBase(context2)) await context2.run(binary, ["auth", "logout", url], { timeoutMs: 3e4 });
+  const all = await readJson(join11(dataDir(context2), folder2, "auth.json")).catch(() => ({}));
+  for (const [url, entry2] of Object.entries(all)) {
+    if (url !== apiBase(context2) && (url === "adaptiqai" || record(entry2).key === KEY_ENV2)) await context2.run(binary, ["auth", "logout", url], { timeoutMs: 3e4 });
   }
 }
+async function providersLogin(context2, binary, folder2, name2, env) {
+  const file3 = join11(dataDir(context2), folder2, "auth.json");
+  const before = await readText(file3);
+  const done = await context2.run(binary, ["providers", "login", apiBase(context2)], { env });
+  if (done.code !== 0) throw failed(name2, done.stderr);
+  if (await readText(file3) === before) throw failed(name2, `${done.stdout}
+${done.stderr}`);
+}
 var signInEnv = (context2, app, facts) => ({
   ADAPTIQ_CONNECT: facts.deviceCode,
   ADAPTIQ_APP: app,
@@ -1161,12 +1388,30 @@ var fromSignIn = (context2, entries) => {
   if (entry2 === void 0) return {};
   return { base: apiBase(context2), ...typeof entry2.token === "string" ? { key: entry2.token } : {} };
 };
-var failed = (name2, stderr) => new Problem("app_sign_in_failed", `${name2} could not sign in: ${stderr.trim().split("\n").pop() ?? "it gave no reason."}`);
+async function cleanSignIns(context2, binary, folder2) {
+  const removed = [];
+  const grant = await forgetGrant(context2, join11(dataDir(context2), folder2, "adaptiqai"));
+  if (grant !== void 0) removed.push(grant);
+  const database = join11(dataDir(context2), folder2, `${folder2}.db`);
+  const unreachable = binary === void 0 && (await fileHoldsKey(database) || await fileHoldsKey(`${database}-wal`)) ? [`${database} still holds an AdaptiqAI key, and ${folder2 === "kilo" ? "Kilo" : "OpenCode"} is not here to log it out. Install it again, then run this again.`] : [];
+  const auth = join11(dataDir(context2), folder2, "auth.json");
+  const ours = async () => Object.keys(await readJson(auth).catch(() => ({}))).filter((url) => url === "adaptiqai" || url === apiBase(context2));
+  const had = await ours();
+  if (had.length === 0) return { removed, left: unreachable };
+  if (binary === void 0) await updateJson(auth, (value) => {
+    for (const url of had) delete value[url];
+  }, context2.backups, { secret: true });
+  else for (const url of had) await context2.run(binary, ["auth", "logout", url], { timeoutMs: 3e4 }).catch(() => void 0);
+  const left = await ours();
+  if (left.length < had.length) removed.push(auth);
+  return { removed, left: [...left.length === 0 ? [] : [`${auth} still holds an AdaptiqAI key. Run: ${folder2} auth logout ${left[0]}`], ...unreachable] };
+}
+var failed = (name2, said) => new Problem("app_sign_in_failed", `${name2} could not sign in: ${said.split("\n").map((line) => line.trim()).filter((line) => line !== "").pop() ?? "it gave no reason."}`);
 var isVersion2 = (said) => /(?:^|[\sv])(?:[2-9]|[1-9]\d+)\./u.test(said.trim());
 var carriedCli = (context2) => {
   const app = macApp(context2, "OpenCode");
   const cli = app === void 0 ? void 0 : join11(app, "Contents", "Resources", "opencode-cli");
-  return cli !== void 0 && existsSync5(cli) ? cli : void 0;
+  return cli !== void 0 && existsSync6(cli) ? cli : void 0;
 };
 async function opencodeCli(context2) {
   const carried = carriedCli(context2);
@@ -1175,10 +1420,39 @@ async function opencodeCli(context2) {
   const said = await context2.run(path, ["--version"], { timeoutMs: 15e3 });
   return { path, two: isVersion2(said.stdout) };
 }
+async function v2Credentials(context2, path) {
+  const listed = await context2.run(path, ["auth", "list", "--format=json", "--standalone"], { timeoutMs: 3e4 }).catch(() => void 0);
+  const found = /* @__PURE__ */ new Map();
+  try {
+    for (const entry2 of JSON.parse(listed?.stdout ?? "")) {
+      const { id, connections } = record(entry2);
+      const ids = (Array.isArray(connections) ? connections : []).map(record).filter((row) => row.type === "credential" && typeof row.id === "string").map((row) => row.id);
+      if (typeof id === "string" && ids.length > 0) found.set(id, ids);
+    }
+  } catch {
+  }
+  return found;
+}
+async function v2Logout(context2, path, integrations) {
+  const had = await v2Credentials(context2, path);
+  const ours = integrations.filter((integration) => had.has(integration));
+  if (ours.length === 0) return { removed: [], left: [] };
+  for (const integration of ours) {
+    for (const id of had.get(integration) ?? []) await context2.run(path, ["auth", "logout", integration, id, "--standalone"], { timeoutMs: 3e4 });
+  }
+  await context2.run(path, ["service", "restart"], { timeoutMs: 3e4 }).catch(() => void 0);
+  const still = await v2Credentials(context2, path);
+  return {
+    removed: ours.filter((integration) => !still.has(integration)).map((integration) => `OpenCode: ${integration}`),
+    left: ours.filter((integration) => still.has(integration)).map((integration) => `OpenCode still holds an AdaptiqAI key. Run: opencode auth logout ${integration} ${still.get(integration)?.[0] ?? ""}`)
+  };
+}
 var opencode = {
   id: "opencode",
   name: "OpenCode",
   install: "curl -fsSL https://opencode.ai/v2/install | bash",
+  desktop: "https://opencode.ai/desktop",
+  collectsKey: true,
   does: "Signed OpenCode in to AdaptiqAI, which turns off its automatic compaction, for every model. It reads its models from AdaptiqAI when it starts. Your other providers stay.",
   signsInAs: async () => "OpenCode",
   found: async (context2) => carriedCli(context2) !== void 0 || command(context2, "opencode", [join11(context2.home, ".opencode", "bin", "opencode")]) !== void 0,
@@ -1190,6 +1464,8 @@ var opencode = {
   async current(context2) {
     const { path, two } = await opencodeCli(context2);
     if (!two) return fromSignIn(context2, await signIns(context2, "opencode"));
+    const signedIn = await v2Credentials(context2, path);
+    if (signedIn.size > 0) return signedIn.has(apiBase(context2)) ? { base: apiBase(context2) } : {};
     const listed = await context2.run(path, ["auth", "list"], { timeoutMs: 2e4 });
     return listed.stdout.includes(new URL(context2.origin).host) ? { base: apiBase(context2) } : {};
   },
@@ -1198,25 +1474,35 @@ var opencode = {
     const { path, two } = await opencodeCli(context2);
     const env = signInEnv(context2, "OpenCode", facts);
     if (two) {
-      const done2 = await context2.run(path, ["auth", "login", apiBase(context2), "--standalone", "--method", "login"], { env });
-      if (done2.code !== 0) throw failed("OpenCode", done2.stderr);
+      const done = await context2.run(path, ["auth", "login", apiBase(context2), "--standalone", "--method", "login"], { env });
+      if (done.code !== 0) throw failed("OpenCode", done.stderr);
       await context2.run(path, ["service", "restart"], { timeoutMs: 3e4 }).catch(() => void 0);
       return [];
     }
-    const done = await context2.run(path, ["providers", "login", apiBase(context2)], { env });
-    if (done.code !== 0) throw failed("OpenCode", done.stderr);
+    await providersLogin(context2, path, "opencode", "OpenCode", env);
     await oneSignIn(context2, path, "opencode");
     return await running(context2, "OpenCode") ? ["OpenCode is open. Quit it and open it again to see AdaptiqAI."] : [];
   },
   async remove(context2) {
-    const { path } = await opencodeCli(context2);
-    await context2.run(path, ["auth", "logout", apiBase(context2)], { timeoutMs: 3e4 });
+    const { path, two } = await opencodeCli(context2);
+    if (two) await v2Logout(context2, path, [apiBase(context2)]);
+    else await context2.run(path, ["auth", "logout", apiBase(context2)], { timeoutMs: 3e4 });
+  },
+  async clean(context2) {
+    if (!await opencode.found(context2)) return await cleanSignIns(context2, void 0, "opencode");
+    const { path, two } = await opencodeCli(context2);
+    if (!two) return await cleanSignIns(context2, path, "opencode");
+    const grant = await forgetGrant(context2, join11(dataDir(context2), "opencode", "adaptiqai"));
+    const done = await v2Logout(context2, path, [apiBase(context2), "adaptiqai"]);
+    return { removed: [...grant === void 0 ? [] : [grant], ...done.removed], left: done.left };
   },
   async start(context2, model2) {
     const { two } = await opencodeCli(context2);
     if (carriedCli(context2) !== void 0) return "open -b ai.opencode.desktop";
     return two ? "opencode" : `opencode -m adaptiq/${model2}`;
   },
+  // The app opens where it was left, and takes no first message; the terminal UI does.
