aegiscode 6.3.1 → 6.4.0

package/README.md

@@ -38,12 +38,22 @@ npm install -g aegiscode
 node cli/bin/aegiscode.js
 ```
 
-Requires Node 18+. Set your key once:
+Requires Node 18+. Save your key once — it goes to `~/.aegiscode/credentials.json`
+(mode `0600`) and is then picked up by every later launch, script and shell:
 
 ```bash
-export AEGIS_API_KEY="aegis_..."
+aegiscode login                    # prompts, no echo
+aegiscode login "aegis_..."        # or inline
+aegiscode key status               # masked key + which source is in use
+aegiscode logout                   # remove it
 ```
 
+`AEGIS_API_KEY` still works and still wins (useful in CI, or for a one-off);
+`aegiscode --key <key>` applies to a single run and is never saved. A key an
+older AEGIS CLI left in `~/.aegiscode/config.json` is picked up and copied into
+the 0600 store automatically — `/cloud status` says so if the plaintext copy is
+still there.
+
 ## Use
 
 ```bash
@@ -101,8 +111,8 @@ command for command — 75 entries across nine categories:
 | Session & context | `/clear` `/compact` `/cost` `/exit` `/new` `/recap` `/resume` `/rewind` `/agents` `/status` `/teleport` `/version` `/clone` `/schedule` |
 | Workspace | `/run` `/build` `/cd` `/copy` `/init` `/review` `/prs` |
 | Model & behavior | `/model` `/effort` `/thinking` `/theme` `/vim` `/router` `/confirm` `/yolo` `/permissions` `/hooks` `/skills` `/mcp` |
-| Data | `/context` `/export` `/tokens` |
-| Auth | `/credentials` `/byok` `/byok-set` `/byok-rm` |
+| Data | `/context` `/export` `/tokens` `/sync` |
+| Auth | `/key` `/login` `/logout` `/credentials` `/byok` `/byok-set` `/byok-rm` |
 | Support | `/help` `/doctor` `/troubleshooting` `/feedback` `/bug` `/issue` `/onboarding` `/benchmark` `/release-notes` `/billing` `/cloud` |
 | Aegis plugin | `/aegis-ask` `/aegis-status` `/aegis-recall` `/aegis-remember` `/memory` `/aegis-council` `/aegis-multi` `/aegis-print` `/aegis-import` `/tool` |
 | Fun | `/radio` `/waifu` |
@@ -119,10 +129,35 @@ the project and writes `AEGIS.md`, `/export` writes the transcript out,
 `/resume` and `/rewind` read the session store, `/cd` moves the working
 directory, `/doctor` runs diagnostics.
 
-The only two commands that answer "not available" are `/login` and `/logout`:
-their whole premise is Claude Code's own auth loop, which this client does not
-participate in — it authenticates with an AEGIS key (or your own provider key
-via `/byok-set`). They say so, and point at the working alternative.
+## Account key and cloud sync
+
+Three ways in, one store: `aegiscode login <key>`, `/key <api_key>` (or a bare
+`/key` to paste it echo-off), and `$AEGIS_API_KEY`. The first two persist;
+the env var outranks the store and needs no persistence. `/login` used to be an
+unavailable Claude Code auth-loop command pointing at `/byok-set` — which stores
+a *provider* key, so that advice sent the AEGIS key into the wrong slot. It is
+now the in-band way to set the account key, and `/logout` removes it.
+
+Conversation sync is the same `conversationSyncPush/Pull` surface the desktop
+uses, over the sessions this host already keeps in `~/.aegiscode/history.jsonl`:
+
+```bash
+/sync                 # push what is pending, then pull — the one you want
+/sync status          # local / pending / in-sync counts, last push and pull
+/sync on | off         # auto-push after each turn (off by default)
+/cloud                 # key + sync state in one panel
+/cloud activate        # turn on cloud memory for the account
+```
+
+Sync is **off by default** on purpose: the server charges a push for the growth
+of a session against the plan's synced-token ceiling, so nothing is uploaded
+until you ask. A refusal (HTTP 402) is reported as a quota refusal with the way
+out, not as "sync failed". Imported remote sessions land in the same store
+`/resume` reads, and are marked `imported` with estimated token counts — never
+passed off as measured here.
+
+There are currently **no** `unavailable` commands: every entry in the registry
+either runs or is a real handler that says honestly what it cannot do.
 