+  greet: async (context2, model2, hello2) => carriedCli(context2) !== void 0 || context2.platform === "win32" ? void 0 : `${await opencode.start(context2, model2)} --prompt ${shellWord(hello2)}`,
   async ask(context2, model2) {
     const { path } = await opencodeCli(context2);
     return { command: path, args: ["run", "-m", `adaptiq/${model2}`, QUESTION] };
@@ -1241,7 +1527,7 @@ function editorKilo(context2) {
     const found = entries.filter((entry2) => entry2.startsWith("kilocode.kilo-code-") && gone[entry2] === void 0).sort(newestFirst)[0];
     if (found === void 0) continue;
     const path = join11(root, found, "bin", context2.platform === "win32" ? "kilo.exe" : "kilo");
-    if (!existsSync5(path)) continue;
+    if (!existsSync6(path)) continue;
     if (context2.platform === "darwin" && macApp(context2, editor) === void 0) continue;
     return { path, editor };
   }
@@ -1253,6 +1539,7 @@ var kilo = {
   aliases: ["kilo-code", "kilocode"],
   name: "Kilo Code",
   install: "npm install -g @kilocode/cli",
+  collectsKey: true,
   does: "Signed Kilo Code in to AdaptiqAI, which turns off its automatic compaction, for every model. It reads its models from AdaptiqAI when it starts. Your other providers stay.",
   signsInAs: async () => "Kilo Code",
   found: async (context2) => editorKilo(context2) !== void 0 || command(context2, "kilo") !== void 0,
@@ -1261,23 +1548,92 @@ var kilo = {
   async apply(context2, facts) {
     if (facts.deviceCode === void 0) return [];
     const path = kiloCli(context2);
-    const done = await context2.run(path, ["providers", "login", apiBase(context2)], { env: signInEnv(context2, "Kilo Code", facts) });
-    if (done.code !== 0) throw failed("Kilo Code", done.stderr);
+    await providersLogin(context2, path, "kilo", "Kilo Code", signInEnv(context2, "Kilo Code", facts));
     await oneSignIn(context2, path, "kilo");
-    const editor = editorKilo(context2)?.editor;
-    return editor === void 0 ? [] : [`In ${editor}, reload the window to see AdaptiqAI in Kilo Code, then start a new task and choose AdaptiqAI in Kilo's model menu.`];
+    const found = editorKilo(context2);
+    if (found === void 0) return [];
+    const [, , scheme] = EDITORS.find(([, editor]) => editor === found.editor);
+    const mac = context2.platform === "darwin";
+    const open3 = mac ? (await context2.run("ps", ["-axo", "comm="], { timeoutMs: 5e3 }).catch(() => void 0))?.stdout.includes(`/${found.editor}.app/Contents/MacOS/`) === true : context2.platform === "win32" || (await context2.run("pgrep", ["-x", scheme.replace(/^vs/u, "")], { timeoutMs: 5e3 }).catch(() => void 0))?.code === 0;
+    if (context2.person && context2.platform !== "win32") await context2.run(mac ? "open" : "xdg-open", [`${scheme}://kilocode.kilo-code/kilocode/model?agent=code`], { timeoutMs: 15e3 }).catch(() => void 0);
+    return [
+      ...open3 ? [`Reload the ${found.editor} window to see AdaptiqAI in Kilo Code: ${mac ? "Cmd" : "Ctrl"}+Shift+P, then Developer: Reload Window.`] : [],
+      `Start a new task, and choose AdaptiqAI \u203A ${facts.models[0].id} in Kilo's model menu.`
+    ];
   },
   async remove(context2) {
     await context2.run(kiloCli(context2), ["auth", "logout", apiBase(context2)], { timeoutMs: 3e4 });
   },
+  clean: async (context2) => await cleanSignIns(context2, await kilo.found(context2) ? kiloCli(context2) : void 0, "kilo"),
   start: async (context2, model2) => editorKilo(context2) === void 0 ? `kilo -m adaptiq/${model2}` : `open Kilo Code in ${editorKilo(context2)?.editor}`,
+  startsByCommand: (context2) => editorKilo(context2) === void 0,
+  greet: async (context2, model2, hello2) => editorKilo(context2) !== void 0 || context2.platform === "win32" ? void 0 : `kilo -m adaptiq/${model2} --prompt ${shellWord(hello2)}`,
   ask: async (context2, model2) => ({ command: kiloCli(context2), args: ["run", "-m", `adaptiq/${model2}`, QUESTION] })
 };
 
 // src/apps/openclaw.ts
+import { readdir as readdir3, readFile as readFile2 } from "node:fs/promises";
 import { join as join12 } from "node:path";
 var PLUGIN3 = "@adaptiqai/openclaw";
+var PLUGIN_FLAGS = ["--force", "--accept-capabilities"];
 var oc = (context2) => command(context2, "openclaw", [join12(context2.home, ".openclaw", "bin", "openclaw")]) ?? "openclaw";
+var state = (context2) => context2.env.OPENCLAW_STATE_DIR ?? join12(context2.home, ".openclaw");
+var envFile2 = (context2) => join12(state(context2), ".env");
+var OURS = /^\s*(export\s+)?ADAPTIQAI_(API_KEY|API_BASE|CONSOLE_URL)\s*=/u;
+async function writeEnv(context2, key) {
+  const before = await readText(envFile2(context2));
+  if (before === void 0 && key === void 0) return false;
+  const kept = (before ?? "").replace(/\n$/u, "").split("\n").filter((line) => !OURS.test(line));
+  if (kept.length === 1 && kept[0] === "") kept.pop();
+  const added = key === void 0 ? [] : [`ADAPTIQAI_API_KEY=${key}`, ...Object.entries(mcpEnv(context2) ?? {}).map(([name2, value]) => `${name2}=${value}`)];
+  return await writeWhole(envFile2(context2), [...kept, ...added, ""].join("\n"), null, { secret: true });
+}
+async function logout(context2, profile2) {
+  if ((await context2.run(oc(context2), ["models", "auth", "logout", profile2, "--yes"], { timeoutMs: 3e4 })).code === 0) return;
+  await context2.run(oc(context2), ["gateway", "call", "models.authLogout", "--params", JSON.stringify({ provider: "adaptiq", profileIds: [profile2] })], { timeoutMs: 3e4 });
+}
+async function databases(context2) {
+  const agents = await readdir3(join12(state(context2), "agents")).catch(() => []);
+  const withLogs = (path) => [path, `${path}-wal`];
+  return [
+    { files: withLogs(join12(state(context2), "state", "openclaw.sqlite")), compact: ["doctor", "--state-sqlite", "compact", "--json"] },
+    {
+      files: agents.flatMap((agent) => withLogs(join12(state(context2), "agents", agent, "agent", "openclaw-agent.sqlite"))),
+      compact: ["doctor", "--session-sqlite", "compact", "--session-sqlite-all-agents", "--json"]
+    }
+  ];
+}
+var holding = async (files) => (await Promise.all(files.map(async (file3) => await fileHoldsKey(file3) ? file3 : ""))).filter((file3) => file3 !== "");
+var envKey = async (context2) => {
+  const line = (await readText(envFile2(context2)) ?? "").split("\n").filter((entry2) => /^\s*(export\s+)?ADAPTIQAI_API_KEY\s*=/u.test(entry2)).pop();
+  const key = line?.replace(/^[^=]*=/u, "").trim().replace(/^['"]|['"]$/gu, "");
+  return key === void 0 || key === "" ? void 0 : key;
+};
+var covers = (stored, wanted) => {
+  if (Array.isArray(wanted)) return Array.isArray(stored) && stored.length === wanted.length && wanted.every((entry2, at) => covers(stored[at], entry2));
+  if (wanted !== null && typeof wanted === "object") {
+    return stored !== null && typeof stored === "object" && Object.entries(wanted).every(([name2, value]) => covers(stored[name2], value));
+  }
+  return stored === wanted;
+};
+async function directOnly(dir2) {
+  const entries = await readdir3(dir2, { withFileTypes: true, recursive: true }).catch(() => []);
+  for (const entry2 of entries) {
+    if (!entry2.isFile()) continue;
+    const text = await readFile2(join12(entry2.parentPath, entry2.name), "utf8").catch(() => "");
+    if (text.includes("direct-only")) return true;
+  }
+  return false;
+}
+var getJson = async (context2, key) => {
+  const said = await context2.run(oc(context2), ["config", "get", key, "--json"], { timeoutMs: 3e4 });
+  if (said.code !== 0) return void 0;
+  try {
+    return JSON.parse(said.stdout.slice(said.stdout.indexOf("{"), said.stdout.lastIndexOf("}") + 1));
+  } catch {
+    return void 0;
+  }
+};
 var get = async (context2, key) => {
   const said = await context2.run(oc(context2), ["config", "get", key], { timeoutMs: 3e4 });