 ## The chatflow
 

package/bin/aegiscode.js

@@ -24,10 +24,16 @@ Usage:
   aegiscode -p "question"       same, explicit
   echo "q" | aegiscode -p -     read the prompt from stdin
 
+Account:
+  aegiscode login [<key>]       save your AEGIS API key (prompts, no echo, if omitted)
+  aegiscode logout              remove the saved key
+  aegiscode key status          show which key is in use and where it came from
+
 Options:
   -m, --model <id>        pin a model id (see /models; default: server choice)
       --base <url>        API base (default $AEGIS_API_BASE or aegiscloud.org)
-      --key <key>         API key for this run (prefer $AEGIS_API_KEY)
+      --key <key>         API key for THIS RUN only — it is not saved. Use
+                           "aegiscode login" to store one for good.
       --json              with -p: emit JSON instead of text
       --no-stream         buffer the answer instead of streaming it
       --max-tokens <n>    output ceiling hint
@@ -59,9 +65,22 @@ function parseArgs(argv) {
     prompt: null,
     help: false,
     version: false,
+    command: null,
+    commandArg: null,
   };
   const rest = [];
 
+  // An account subcommand is `argv[0]` and nothing else — position 0 only, so
+  // `aegiscode -p "key"` (a one-shot prompt whose text happens to be one of
+  // these words) is never hijacked into an account operation.
+  const head = argv[0];
+  if (head && !head.startsWith('-') && ACCOUNT_COMMANDS.has(head)) {
+    const arg = argv[1];
+    opts.command = head;
+    opts.commandArg = arg && !arg.startsWith('-') ? arg : null;
+    argv = argv.slice(opts.commandArg ? 2 : 1);
+  }
+
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     const next = () => {
@@ -127,6 +146,134 @@ function parseArgs(argv) {
   return opts;
 }
 
+/**
+ * Account subcommands: the in-band way to give this host a key.
+ *
+ * They exist because an `AEGIS_API_KEY` export was previously the *only* way
+ * in, and an export does not survive a new terminal. `--key` remains purely
+ * per-run (CI, a rotation test) so there is exactly one thing a user has to
+ * remember: `aegiscode login` saves it, `aegiscode logout` removes it.
+ */
+const ACCOUNT_COMMANDS = new Set(['login', 'logout', 'key']);
+
+/**
+ * Run `login` / `logout` / `key` and return a process exit code.
+ *
+ * Exit codes are meaningful because these are the commands a script calls:
+ * 0 = done, 1 = the server refused the credential, 2 = no credential and no
+ * way to ask for one (no TTY).
+ */
+async function runAccountCommand(command, arg, io = {}) {
+  const stdout = io.stdout || process.stdout;
+  const stderr = io.stderr || process.stderr;
+  const stdin = io.stdin || process.stdin;
+  const { credentials, readSecret, maskKey } = loadAccountDeps();
+
+  const where = () => credentials.credentialsPath();
+
+  if (command === 'logout' || (command === 'key' && ['clear', 'remove', 'rm'].includes(String(arg || '').toLowerCase()))) {
+    const res = credentials.clearApiKey();
+    stdout.write(
+      res.cleared
+        ? `aegiscode: key removed from ${res.path}\n`
+        : 'aegiscode: no saved key to remove\n'
+    );
+    if (credentials.legacyKeyOnDisk()) {
+      stdout.write(
+        'aegiscode: note — a plaintext copy is also in config.json, written by an older ' +
+          'AEGIS CLI; delete its "aegiscloud" block as well to finish removing it\n'
+      );
+    }
+    return 0;
+  }
+
+  if (command === 'key' && ['status', 'show', ''].includes(String(arg || '').toLowerCase())) {
+    const st = credentials.keyStatus();
+    if (io.json) {
+      stdout.write(
+        JSON.stringify(
+          {
+            configured: st.configured,
+            source: st.source,
+            source_label: credentials.sourceLabel(st.source),
+            path: st.path,
+            file_mode: st.fileMode,
+            masked: st.configured ? maskKey(st.key) : null,
+            memory_token: st.memoryToken,
+            verified_at: st.verifiedAt,
+            plaintext_copy_in_config: st.legacyPlaintext,
+          },
+          null,
+          2
+        ) + '\n'
+      );
+      return st.configured ? 0 : 1;
+    }
+    stdout.write(
+      [
+        `key:      ${st.configured ? maskKey(st.key) : 'not set'}`,
+        `source:   ${credentials.sourceLabel(st.source)}`,
+        `file:     ${st.path}${st.fileMode ? ` (${st.fileMode})` : ''}`,
+        `memory:   ${st.memoryToken ? 'token held (cloud sync ready)' : 'no token'}`,
+        st.verifiedAt ? `verified: ${st.verifiedAt}` : null,
+        st.legacyPlaintext
+          ? `note:     a plaintext copy also sits in config.json — re-save with \`aegiscode login\` to move it`
+          : null,
+      ]
+        .filter(Boolean)
+        .join('\n') + '\n'
+    );
+    return st.configured ? 0 : 1;
+  }
+
+  // `login [<key>]` and `key <api_key>`: take the key inline or ask for it.
+  let key = arg && arg !== 'status' ? String(arg).trim() : '';
+  if (!key) {
+    if (!stdin.isTTY) {
+      stderr.write(
+        'aegiscode: no terminal to prompt on — pass the key: `aegiscode login <api_key>`\n' +
+          '           (or set AEGIS_API_KEY for a single run)\n'
+      );
+      return 2;
+    }
+    key = await readSecret('AEGIS API key (kept off screen, Enter to cancel): ', { stdin, stdout });
+  }
+  if (!key) {
+    stderr.write('aegiscode: no key given — nothing saved\n');
+    return 2;
+  }
+
+  const { createApp } = require('../src/app.js');
+  const app = createApp({ interactive: false });
+  const res = await app.setApiKey(key);
+  if (!res.ok) {
+    stderr.write(`aegiscode: ${res.message || 'that key could not be saved'}\n`);
+    return 2;
+  }
+  const who = res.account && (res.account.email || res.account.plan);
+  stdout.write(`aegiscode: key saved to ${res.path}${who ? ` — ${who}` : ''}\n`);
+  if (res.error) {
+    const status = res.error.status;
+    stderr.write(`aegiscode: the account check failed: ${res.error.message}\n`);
+    if (status === 401 || status === 403) {
+      stderr.write('aegiscode: the key is stored but the server refused it — re-run with a fresh key\n');
+      return 1;
+    }
+    stderr.write('aegiscode: (stored anyway — the server could not be reached to confirm it)\n');
+    return 0;
+  }
+  stdout.write('aegiscode: verified — run `aegiscode` to start a session\n');
+  return 0;
+}
+
+/** Lazily required so `--version`/`--help` stay dependency-free and instant. */
+function loadAccountDeps() {
+  const credentials = require('../src/credentials.js');
+  const { readSecret } = require('../src/secret.js');
+  const { maskKey } = require('../src/format.js');
+  return { credentials, readSecret, maskKey };
+}
+
 function readStdin() {
   return new Promise((resolve) => {
     let buf = '';
@@ -163,6 +310,18 @@ async function main(argv = process.argv.slice(2)) {
   if (opts.base) process.env.AEGIS_API_BASE = opts.base;
   if (opts.key) process.env.AEGIS_API_KEY = opts.key;
 
+  // Account subcommands run before a session is built: they are one-shot,
+  // non-interactive, and must work in a script (`aegiscode login "$KEY"`) as
+  // well as at a prompt.
+  if (ACCOUNT_COMMANDS.has(opts.command)) {
+    return runAccountCommand(opts.command, opts.commandArg, {
+      json: opts.json,
+      stdin: process.stdin,
+      stdout: process.stdout,
+      stderr: process.stderr,
+    });
+  }
+
   const { createApp } = require('../src/app.js');
 
   let prompt = opts.prompt;
@@ -214,4 +373,4 @@ if (require.main === module) {
     });
 }
 
-module.exports = { main, parseArgs, HELP };
+module.exports = { main, parseArgs, HELP, ACCOUNT_COMMANDS, runAccountCommand };