   const value = said.stdout.trim().split("\n").pop()?.trim();
@@ -1289,9 +1645,10 @@ var entry = (model2) => ({
   ...model2.input.includes("image") ? { input: ["text", "image"] } : {},
   contextWindow: CONVERSATION_TOKENS,
   ...model2.output > 0 ? { maxTokens: model2.output } : {},
-  ...model2.reasoning === null ? {} : {
-    reasoning: true,
-    compat: {
+  ...model2.reasoning === null ? {} : { reasoning: true },
+  compat: {
+    supportsPromptCacheKey: true,
+    ...model2.reasoning === null ? {} : {
       supportsReasoningEffort: true,
       supportedReasoningEfforts: [...model2.reasoning.offWire === null ? [] : [model2.reasoning.offWire], ...model2.reasoning.levels]
     }
@@ -1302,21 +1659,37 @@ var openclaw = {
   id: "openclaw",
   name: "OpenClaw",
   install: "npm install -g openclaw",
-  does: "Added AdaptiqAI to OpenClaw, made it the default model, and turned off its automatic compaction, for every model. Your other providers stay.",
+  // 2026.11.3 refuses to install on an older one (>=24.16.0 <25 || >=26.1.0).
+  installNeedsNode: "24.16.0",
+  does: "Added AdaptiqAI and its plugin to OpenClaw, made it the default model, and turned off its automatic compaction and, where the plugin needs it, tool search, for every model. Your other providers stay.",
   signsInAs: async () => "OpenClaw",
   found: async (context2) => command(context2, "openclaw", [join12(context2.home, ".openclaw", "bin", "openclaw")]) !== void 0,
   async prepare(context2) {
     const done = await context2.run(oc(context2), ["config", "file"], { timeoutMs: 3e4 });
     if (done.code !== 0) throw new Problem("app_refused", `OpenClaw would not start: ${done.stderr.trim().split("\n").pop() ?? ""}`);
+    const inspected = await context2.run(oc(context2), ["plugins", "inspect", "adaptiq"], { timeoutMs: 6e4 });
+    const had = inspected.code === 0 ? /^Version:\s*(\S+)/mu.exec(inspected.stdout)?.[1] ?? "?" : "";
+    const npm = command(context2, "npm");
+    const seen = npm === void 0 ? void 0 : await context2.run(npm, ["view", PLUGIN3, "version"], { timeoutMs: 3e4 }).catch(() => void 0);
+    const latest = seen?.code === 0 ? seen.stdout.trim().split("\n").pop()?.trim() ?? "" : "";
+    if (had !== "" && (!/^\d+\.\d+\.\d+/u.test(latest) || latest === had)) return;
+    const added = await context2.run(oc(context2), ["plugins", "install", PLUGIN3, ...PLUGIN_FLAGS], { timeoutMs: 18e4 });
+    if (added.code !== 0 && had === "") {
+      throw new Problem("tools_not_installed", `AdaptiqAI's plugin for OpenClaw could not be installed, so OpenClaw was left as it was. Check the connection, then run this again. (${added.stderr.trim().split("\n").pop() ?? ""})`);
+    }
   },
   async current(context2) {
     const base = await get(context2, "models.providers.adaptiq.baseUrl");
     if (base === void 0) return {};
     const primary = await get(context2, "agents.defaults.model.primary");
-    return { base, ...primary?.startsWith("adaptiq/") === true ? { model: primary.slice("adaptiq/".length) } : {} };
+    const key = await envKey(context2);
+    return {
+      base,
+      ...primary?.startsWith("adaptiq/") === true ? { model: primary.slice("adaptiq/".length) } : {},
+      ...key === void 0 ? {} : { key }
+    };
   },
   async apply(context2, facts) {
-    const notes = [];
     const was = await get(context2, "agents.defaults.model.primary");
     const compaction = await get(context2, "agents.defaults.compaction.enabled");
     await remember(context2, openclaw, { primary: was?.startsWith("adaptiq/") === true ? null : was ?? null, compaction: compaction ?? null });
@@ -1324,27 +1697,38 @@ var openclaw = {
       models: { providers: { adaptiq: { baseUrl: apiBase(context2), api: "openai-completions", models: facts.models.map(entry) } } },
       agents: { defaults: { model: { primary: `adaptiq/${facts.models[0].id}` } } }
     };
-    const patched = await context2.run(oc(context2), ["config", "patch", "--stdin", "--replace-path", "models.providers.adaptiq.models"], { input: JSON.stringify(patch), timeoutMs: 6e4 });
-    if (patched.code !== 0) throw new Problem("app_refused", `OpenClaw refused the setup: ${patched.stderr.trim().split("\n").pop() ?? ""}`);
-    if (facts.key !== void 0) {
+    if (was !== patch.agents.defaults.model.primary || !covers(await getJson(context2, "models.providers.adaptiq"), patch.models.providers.adaptiq)) {
+      const patched = await context2.run(oc(context2), ["config", "patch", "--stdin", "--replace-path", "models.providers.adaptiq.models"], { input: JSON.stringify(patch), timeoutMs: 6e4 });
+      if (patched.code !== 0) throw new Problem("app_refused", `OpenClaw refused the setup: ${patched.stderr.trim().split("\n").pop() ?? ""}`);
+    }
+    if (facts.key !== void 0 && facts.key !== await envKey(context2)) {
       const pasted = await context2.run(oc(context2), ["models", "auth", "paste-api-key", "--provider", "adaptiq"], { input: facts.key, timeoutMs: 6e4 });
       if (pasted.code !== 0) throw new Problem("app_refused", `OpenClaw refused the key: ${pasted.stderr.trim().split("\n").pop() ?? ""}`);
     }
     await context2.run(oc(context2), ["config", "set", "agents.defaults.compaction.enabled", "false"], { timeoutMs: 3e4 });
-    const listed = await context2.run(oc(context2), ["plugins", "list"], { timeoutMs: 6e4 });
-    if (!listed.stdout.includes(PLUGIN3) && !/\badaptiq\b/u.test(listed.stdout)) {
-      const added = await context2.run(oc(context2), ["plugins", "install", PLUGIN3], { timeoutMs: 18e4 });
-      if (added.code !== 0) notes.push(`AdaptiqAI's plugin for OpenClaw could not be installed, so conversations have no memory of their own yet. Run: openclaw plugins install ${PLUGIN3}`);
-      else if (await gatewayUp(context2)) {
-        if (await context2.confirm("OpenClaw's Gateway loads AdaptiqAI's plugin when it starts. Restart it now?")) await context2.run(oc(context2), ["gateway", "restart"], { timeoutMs: 6e4 });
-        else notes.push("Restart OpenClaw's Gateway to load AdaptiqAI's plugin: openclaw gateway restart");
+    const inspected = await context2.run(oc(context2), ["plugins", "inspect", "adaptiq"], { timeoutMs: 6e4 });
+    const where = /^Install path:\s*(.+)$/mu.exec(inspected.stdout)?.[1]?.trim().replace(/^~\//u, `${context2.home}/`);
+    if (where !== void 0 && await directOnly(join12(where, "lib"))) {
+      if (await get(context2, "tools.toolSearch") !== void 0) await context2.run(oc(context2), ["config", "unset", "tools.toolSearch"], { timeoutMs: 3e4 });
+    } else {
+      await context2.run(oc(context2), ["config", "set", "tools.toolSearch", "false"], { timeoutMs: 3e4 });
+    }
+    if (facts.key !== void 0) await writeEnv(context2, facts.key);
+    await logout(context2, "adaptiq:device");
+    await forgetGrant(context2, join12(state(context2), "adaptiqai"));
+    if (await gatewayUp(context2)) {
+      if (!await context2.confirm("Restart OpenClaw's Gateway now, so it uses AdaptiqAI? Answers in progress stop.")) return ["OpenClaw uses AdaptiqAI once its Gateway restarts: openclaw gateway restart"];
+      const restarted = await context2.run(oc(context2), ["gateway", "restart"], { timeoutMs: 6e4 });
+      if (restarted.code !== 0) {
+        const said = `${restarted.stderr}
+${restarted.stdout}`.trim().split("\n").pop() ?? "";
+        return [`OpenClaw's Gateway did not restart${said === "" ? "" : ` (${said})`}. It uses AdaptiqAI once it restarts: openclaw gateway restart`];
       }
     }
-    return notes;
+    return [];
   },
   async remove(context2) {
     const had = await recall(context2, openclaw);
-    await context2.run(oc(context2), ["models", "auth", "logout", "adaptiq:manual", "--yes"], { timeoutMs: 3e4 });
     await updateJson(join12(context2.env.OPENCLAW_STATE_DIR ?? join12(context2.home, ".openclaw"), "openclaw.json"), (value) => {