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "aegiscode",
   "productName": "AEGIS Code",
-  "version": "6.3.1",
-  "description": "aegiscode — the command-line version of AEGIS Desktop. The shared tool surface in your shell, over the same thin transport and tool registry as the MCP plugin and the desktop app. Ships transport + UI only; no brain.",
+  "version": "6.4.0",
+  "description": "aegiscode \u2014 the command-line version of AEGIS Desktop. The shared tool surface in your shell, over the same thin transport and tool registry as the MCP plugin and the desktop app. Ships transport + UI only; no brain.",
   "author": {
     "name": "AEGIS Code",
     "email": "nborneklint@gmail.com"

package/src/app.js

@@ -27,6 +27,9 @@ const { GLYPH, VERBS, themeOf, RESET, THEME_TABLE } = require('./theme.js');
 const { LiveRegion, termWidth, w } = require('./screen.js');
 const { parseLine, COMMANDS, visibleCommands } = require('./commands.js');
 const { updateConfig, loadPermissions, loadConfig, configExists } = require('./config.js');
+const credentials = require('./credentials.js');
+const cloudsync = require('./cloudsync.js');
+const { readSecret } = require('./secret.js');
 const { normalizeModelCatalog, pickerEntries, catalogIds } = require('./models.js');
 const { appendHistory, readSessionTranscript, readOwnSessions } = require('./history.js');
 const { snapshotCheckpoint } = require('./checkpoint.js');
@@ -50,7 +53,12 @@ function createApp(options = {}) {
   };
   const out = options.out || process.stdout;
   const err = options.err || process.stderr;
-  const client = options.client || createClient();
+  // The key comes from the credential store (env → credentials.json →
+  // config.json) rather than from the environment alone: an export does not
+  // survive a new shell, and until it is *stored* every one of those launches
+  // is "no key" with no in-band way to set one. An injected client keeps
+  // whatever key it was built with.
+  const client = options.client || createClient(credentials.clientOptions());
   const { TOOLS, toolList } = options.tools || createTools(client);
 
   // Tool-approval gate (exec/writeFile/editFile confirm before running).
@@ -87,7 +95,11 @@ function createApp(options = {}) {
   const commandCtx = {
     light: opts.light,
     model: opts.model,
-    effort: 'high',
+    // `null` = "auto": send no effort, so the server sizes the turn from the
+    // ask. This is the *budget* control on the pooled class (aegis1 sizes the
+    // token ladder from it), which is why it is not defaulted to a rung here —
+    // pinning one would make every turn cost what that rung grants.
+    effort: null,
     thinking: false,
     themeIndex: opts.light ? 2 : 1,
     vim: false,
@@ -147,6 +159,83 @@ function createApp(options = {}) {
     }
   }
 