       delete record(record(value.models).providers).adaptiq;
       const defaults = record(record(value.agents).defaults);
@@ -1356,9 +1740,34 @@ var openclaw = {
       if (had.compaction === null) delete record(defaults.compaction).enabled;
       else if (had.compaction === "true") record(defaults.compaction).enabled = true;
     }, context2.backups);
+    await writeEnv(context2);
     await forget(context2, openclaw);
   },
-  start: async () => "openclaw dashboard",
+  async clean(context2) {
+    const removed = [];
+    if (await writeEnv(context2)) removed.push(envFile2(context2));
+    const grant = await forgetGrant(context2, join12(state(context2), "adaptiqai"));
+    if (grant !== void 0) removed.push(grant);
+    const here = await openclaw.found(context2);
+    if (here) for (const profile2 of ["adaptiq:manual", "adaptiq:device"]) await logout(context2, profile2);
+    const all = await databases(context2);
+    const every = all.flatMap((database) => database.files);
+    const held = await holding(every);
+    let up = here && held.length > 0 && await gatewayUp(context2);
+    if (up && await context2.confirm("OpenClaw's database keeps the old key until its Gateway closes it. Restart its Gateway now? Answers in progress stop.") && (await context2.run(oc(context2), ["gateway", "restart"], { timeoutMs: 6e4 })).code === 0) up = await gatewayUp(context2);
+    for (const { files, compact } of all) {
+      if (here && !up && (await holding(files)).length > 0) await context2.run(oc(context2), compact, { timeoutMs: 6e5 });
+    }
+    const still = await holding(every);
+    removed.push(...held.filter((file3) => !still.includes(file3)));
+    const left = still.length === 0 ? [] : [here ? `OpenClaw's own database still holds the AdaptiqAI key (${still[0]}). Quit OpenClaw and stop its Gateway (openclaw gateway stop), then run this again: npx -y adaptiqai disconnect openclaw` : `OpenClaw's own database still holds the AdaptiqAI key (${still[0]}), and OpenClaw is not here to clear it. If you no longer use OpenClaw, delete its folder, ${state(context2)}.`];
+    return { removed, left };
+  },
+  // The Mac app shows the dashboard in its own window, on the Gateway it runs itself; without it, the browser does.
+  start: async (context2) => {
+    const dashboard = `${/\s/u.test(oc(context2)) ? `'${oc(context2)}'` : oc(context2)} dashboard`;
+    return context2.platform === "darwin" ? `open -b ai.openclaw.mac openclaw://dashboard 2>/dev/null || ${dashboard}` : dashboard;
+  },
   async ask(context2) {
     const local = await gatewayUp(context2) ? [] : ["--local"];
     return { command: oc(context2), args: ["agent", ...local, "--agent", "main", "--json", "--timeout", "120", "--message", QUESTION] };
@@ -1367,17 +1776,17 @@ var openclaw = {
 
 // src/apps/pi.ts
 import { join as join13 } from "node:path";
-var PACKAGE = "npm:@adaptiqai/pi";
+var PACKAGE2 = "npm:@adaptiqai/pi";
 var PROVIDER2 = "adaptiqai";
 var CONSOLE_PROVIDER = "adaptiq";
-var dir2 = (context2) => context2.env.PI_CODING_AGENT_DIR ?? join13(context2.home, ".pi", "agent");
-var file3 = (context2, name2) => join13(dir2(context2), name2);
+var dir = (context2) => context2.env.PI_CODING_AGENT_DIR ?? join13(context2.home, ".pi", "agent");
+var file2 = (context2, name2) => join13(dir(context2), name2);
 var pi = (context2) => command(context2, "pi") ?? "pi";
 async function hasPackage(context2) {
-  const { packages } = await readJson(file3(context2, "settings.json"));
+  const { packages } = await readJson(file2(context2, "settings.json"));
   return Array.isArray(packages) && packages.some((entry2) => {
     const source = typeof entry2 === "string" ? entry2 : record(entry2).source;
-    return typeof source === "string" && source.startsWith(PACKAGE);
+    return typeof source === "string" && source.startsWith(PACKAGE2);
   });
 }
 var piApp = {
@@ -1388,53 +1797,73 @@ var piApp = {
   signsInAs: async () => "Pi",
   found: async (context2) => command(context2, "pi") !== void 0,
   async prepare(context2) {
-    await Promise.all(["auth.json", "models.json", "settings.json"].map((name2) => readJson(file3(context2, name2))));
+    await Promise.all(["auth.json", "models.json", "settings.json"].map((name2) => readJson(file2(context2, name2))));
+    const done = await context2.run(pi(context2), ["install", PACKAGE2], { timeoutMs: 18e4 });
+    if (done.code !== 0 && !await hasPackage(context2)) {
+      throw new Problem("plugin_failed", `Pi could not install AdaptiqAI's package, so it was left as it was. Check the connection, then run this again: ${done.stderr.trim().split("\n").pop() ?? ""}`);
+    }
   },
   async current(context2) {
-    const { key } = record((await readJson(file3(context2, "auth.json")))[PROVIDER2]);
+    const { key } = record((await readJson(file2(context2, "auth.json")))[PROVIDER2]);
     return typeof key === "string" ? { base: apiBase(context2), key } : {};
   },
   async apply(context2, facts) {
-    if (!await hasPackage(context2)) {
-      const done = await context2.run(pi(context2), ["install", PACKAGE], { timeoutMs: 18e4 });
-      if (done.code !== 0) throw new Problem("plugin_failed", `Pi could not install AdaptiqAI's package, so it was left as it was: ${done.stderr.trim().split("\n").pop() ?? ""}`);
-    }
-    const settings = await readJson(file3(context2, "settings.json"));
+    await forgetGrant(context2, file2(context2, "adaptiqai"));
+    const settings = await readJson(file2(context2, "settings.json"));
     await remember(context2, piApp, { compaction: settings.compaction ?? null });
-    await updateJson(file3(context2, "auth.json"), (value) => {
+    await updateJson(file2(context2, "auth.json"), (value) => {
       value[PROVIDER2] = { type: "api_key", key: facts.key };
       if (record(value[CONSOLE_PROVIDER]).type === "api_key") delete value[CONSOLE_PROVIDER];
     }, context2.backups, { secret: true });
-    await updateJson(file3(context2, "models.json"), (value) => {
+    await updateJson(file2(context2, "models.json"), (value) => {
       const all = record(value.providers);
       if (all[CONSOLE_PROVIDER] === void 0) return;
       delete all[CONSOLE_PROVIDER];
       value.providers = all;
     }, context2.backups, { secret: true });
-    await updateJson(file3(context2, "settings.json"), (value) => {
+    await updateJson(file2(context2, "settings.json"), (value) => {
       value.compaction = { ...record(value.compaction), enabled: false };
+      if (value.defaultProvider === void 0 || value.defaultProvider === CONSOLE_PROVIDER) {
+        value.defaultProvider = PROVIDER2;
+        value.defaultModel = facts.models[0].id;
+      }
     }, context2.backups, { secret: true });
     return [];
   },
   async remove(context2) {
     const had = await recall(context2, piApp);
-    if (await hasPackage(context2)) await context2.run(pi(context2), ["remove", PACKAGE], { timeoutMs: 6e4 });
-    await updateJson(file3(context2, "auth.json"), (value) => {
+    if (await hasPackage(context2)) await context2.run(pi(context2), ["remove", PACKAGE2], { timeoutMs: 6e4 });
+    await updateJson(file2(context2, "auth.json"), (value) => {
       delete value[PROVIDER2];
     }, context2.backups, { secret: true });
-    if ("compaction" in had) {
-      await updateJson(file3(context2, "settings.json"), (value) => {
+    await updateJson(file2(context2, "settings.json"), (value) => {
+      if ("compaction" in had) {
         if (had.compaction === null) delete value.compaction;
         else value.compaction = had.compaction;
-      }, context2.backups, { secret: true });
-    }
+      }
+      if (value.defaultProvider === PROVIDER2) {
+        delete value.defaultProvider;
+        delete value.defaultModel;
+      }
+    }, context2.backups, { secret: true });
     await forget(context2, piApp);
   },
-  start: async (_context, model2) => `pi --provider ${PROVIDER2} --model ${model2}`
+  async clean(context2) {
+    const removed = [];
+    const auth = file2(context2, "auth.json");
+    if (await updateJson(auth, (value) => {
+      delete value[PROVIDER2];
+    }, context2.backups, { secret: true })) removed.push(auth);
+    const grant = await forgetGrant(context2, file2(context2, "adaptiqai"));
+    if (grant !== void 0) removed.push(grant);
+    return { removed, left: [] };
+  },
+  start: async (_context, model2) => `pi --provider ${PROVIDER2} --model ${model2}`,
+  greet: async (context2, model2, hello2) => context2.platform === "win32" ? void 0 : `pi --provider ${PROVIDER2} --model ${model2} ${shellWord(hello2)}`
 };
 
 // src/apps/index.ts
-var APPS = [cline, deepseek, codex, claudeCode, opencode, kilo, piApp, hermesApp, openclaw];
+var APPS = [deepseek, codex, claudeCode, opencode, kilo, piApp, hermesApp, openclaw];
 function appNamed(word) {
   const wanted = word.trim().toLowerCase();
   return APPS.find((app) => app.id === wanted || app.aliases?.includes(wanted) === true);
@@ -1442,7 +1871,9 @@ function appNamed(word) {
 
 // src/commands.ts
 import { spawn as spawn2 } from "node:child_process";
-import { dirname as dirname3 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { access as access3, constants as constants4 } from "node:fs/promises";
+import { delimiter as delimiter3, dirname as dirname4, join as join15 } from "node:path";
 
 // ../core/lib/errors.js
 var CODES = {
@@ -1466,6 +1897,13 @@ var CODES = {
 };
 var RETRYABLE_CODES = [CODES.empty, CODES.busy, CODES.server, CODES.timeout, CODES.transport, CODES.preparing];
 
+// ../core/lib/tool-failures.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var PASSING = [CODES.server, CODES.timeout, CODES.transport, CODES.busy, CODES.preparing, CODES.empty, CODES.conversationUnavailable];
+var inCall = new AsyncLocalStorage();
+var UNKNOWN_TURN_MS = 2 * 6e4;
+var KEPT_MS = 10 * 6e4;
+
 // ../core/lib/auth.js
 var REFRESH_MARGIN_MS = 2 * 6e4;
 var DEVICE_TIMEOUT_MS = 10 * 6e4;
@@ -1570,13 +2008,13 @@ async function pollDeviceCode(client2, code, extra = {}) {
     return { state: "failed", message: detailMessage(await readJson2(response)) ?? `Sign-in failed (HTTP ${response.status}).` };
   }
   const body = await readJson2(response);
-  const access2 = String(body?.access_token ?? "");
+  const access4 = String(body?.access_token ?? "");
   const refresh = String(body?.refresh_token ?? "");
-  if (!access2.startsWith("ak_") || refresh !== "" && !refresh.startsWith("akr_"))
+  if (!access4.startsWith("ak_") || refresh !== "" && !refresh.startsWith("akr_"))
     return { state: "failed", message: "AdaptiqAI returned an invalid credential." };
   return {
     state: "approved",
-    access: access2,
+    access: access4,
     refresh: refresh === "" ? null : refresh,
     expiresIn: Math.max(60, Number(body?.expires_in ?? 3600)),
     workspaceLabel: typeof body?.workspace_label === "string" && body.workspace_label !== "" ? body.workspace_label : "Your workspace"
@@ -1810,6 +2248,7 @@ var FOLLOW_MS = 3 * 36e5;
 
 // ../core/lib/update.js
 var RELEASE_AGE_MS = 24 * 36e5;
+var OFFER_AGE_MS = 48 * 36e5;
 
 // ../core/lib/workspace.js
 var UNDO_WINDOW_MS = 15 * 6e4;
@@ -1820,13 +2259,51 @@ var ATTACH_BACKOFF_MAX_MS = 10 * 6e4;
 var ATTACH_DEADLINE_MS = 6 * 36e5;
 var SESSION_BACKOFF_MAX_MS = 5 * 6e4;
 
+// ../core/lib/commands.js
+var ACTIONS = [
+  ["", "workspace, models and memory"],
+  ["signin", "connect your AdaptiqAI account in the browser"],
+  ["private", "stop saving new messages of this conversation"],
+  ["remember", "save this conversation to memory again"],
+  ["knowledge", "knowledge used in this conversation, and what else you can use"],
+  ["use <name>", "use a collection or an earlier conversation here"],
+  ["stop <name>", "stop using it here (nothing is deleted)"],
+  ["open", "open this conversation in AdaptiqAI Knowledge"],
+  ["diagnostics", "a report you can send to support (no secrets)"],
+  ["signout", "forget the connection on this computer"]
+];
+var COMMAND_HINT = ["status", ...ACTIONS.slice(1).map(([action]) => action.split(" ")[0])].join(" \xB7 ");
+
+// ../core/lib/preparing.js
+var PREPARING_MOST_MS = 15 * 6e4;
+
+// ../core/lib/reading.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+
+// ../core/lib/series.js
+var MONTHS = [
+  "januar februar marts april maj juni juli august september oktober november december",
+  "january february march april may june july august september october november december",
+  "jan feb mar apr maj jun jul aug sep okt nov dec",
+  "jan feb mar apr may jun jul aug sep oct nov dec"
+].map((words) => words.split(" "));
+var TOKEN = new RegExp(`(\\d+|(?<!\\p{L})(?:${[...new Set(MONTHS.flat())].sort((a, b) => b.length - a.length).join("|")})(?!\\p{L}))`, "iu");
+
 // ../core/lib/reading.js
 var READ_PER_REPLY = 13e4;
-var READING_NOTE = `A collection used here is in your memory, but a large one is read in parts: each reply reads what matches the conversation (about ${formatTokens(READ_PER_REPLY)} tokens of it), never all of it at once. To work in it: contents lists its documents; find searches its text for words and gives the exact lines as document:line; open reads one document (around a line, if given) in your next reply. Before you say something is not there, find it; for an overview, take contents first; answer from what you read, citing document:line.`;
+var READING_NOTE = `A collection used here is in your memory, but a large one is read in parts: each reply reads what matches the conversation (about ${formatTokens(READ_PER_REPLY)} tokens of it), never all of it at once. contents lists its documents; open shows a document's exact lines (around a line, if given; more: true reads on). Before you say something is not there, find it; for an overview, take contents first. Answer from what these actions return, citing document:line as a result shows it, and never name a document or a line no result showed.`;
+var READS_IDLE_MS = 10 * 6e4;
+var ORIGINAL_BYTES = 16 * 1024 * 1024;
+var KNOWN_CHARS = 32 * 1024 * 1024;
+var calls = new AsyncLocalStorage2();
 
 // ../core/lib/tools.js
 var SOURCE_LIMIT = 6 * 1024 * 1024;
 
+// ../core/lib/turns.js
+var OFFER = new RegExp("(?<!\\p{L})(?:knowledge|collection|ncm|viden|samling)|\u77E5\u8BC6|\u96C6\u5408", "iu");
+var OFFER_DOES = new RegExp("(?<!\\p{L})(?:save|make|create|add|put|keep|store|turn|remember|gem|gemme|lav|lave|opret|oprette|tilf\xF8j|tilf\xF8je|l\xE6g|l\xE6gge)(?!\\p{L})|\u4FDD\u5B58|\u521B\u5EFA|\u505A\u6210|\u653E\u8FDB|\u52A0\u5165|\u5B58", "iu");
+
 // src/gateway.ts
 async function call(context2, path, options = {}) {
   let response;
@@ -1849,6 +2326,7 @@ async function call(context2, path, options = {}) {
   return { status: response.status, body, headers: response.headers };
 }
 var SAFE_MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/u;
+var namedModels = (ids) => models(ids.map((id) => ({ id })));
 var models = (rows) => buildCatalog(rows, { kind: "unknown" }).filter((row) => SAFE_MODEL_ID.test(row.id)).map((row) => ({
   id: row.id,
   name: row.name,
@@ -1932,7 +2410,7 @@ async function testRequest(context2, key, model2) {
 }
 
 // src/signin.ts
-import { randomBytes as randomBytes2, createHash as createHash2 } from "node:crypto";
+import { randomBytes, createHash as createHash2 } from "node:crypto";
 import { chmod as chmod5, mkdir as mkdir7, rm as rm4 } from "node:fs/promises";
 import { join as join14 } from "node:path";
 var pendingFile = (context2, app) => join14(cliDir(context2), `sign-in-${app.id}.json`);
@@ -1951,12 +2429,12 @@ var forgetSignIn = async (context2, app) => {