+  // ── the AEGIS account key ─────────────────────────────────────────────────
+  //
+  // Set/forget at runtime, for `/key` and `aegiscode login`. Both paths are the
+  // same three steps — persist, apply to the live client, invalidate the model
+  // catalog — because a key that is stored but not applied leaves the current
+  // session failing, and one that is applied but not stored is gone next launch.
+
+  /**
+   * Persist an account key and start using it immediately.
+   *
+   * `verify` spends one `/api/verify-api-key` round trip to catch a bad key at
+   * the moment it is entered rather than at the first prompt, and is also how
+   * the memory token (cloud sync's credential) is obtained — so a successful
+   * login leaves both credentials in the store.
+   */
+  async function setApiKey(raw, { verify = true } = {}) {
+    const saved = credentials.saveApiKey(raw);
+    if (!saved.ok) return saved;
+    client.setApiKey(saved.key);
+    modelCache.models = [];
+    modelCache.at = 0;
+    let account = null;
+    let error = null;
+    if (verify) {
+      try {
+        const info = (await client.verifyApiKey()) || {};
+        account = info;
+        const patch = { verifiedAt: new Date().toISOString() };
+        if (info.memory_token) patch.memoryToken = info.memory_token;
+        if (info.plan) patch.plan = info.plan;
+        patch.account = { plan: info.plan || null, email: info.email || null, valid: info.valid !== false };
+        credentials.writeCredentials(patch);
+        if (info.plan) session.plan = info.plan;
+        if (info.email) session.account = { ...(session.account || {}), email: info.email };
+      } catch (e) {
+        error = e;
+      }
+    }
+    return { ...saved, account, error };
+  }
+
+  /** Drop the stored key and stop authenticating this session. */
+  function forgetApiKey() {
+    const res = credentials.clearApiKey();
+    client.setApiKey('');
+    modelCache.models = [];
+    modelCache.at = 0;
+    return res;
+  }
+
+  function cloudSyncEnabled() {
+    try {
+      return loadConfig().cloudSync === true;
+    } catch {
+      return false;
+    }
+  }
+
+  function setCloudSync(on) {
+    return updateConfig({ cloudSync: on === true });
+  }
+
+  /**
+   * Copy a key found in config.json into the 0600 store, once, so the next run
+   * reads the tight copy. Never deletes the original — that file belongs to
+   * another product and holds the user's key.
+   */
+  function adoptLegacyKeyOnce() {
+    try {
+      const resolved = credentials.resolveApiKey();
+      if (resolved.source !== 'config') return [];
+      return credentials.adoptLegacy().adopted;
+    } catch {
+      return [];
+    }
+  }
+
   // ── the AEGIS Cloud model catalog ──────────────────────────────────────────
   //
   // `/model` (and the alt+p chord that dispatches it) reads the pinnable ids
@@ -371,6 +460,14 @@ function createApp(options = {}) {
           model: commandCtx.model || undefined,
           system: opts.system,
           maxTokens: opts.maxTokens,
+          // `effort` is the pooled budget control, and it travels on every turn
+          // — this host only ever runs the 'aegis' class, whose calls are sized
+          // server-side from it (aegis1 services/pool_brain.py). It used to be
+          // held in the session state and rendered in the status line without
+          // ever reaching the wire, so /effort changed the display and nothing
+          // about what the turn cost. `null` (auto) is omitted so the server
+          // infers the rung from the ask.
+          effort: commandCtx.effort || undefined,
           // false asks the engine for the buffered (non-stream) wire form, so
           // `--no-stream` and piped runs get a single body rather than SSE.
           stream: commandCtx.stream !== false,
@@ -436,7 +533,7 @@ function createApp(options = {}) {
         render.renderNotice(
           ctx(),
           'error',
-          'no AEGIS_API_KEY set — export one (https://aegiscloud.org) or run /byok-set'
+          `no AEGIS account key — ${credentials.HOW_TO_SET} (or set $${credentials.KEY_ENV})`
         )
       );
       return;
@@ -494,7 +591,7 @@ function createApp(options = {}) {
     const tool = TOOLS[name];
     if (!tool) throw new Error(`unknown tool: ${name}`);
     if (!client.apiKey) {
-      throw new Error('no AEGIS_API_KEY set — export one (https://aegiscloud.org)');
+      throw new Error(`no AEGIS account key — ${credentials.HOW_TO_SET}`);
     }
     const text = await tool.run(args || {});
     emit(render.renderToolResult(ctx(), name, text, width()));
@@ -713,6 +810,17 @@ function createApp(options = {}) {
       TOOLS,
       saveConfig: (patch) => updateConfig(patch),
       showThemePicker: () => showThemePicker(),
+      // Credential + cloud-sync surface for the /key, /cloud and /sync commands.
+      // Defined here on the app's context so the chatflow's Object.assign-based
+      // context inherits them too — one definition, both hosts.
+      keyStatus: () => credentials.keyStatus(),
+      setApiKey: (raw, o) => setApiKey(raw, o),
+      forgetApiKey: () => forgetApiKey(),
+      readSecret: (text) => readSecret(text, { stdin: process.stdin, stdout: out }),
+      cloudsync,
+      cloudSyncEnabled: () => cloudSyncEnabled(),
+      setCloudSync: (on) => setCloudSync(on),
+      adoptLegacyKey: () => adoptLegacyKeyOnce(),
     };
     Object.defineProperty(c, 'sessionId', {
       enumerable: true,
@@ -801,7 +909,7 @@ function createApp(options = {}) {
     try {
       let args = cmd.build(arg);
       if (cmd.secret) {
-        const key = await readSecret(`provider key for ${args.provider}: `);
+        const key = await askSecret(`provider key for ${args.provider}: `);
         if (!key) {
           emit(render.renderNotice(ctx(), 'warn', 'empty key — nothing sent'));
           return true;
@@ -816,52 +924,26 @@ function createApp(options = {}) {
     return true;
   }
 