   await rm4(pendingFile(context2, app), { force: true });
 };
 async function installationId(context2) {
-  const file4 = join14(configDir(context2.env, context2.home), "installation");
-  const saved = (await readText(file4))?.replace(/[^a-f0-9]/gu, "").slice(0, 32);
+  const file3 = join14(configDir(context2.env, context2.home), "installation");
+  const saved = (await readText(file3))?.replace(/[^a-f0-9]/gu, "").slice(0, 32);
   if (saved?.length === 32) return saved;
-  const made = randomBytes2(16).toString("hex");
+  const made = randomBytes(16).toString("hex");
   await mkdir7(configDir(context2.env, context2.home), { recursive: true, mode: 448 });
-  await writeWhole(file4, `${made}
+  await writeWhole(file3, `${made}
 `, null, { secret: true });
   return made;
 }
@@ -1968,7 +2446,7 @@ async function start(context2, app) {
       app: await app.signsInAs(context2),
       device: deviceName(),
       // Nothing needs this again: the key an app stores lasts by itself and is never refreshed.
-      binding: createHash2("sha256").update(randomBytes2(32)).digest("hex"),
+      binding: createHash2("sha256").update(randomBytes(32)).digest("hex"),
       tokenLifetime: "long"
     });
   } catch (error) {
@@ -1988,7 +2466,7 @@ function tell(context2, app, pending) {
     url: pending.url,
     code: pending.userCode,
     expires_in: Math.max(0, Math.round((pending.expiresAt - context2.now()) / 1e3)),
-    say: "Open this link, sign in or create an account, check that the page shows the same code, and press Connect. Then add a card or funds. Nothing is charged when you add a card."
+    say: "Open this link, sign in or create an account, check that the page shows the same code, and press Connect. Then add funds."
   }, [
     ...elsewhere === void 0 ? [] : ["", `Signing in at ${elsewhere}, set by ADAPTIQAI_API_BASE, not at AdaptiqAI's own address.`],
     "",
@@ -2000,13 +2478,14 @@ function tell(context2, app, pending) {
   ]);
 }
 async function signIn(context2, app, options) {
-  let pending = await pendingSignIn(context2, app);
+  const given = options.code === void 0 ? void 0 : { deviceCode: options.code, userCode: "", url: "", expiresAt: context2.now() + 6e5, interval: 2e3, app: app.id, origin: context2.origin };
+  let pending = given ?? await pendingSignIn(context2, app);
   const resumed = pending !== void 0;
   if (pending === void 0) {
     pending = await start(context2, app);
     await options.open(pending.url);
   }
-  tell(context2, app, pending);
+  if (given === void 0) tell(context2, app, pending);
   if (!resumed && options.waitMs === 0) return { state: "waiting" };
   const extra = {
     client_app: await app.signsInAs(context2),
@@ -2014,17 +2493,24 @@ async function signIn(context2, app, options) {
     model: options.model,
     installation: await installationId(context2)
   };
-  const until = context2.now() + options.waitMs;
-  context2.say.note("Waiting for you in the browser...");
+  const until = context2.now() + (given === void 0 ? options.waitMs : Math.max(options.waitMs, 6e4));
+  if (given === void 0) context2.say.note("Waiting for you in the browser...");
   for (; ; ) {
     const answer = await pollDeviceCode(client(context2), pending, extra);
     if (answer.state === "approved") return { state: "approved", key: answer.access, workspace: answer.workspaceLabel, deviceCode: pending.deviceCode };
     if (answer.state === "waiting") {
-      if (context2.now() + answer.delayMs > until) return { state: "waiting" };
+      if (context2.now() + answer.delayMs > until) {
+        if (given !== void 0) throw new Problem("sign_in_failed", "AdaptiqAI did not answer for the code from the console. Check the connection, then run the command again.");
+        return { state: "waiting" };
+      }
       await context2.sleep(answer.delayMs);
       continue;
     }
-    await forgetSignIn(context2, app);
+    if (given !== void 0 && answer.state === "expired") {
+      context2.say.note("The code from the console has expired, or was used. Signing in in the browser instead.");
+      return await signIn(context2, app, { model: options.model, waitMs: options.waitMs, open: options.open });
+    }
+    if (given === void 0) await forgetSignIn(context2, app);
     if (answer.state === "denied") throw new Problem("declined", answer.message);
     if (answer.state === "expired" && resumed) return await signIn(context2, app, options);
     throw new Problem(answer.state === "expired" ? "sign_in_expired" : "sign_in_failed", answer.message);
@@ -2034,13 +2520,14 @@ async function signIn(context2, app, options) {
 // src/commands.ts
 var EXIT = { connected: 0, failed: 1, usage: 2, waitingForSignIn: 3, waitingForFunds: 4 };
 var FUNDS_POLL_MS = 15e3;
+var hello = (name2) => `Hi${name2 === void 0 || name2 === "" || name2 === "Your workspace" ? "" : `, I'm ${name2}`}. Briefly confirm that the connection to AdaptiqAI works, and ask what we should work on.`;
 async function openLink(context2, url) {
   const { env, platform } = context2;
   if (env.SSH_CONNECTION !== void 0 || env.CI !== void 0 || !safeLink(url)) return;
   if (platform !== "darwin" && platform !== "win32" && env.DISPLAY === void 0 && env.WAYLAND_DISPLAY === void 0) return;
-  const [file4, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", new URL(url).href]] : ["xdg-open", [url]];
+  const [file3, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", new URL(url).href]] : ["xdg-open", [url]];
   await new Promise((resolve) => {
-    const child = spawn2(file4, [...args], { stdio: "ignore", detached: true, env });
+    const child = spawn2(file3, [...args], { stdio: "ignore", detached: true, env });
     child.on("error", () => resolve());
     child.on("spawn", () => {
       child.unref();
@@ -2048,6 +2535,75 @@ async function openLink(context2, url) {
     });
   });
 }
+var APP_POLL_MS = 3e3;
+function installer(context2, app) {
+  if (app.install.startsWith("npm install -g ")) return command(context2, "npm") === void 0 ? void 0 : app.install;
+  return context2.platform !== "win32" && app.install.startsWith("curl ") ? app.install : void 0;
+}
+async function npmUserPrefix(context2) {
+  const npm = command(context2, "npm");
+  if (npm === void 0 || context2.platform === "win32") return void 0;
+  const prefix = (await context2.run(npm, ["prefix", "-g"], { timeoutMs: 3e4 })).stdout.trim().split("\n").pop() ?? "";
+  if (prefix === "") return void 0;
+  const writable = async (path) => await access3(path, constants4.W_OK).then(() => true, () => false);
+  const modules = join15(prefix, "lib", "node_modules");
+  if (await writable(modules) || !existsSync7(modules) && await writable(prefix)) return void 0;
+  return join15(context2.home, ".local");
+}
+async function waitForApp(context2, app, page, options) {
+  context2.say.note(`Opening ${page}. Download ${app.name} there and install it; this goes on once it is here.`);
+  if (options.open) await openLink(context2, page);
+  const until = context2.now() + options.waitMs;
+  while (!await app.found(context2)) {
+    if (context2.now() + APP_POLL_MS > until) throw new Problem("app_not_installed", `${app.name} is not installed yet. Install it from ${page}, then run this again.`, { app: app.id, download: page });
+    await context2.sleep(APP_POLL_MS);
+  }
+  context2.say.note(`Found ${app.name}.`);
+  return true;
+}
+async function getApp(context2, app, options) {
+  const page = context2.platform === "darwin" ? app.desktop : void 0;
+  if (app.fetched === true && page === void 0) return true;
+  const terminal = app.fetched === true ? "" : installer(context2, app);
+  const ways = [...page === void 0 ? [] : ["app"], ...terminal === void 0 ? [] : ["terminal"]];
+  if (!context2.person || ways.length === 0) return app.fetched === true;
+  if (ways.length === 1 && terminal && app.installNeedsNode !== void 0) await needNode(context2, app.installNeedsNode, `${app.name}'s installer`, ["connect", app.id]);
+  let way;
+  if (ways.length === 2) {
+    const picked = await context2.choose(`${app.name} is not on this computer. How do you want it?`, [
+      app.installMacApp === void 0 ? "Download the Mac app" : "Install the Mac app",
+      app.fetched === true ? "Run it from this terminal, in your browser" : `Install it in this terminal (${app.install})`
+    ]);
+    way = picked === void 0 ? void 0 : ways[picked];
+  } else if (await context2.confirm(ways[0] === "app" ? `${app.name} is not on this computer. Download the Mac app from ${page}?` : `${app.name} is not installed here. Install it now, with ${app.install}?`)) {
+    way = ways[0];
+  }
+  if (way === void 0) return false;
+  if (way === "app" && app.installMacApp !== void 0) {
+    if (await app.installMacApp(context2) && await app.found(context2)) return true;
+    if (app.fetched === true) {
+      context2.say.note(`${app.name}'s app could not be installed here, so it runs in your browser instead.`);
+      return true;
+    }
+  }
+  if (way === "app") return await waitForApp(context2, app, page, options);
+  if (terminal === "") return true;
+  const local = terminal?.startsWith("npm install -g ") === true ? await npmUserPrefix(context2) : void 0;
+  context2.say.note(`Installing ${app.name}...`);
+  const code = await context2.handOver(local === void 0 ? terminal : terminal.replace("npm install -g ", `npm install -g --prefix=${shellWord(local)} `));
+  if (code !== 0) throw new Problem("app_install_failed", `${app.name} could not be installed: its installer ended with ${code}. Install it with ${app.install}, then run this again.`, { app: app.id, install: app.install });
+  if (local !== void 0) {
+    const bin2 = join15(local, "bin");
+    const path = context2.env.PATH ?? "";
+    if (!path.split(delimiter3).includes(bin2)) {
+      context2.env.PATH = `${bin2}${delimiter3}${path}`;
+      context2.say.note(`${app.name} went in ~/.local/bin, as npm's own folder is for root here. Add that folder to your PATH to start it by name.`);
+    }
+  }
+  if (!await app.found(context2)) throw new Problem("app_not_found", `${app.name} is installed, but this terminal does not find it yet. Open a new terminal, then run this again.`, { app: app.id });
+  context2.say.note(`Installed ${app.name}.`);
+  return true;
+}
 async function stillGood(context2, current) {
   return current.key !== void 0 && await whoami(context2, current.key) !== void 0;
 }
@@ -2081,29 +2637,51 @@ async function test(context2, app, key, model2) {
 }
 async function connect(context2, app, options) {
   const { say } = context2;
-  if (app.fetched !== true && !await app.found(context2)) throw new Problem("app_not_installed", `${app.name} is not installed here. ${/^(npm|curl) /u.test(app.install) ? `Install it with: ${app.install}` : app.install}`, { app: app.id, install: app.install });
-  await app.prepare?.(context2);
+  try {
+    if (!await app.found(context2) && !await getApp(context2, app, options)) {
+      const page = context2.platform === "darwin" ? app.desktop : void 0;
+      throw new Problem("app_not_installed", `${app.name} is not installed here. ${/^(npm|curl) /u.test(app.install) ? `Install it with: ${app.install}` : app.install}${page === void 0 ? "" : `, or get the Mac app: ${page}`}`, { app: app.id, install: app.install, ...page === void 0 ? {} : { download: page } });
+    }
+    await app.prepare?.(context2);
+  } catch (error) {
+    if (error instanceof HandedOver) return error.exitCode;
+    throw error;
+  }
   const current = await app.current(context2);
   const here = current.base === apiBase(context2);
-  const reuse = options.fresh !== true && here && (current.key === void 0 ? app.ask !== void 0 && await pendingSignIn(context2, app) === void 0 : await stillGood(context2, current));
-  let key = reuse ? current.key : void 0;
+  let given;
+  if (options.key !== void 0) {
+    if (app.collectsKey === true) throw new Problem("needs_sign_in", `${app.name} signs in by itself, which an owner or admin of the workspace approves. Ask one to connect it, or set it up by hand from Connect to app.`, { app: app.id });
+    given = await whoami(context2, options.key);
+    if (given === void 0) throw new Problem("key_refused", "AdaptiqAI does not take that key. Make a new one in the console, then run this again.", { app: app.id });
+  }
+  const reuse = options.code === void 0 && options.key === void 0 && options.fresh !== true && here && (current.key === void 0 ? app.ask !== void 0 && await pendingSignIn(context2, app) === void 0 : await stillGood(context2, current));
+  let key = reuse ? current.key : options.key;
   let deviceCode;
   let signedInOn;
-  if (!reuse) {
+  let workspace;
+  if (!reuse && options.code !== void 0 && app.collectsKey === true) {
+    signedInOn = await modelForSignIn(context2, options.model);
+    deviceCode = options.code;
+  } else if (options.key !== void 0) {
+    signedInOn = await modelForSignIn(context2, options.model);
+    workspace = given?.workspace;
+  } else if (!reuse) {
     signedInOn = await modelForSignIn(context2, options.model);
     const signedIn = await signIn(context2, app, {
       model: signedInOn,
       waitMs: options.waitMs,
       open: async (url) => {
         if (options.open) await openLink(context2, url);
-      }
+      },
+      ...options.code === void 0 ? {} : { code: options.code }
     });
     if (signedIn.state === "waiting") {
       say.event("waiting", { for: "sign_in", app: app.id, run_again: true }, "Still waiting. Run this again once you have pressed Connect.");
       return EXIT.waitingForSignIn;
     }
     ;
-    ({ key, deviceCode } = signedIn);
+    ({ key, deviceCode, workspace } = signedIn);
     say.event("signed_in", { app: app.id, workspace: signedIn.workspace }, `Signed in to ${signedIn.workspace}.`);
   } else {
     await forgetSignIn(context2, app);
@@ -2114,14 +2692,16 @@ async function connect(context2, app, options) {
   let left = [];
   if (settled !== void 0) model2 = settled;
   else {
-    const models2 = chooseModels(await listModels(context2, key), options.model, reuse ? current.model : signedInOn);
+    const listed = await listModels(context2, key);
+    const offered = key === void 0 && options.code !== void 0 && options.model !== void 0 && !listed.some((entry2) => entry2.id === options.model) ? [...namedModels([options.model]), ...listed] : listed;
+    const models2 = chooseModels(offered, options.model, reuse ? current.model : signedInOn);
     const facts = { ...key === void 0 ? {} : { key }, ...deviceCode === void 0 ? {} : { deviceCode }, models: models2 };
     left = await app.apply(context2, facts);
     await forgetSignIn(context2, app);
     model2 = models2[0].id;
     say.event("configured", { app: app.id, model: model2, backups: context2.backups.saved }, [
       `${app.does} It starts on ${models2[0].name}.`,
-      ...context2.backups.saved.length > 0 ? [`What changed was copied first, to ${dirname3(context2.backups.saved[0])}.`] : []
+      ...context2.backups.saved.length > 0 ? [`What changed was copied first, to ${dirname4(context2.backups.saved[0])}.`] : []
     ]);
   }
   const until = context2.now() + options.waitMs;
@@ -2139,7 +2719,7 @@ async function connect(context2, app, options) {
       say.event(
         "insufficient_balance",
         { app: app.id, add_funds_url: result.url, run_again: true, message: result.message },
-        [`Your balance is empty. Add a card or funds: ${result.url}`, ...context2.now() + FUNDS_POLL_MS > until ? ["Run this again once they are in."] : ["Waiting for funds. You can stop this and run it again at any time."]]