-  /** Read a secret without echoing it (raw mode; falls back to plain input). */
-  function readSecret(promptText) {
-    if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function') {
-      return Promise.resolve('');
-    }
-    return new Promise((resolve) => {
-      const t = themeOf(ctx());
-      out.write(t.gray + promptText + RESET);
-      const stdin = process.stdin;
-      let buf = '';
-      stdin.setRawMode(true);
-      stdin.resume();
-      const onData = (chunk) => {
-        for (const ch of chunk.toString('utf8')) {
-          if (ch === '\r' || ch === '\n') {
-            stdin.setRawMode(false);
-            stdin.removeListener('data', onData);
-            out.write('\n');
-            return resolve(buf);
-          }
-          if (ch === '\x03') {
-            // ctrl+c
-            stdin.setRawMode(false);
-            stdin.removeListener('data', onData);
-            out.write('\n');
-            return resolve('');
-          }
-          if (ch === '\u007f') {
-            buf = buf.slice(0, -1);
-            out.write('\b \b');
-            continue;
-          }
-          buf += ch;
-          out.write('•');
-        }
-      };
-      stdin.on('data', onData);
-    });
+  /**
+   * Ask for a secret on this session's streams.
+   *
+   * The prompt loop itself lives in secret.js, shared with `aegiscode login` in
+   * the bin — one implementation, so the terminal host and the non-interactive
+   * entry point cannot differ in whether a key is echoed or masked. Only the
+   * prompt's colouring is the session's business.
+   */
+  function askSecret(promptText) {
+    const t = themeOf(ctx());
+    return readSecret(t.gray + promptText + RESET, { stdin: process.stdin, stdout: out });
   }
 
   // --- entry points ---------------------------------------------------------
 
   /** Non-interactive: one prompt, plain output, exit code. */
   async function runOnce(prompt, { json = false } = {}) {
+    adoptLegacyKeyOnce();
     if (!client.apiKey) {
-      err.write('aegiscode: no AEGIS_API_KEY set. Export your key first (https://aegiscloud.org).\n');
+      err.write(`aegiscode: no AEGIS account key. ${credentials.HOW_TO_SET}, or set $${credentials.KEY_ENV}.\n`);
       return 2;
     }
     const res = await ask(prompt);
@@ -946,6 +1028,39 @@ function createApp(options = {}) {
     } catch {
       /* persistence is best-effort */
     }
+    // Auto-sync hook: one place, reached by both the linear REPL and the
+    // chatflow's session loop, and only when the user turned it on. Off by
+    // default because a push is billed against the plan's synced-token ceiling
+    // (aegis1 charges the *growth* of a session), so uploading is a choice.
+    if (cloudSyncEnabled()) autoSync();
+  }
+
+  /**
+   * Push after a turn, in the background.
+   *
+   * Deliberately not awaited and deliberately quiet on success: this runs after
+   * every turn, and a line per turn would be noise. Failures are reported once
+   * per session per session-cycle — a quota refusal that repeats forever is a
+   * wall of text, not information — and never thrown, because the user's turn
+   * already succeeded by the time this runs.
+   */
+  let autoSyncNotes = new Set();
+  function autoSync() {
+    if (!client.apiKey) return;
+    Promise.resolve()
+      .then(() => cloudsync.push(client))
+      .then((res) => {
+        if (res && res.failed && res.failed.length) {
+          const f = res.failed[0];
+          if (autoSyncNotes.has(f.kind)) return;
+          autoSyncNotes.add(f.kind);
+          const hint = f.hint ? ` — ${f.hint}` : '';
+          emit(render.renderNotice(ctx(), f.kind === 'quota' ? 'warn' : 'error', `cloud sync: ${f.message}${hint}`));
+        }
+      })
+      .catch(() => {
+        /* offline is not worth interrupting a session over */
+      });
   }
 