+        [`Your balance is empty. Add funds: ${result.url}`, ...context2.now() + FUNDS_POLL_MS > until ? ["Run this again once they are in."] : ["Waiting for funds. You can stop this and run it again at any time."]]
       );
       told = true;
     }
@@ -2148,6 +2728,9 @@ async function connect(context2, app, options) {
   }
   const start2 = await app.start(context2, model2);
   say.event("connected", { app: app.id, model: model2, start: start2, notes: left }, ["Connected. AdaptiqAI answered.", ...left, `Start it: ${start2}`]);
+  if (app.startsByCommand?.(context2) !== false && await context2.confirm(`Start ${app.name} now?`)) {
+    await context2.handOver(await app.greet?.(context2, model2, options.hello ?? hello(workspace)) ?? start2);
+  }
   return EXIT.connected;
 }
 async function status(context2, only) {
@@ -2180,13 +2763,21 @@ async function status(context2, only) {
 }
 async function disconnect(context2, app) {
   await forgetSignIn(context2, app);
-  if (!await app.found(context2) || (await app.current(context2)).base === void 0) {
-    context2.say.event("not_connected", { app: app.id }, `${app.name} is not connected to AdaptiqAI here.`);
+  const connected = await app.found(context2) && (await app.current(context2)).base !== void 0;
+  const notes = connected ? await app.remove(context2) ?? [] : [];
+  const { removed, left } = await app.clean?.(context2) ?? { removed: [], left: [] };
+  if (!connected) {
+    context2.say.event("not_connected", { app: app.id, removed, notes: left }, [
+      `${app.name} is not connected to AdaptiqAI here.`,
+      ...removed.length > 0 ? ["It still held an AdaptiqAI key, which is gone now."] : [],
+      ...left
+    ]);
     return 0;
   }
-  await app.remove(context2);
-  context2.say.event("disconnected", { app: app.id, console_url: context2.console, backups: context2.backups.saved }, [
+  context2.say.event("disconnected", { app: app.id, console_url: context2.console, backups: context2.backups.saved, removed, notes: [...notes, ...left] }, [
     `${app.name} no longer uses AdaptiqAI.`,
+    ...notes,
+    ...left,
     `To end the connection too, disconnect it in the console: ${context2.console}`
   ]);
   return 0;
@@ -2195,6 +2786,7 @@ async function disconnect(context2, app) {
 // src/entry.ts
 var USAGE = `Connect the AI app you use to AdaptiqAI.
 
+  npx -y adaptiqai                   pick the app, then connect it
   npx -y adaptiqai connect <app>     sign in, set the app up, and test it
   npx -y adaptiqai status [app]      say where each app stands
   npx -y adaptiqai disconnect <app>  take AdaptiqAI out of an app
@@ -2218,17 +2810,14 @@ to press Connect; 4 waiting for funds. After 3 or 4, run the same command again.
 `;
 var TEN_MINUTES_MS = 6e5;
 async function pick(context2) {
-  const found = [];
-  for (const app of APPS) if (await app.found(context2)) found.push(app);
-  if (found.length === 1) return found[0];
-  if (found.length === 0) throw new Problem("no_app", `No app that AdaptiqAI connects is installed here. Apps: ${APPS.map((app) => app.id).join(", ")}.`);
+  const here = /* @__PURE__ */ new Set();
+  for (const app of APPS) if (await app.found(context2)) here.add(app.id);
   if (!context2.person) {
-    context2.say.event("choose_app", { apps: found.map((app) => app.id) }, "Say which app.");
+    context2.say.event("choose_app", { apps: APPS.map((app) => app.id), installed: APPS.filter((app) => here.has(app.id)).map((app) => app.id) }, "Say which app.");
     return void 0;
   }
-  found.forEach((app, index) => context2.say.note(`  ${index + 1}. ${app.name}`));
-  const answer = await ask("Which app? ");
-  return found[Number(answer) - 1] ?? appNamed(answer);
+  const index = await context2.choose("Which app do you want to use with AdaptiqAI?", APPS.map((app) => `${app.name}${here.has(app.id) ? " (on this computer)" : ""}`));
+  return index === void 0 ? void 0 : APPS[index];
 }
 async function ask(question) {
   const reader = createInterface({ input: process.stdin, output: process.stdout });
@@ -2249,14 +2838,24 @@ function context(person, json, app) {
     platform,
     person,
     confirm: async (question) => person && !/^n/iu.test(await ask(`${question} [Y/n] `)),
+    choose: async (question, options) => {
+      if (!person) return void 0;
+      process.stdout.write(`${question}
+${options.map((option, index) => `  ${index + 1}. ${option}`).join("\n")}
+`);
+      const answer = Number(await ask(`Pick 1-${options.length}: `));
+      return Number.isInteger(answer) && answer >= 1 && answer <= options.length ? answer - 1 : void 0;
+    },
     say: new Output(json),
     run: runner(env, platform),
+    handOver: handOver(env, platform),
+    node: process.versions.node,
     fetch: globalThis.fetch.bind(globalThis),
     now: Date.now,
     sleep: async (ms) => {
       await new Promise((resolve) => setTimeout(resolve, ms));
     },
-    backups: new Backups(join15(cliDir(paths), "backups", app, stamp))
+    backups: new Backups(join16(cliDir(paths), "backups", app, stamp))
   };
 }
 var parse = (argv) => parseArgs({
@@ -2281,7 +2880,7 @@ async function main(argv) {
   }
   const { values, positionals } = parsed;
   if (values.version) {
-    process.stdout.write(`${"0.1.0"}
+    process.stdout.write(`${"0.2.0"}
 `);
     return 0;
   }
@@ -2305,9 +2904,21 @@ async function main(argv) {
   const seconds = values.wait === void 0 ? void 0 : Number(values.wait);
   if (seconds !== void 0 && !(seconds >= 0)) throw new Problem("bad_wait", "--wait takes a number of seconds.", { exit: EXIT.usage });
   const waitMs = values["no-wait"] ? 0 : seconds === void 0 ? person ? TEN_MINUTES_MS : 0 : seconds * 1e3;
+  const code = run.env.ADAPTIQ_CONNECT?.trim();
+  if (code !== void 0 && code !== "" && !/^[A-Za-z0-9_-]{32,128}$/u.test(code)) throw new Problem("bad_code", "ADAPTIQ_CONNECT is not a connect code from the console.", { exit: EXIT.usage });
   const app = named ?? await pick(run);
   if (app === void 0) return EXIT.usage;
-  return await connect(run, app, { ...values.model === void 0 ? {} : { model: values.model }, waitMs, open: !values["no-open"] });
+  const key = run.env.ADAPTIQ_KEY?.trim();
+  if (key !== void 0 && key !== "" && !/^ak_[A-Za-z0-9._-]+$/u.test(key)) throw new Problem("bad_key", "ADAPTIQ_KEY is not an AdaptiqAI key.", { exit: EXIT.usage });
+  const hello2 = run.env.ADAPTIQ_HELLO?.replace(new RegExp("\\p{Cc}", "gu"), "").trim().slice(0, 400);
+  return await connect(run, app, {
+    ...values.model === void 0 ? {} : { model: values.model },
+    ...hello2 === void 0 || hello2 === "" ? {} : { hello: hello2 },
+    ...key === void 0 || key === "" ? {} : { key },
+    ...code === void 0 || code === "" ? {} : { code },
+    waitMs,
+    open: !values["no-open"]
+  });
 }
 var quit = (code) => {
   process.stdout.write("", () => process.exit(code));