   /** One line of session accounting, for ctrl+t and the meta row. */  function tokenSummary() {
@@ -1073,6 +1188,8 @@ function createApp(options = {}) {
       return;
     }
     if (!opts.model && cfg.model) commandCtx.model = cfg.model;
+    // `null` in the config is "auto" and is deliberately not assigned over the
+    // default — there is nothing to restore, because nothing is pinned.
     if (cfg.effort) commandCtx.effort = cfg.effort;
     if (typeof cfg.vim === 'boolean') commandCtx.vim = cfg.vim;
     if (cfg.lastRecap) commandCtx.lastRecap = cfg.lastRecap;
@@ -1101,6 +1218,7 @@ function createApp(options = {}) {
       process.stdout.isTTY;
     if (tty) {
       restorePrefs();
+      adoptLegacyKeyOnce();
       // Onboarding runs in the normal buffer, before the session takes the
       // alternate screen — the reference's order. A declined trust check must
       // abort: the reference returns without ever reaching `session(ctx)`.
@@ -1108,8 +1226,31 @@ function createApp(options = {}) {
         continue: !!options.continue,
         seen: options.seen || configExists,
         save: (patch) => updateConfig(patch),
+        // With no key the session can do nothing, so ask for it here where the
+        // user is already answering questions — verified on submit, and saved
+        // 0600 so the next launch (and every script) has it.
+        needsKey: () => !client.apiKey,
+        submitKey: (key) => setApiKey(key),
       });
       if (!onboard.ok) return 0;
+      if (onboard.key && onboard.key.set) {
+        emit(
+          render.renderNotice(
+            ctx(),
+            'info',
+            `key saved to ${credentials.credentialsPath()} — no export needed from now on`
+          )
+        );
+      }
+      if (onboard.key && onboard.key.skipped && !client.apiKey) {
+        emit(
+          render.renderNotice(
+            ctx(),
+            'warn',
+            `no key saved — /key <api_key> or \`aegiscode login\` whenever you are ready`
+          )
+        );
+      }
       // A stored pin the platform does not advertise routes elsewhere in
       // silence (see validatePinnedModel) — checked once, here, where the user
       // can act on it. Not on `-p`: a network round-trip ahead of the first
@@ -1129,6 +1270,7 @@ function createApp(options = {}) {
       return 0;
     }
     restorePrefs();
+    adoptLegacyKeyOnce();
     return runLinearRepl();
   }
 
@@ -1154,6 +1296,13 @@ function createApp(options = {}) {
     recordTurn,
     persistTurn,
     restorePrefs,
+    setApiKey,
+    forgetApiKey,
+    adoptLegacyKeyOnce,
+    cloudSyncEnabled,
+    setCloudSync,
+    cloudsync,
+    keyStatus: () => credentials.keyStatus(),
     sessionId: () => commandCtx.sessionId,
     tokenSummary,
     resumeSession,

package/src/chatflow.js

@@ -164,7 +164,7 @@ const separatorLine = (cols, ctx) => [span(themeOf(ctx).dim, '─'.repeat(cols))
 /** The idle bottom-left line: which effort level the next turn runs at. */
 function effortLine(ctx, cols) {
   const t = themeOf(ctx);
-  const txt = `● ${ctx.effort || 'high'} · /effort`;
+  const txt = `● ${ctx.effort || 'auto'} · /effort`;
   const pad = ' '.repeat(Math.max(0, cols - [...txt].length - 4));
   return [span(t.gray, pad + txt)];
 }
@@ -1111,12 +1111,15 @@ async function runSession(host) {
         return;
       }
       if (type === 'effort') {
-        const levels = ['low', 'medium', 'high'];
-        const chosen = levels[overlay.sel || 0];
+        // The picker's own order, not a second copy of the level names: this
+        // used to re-declare ['low','medium','high'] here while the picker drew
+        // its own table, so the row a user picked and the value it stored were
+        // resolved through different lists.
+        const chosen = overlays.EFFORT_VALUES[overlay.sel || 0];
         overlay = null;
         ctx.effort = chosen;
         host.updateConfig({ effort: chosen });
-        note(`effort: ${chosen}`);
+        note(`effort: ${chosen || 'auto'}`);
         render();
         return;
       }