archbyte 0.3.3 → 0.3.5

package/bin/archbyte.js

@@ -32,17 +32,15 @@ const program = new Command();
 
 program
   .name('archbyte')
-  .description('ArchByte - See what agents build. As they build it.')
-  .version(PKG_VERSION)
+  .description('ArchByte - AI architecture analysis with an interactive diagram UI')
+  .version(PKG_VERSION, '-v, --version', 'Show version number')
   .addHelpText('after', `
   Quick start:
-    1. Sign up at https://archbyte.heartbyte.io
-    2. $ archbyte login       Sign in from the CLI
-    3. $ archbyte init        Configure your model provider
-    4. $ archbyte run         Analyze → generate → serve
+    $ archbyte login          Sign in or create a free account
+    $ archbyte init           Configure your model provider
+    $ archbyte run            Analyze + open interactive diagram UI
 
   https://archbyte.heartbyte.io
-  Support: archbyte@heartbyte.io
 `);
 
 // — Getting started —
@@ -220,8 +218,9 @@ program
   .argument('[action]', 'show, set, get, or path')
   .argument('[key]', 'config key (provider, api-key, model)')
   .argument('[value]', 'config value')
-  .action(async (action, key, value) => {
-    await handleConfig({ args: [action, key, value].filter(Boolean) });
+  .option('--raw', 'Show unmasked values (for scripting)')
+  .action(async (action, key, value, options) => {
+    await handleConfig({ args: [action, key, value].filter(Boolean), raw: options.raw });
   });
 
 program

package/dist/cli/auth.d.ts

@@ -34,6 +34,9 @@ export declare function getVerifiedTier(): "free" | "premium";
 /**
  * Check if an offline action is allowed. Returns true if within limits.
  * Increments the counter when allowed.
+ *
+ * Uses atomic write-to-temp-then-rename to prevent race conditions
+ * between concurrent CLI invocations.
  */
 export declare function checkOfflineAction(): {
     allowed: boolean;

package/dist/cli/auth.js

@@ -178,8 +178,17 @@ function saveCredentials(creds) {
         // Windows doesn't support chmod
     }
 }
+/**
+ * Check if credentials are expired. Treats invalid/unparseable dates
+ * as expired (fail-closed) to prevent corrupted files from bypassing
+ * expiry checks.
+ */
 function isExpired(creds) {
-    return new Date(creds.expiresAt) < new Date();
+    const expiry = new Date(creds.expiresAt);
+    // Invalid Date — treat as expired (fail-closed)
+    if (isNaN(expiry.getTime()))
+        return true;
+    return expiry < new Date();
 }
 function parseJWTPayload(token) {
     try {
@@ -268,6 +277,9 @@ const OFFLINE_MAX_FREE = 0; // Free users: 0 offline actions (must verify online
 /**
  * Check if an offline action is allowed. Returns true if within limits.
  * Increments the counter when allowed.
+ *
+ * Uses atomic write-to-temp-then-rename to prevent race conditions
+ * between concurrent CLI invocations.
  */
 export function checkOfflineAction() {
     const tier = getVerifiedTier();
@@ -293,13 +305,15 @@ export function checkOfflineAction() {
                 reason: `Offline action limit reached (${maxActions}/${maxActions}). Reconnect to the license server to continue.`,
             };
         }
-        // Increment and save
+        // Increment and save atomically (write to temp file, then rename)
         data.count++;
-        fs.writeFileSync(OFFLINE_ACTIONS_PATH, JSON.stringify(data), "utf-8");
+        const tmpPath = OFFLINE_ACTIONS_PATH + `.${process.pid}.tmp`;
+        fs.writeFileSync(tmpPath, JSON.stringify(data), "utf-8");
         try {
-            fs.chmodSync(OFFLINE_ACTIONS_PATH, 0o600);
+            fs.chmodSync(tmpPath, 0o600);
         }
         catch { /* Windows */ }
+        fs.renameSync(tmpPath, OFFLINE_ACTIONS_PATH);
         return { allowed: true };
     }
     catch {
@@ -322,51 +336,66 @@ export function resetOfflineActions() {
 // === OAuth Flow ===
 function startOAuthFlow(provider = "github") {
     return new Promise((resolve, reject) => {
+        let resolved = false;
         const timeout = setTimeout(() => {
             server.close();
-            reject(new Error("Login timed out (60s). Try again or use --token."));
+            if (!resolved) {
+                resolved = true;
+                reject(new Error("Login timed out (60s). Try again or use --token."));
+            }
         }, OAUTH_TIMEOUT_MS);
         const server = http.createServer(async (req, res) => {
             const url = new URL(req.url ?? "/", `http://localhost:${CLI_CALLBACK_PORT}`);
-            if (url.pathname === "/callback") {
-                // Extract token from raw query string, not URLSearchParams
-                // (URLSearchParams decodes '+' as space per x-www-form-urlencoded, corrupting JWT signatures)
-                const rawQuery = (req.url ?? "").split("?")[1] ?? "";
-                const tokenMatch = rawQuery.match(/(?:^|&)token=([^&]+)/);
-                const token = tokenMatch ? decodeURIComponent(tokenMatch[1]) : null;
-                if (!token) {
-                    res.writeHead(400, { "Content-Type": "text/html" });
-                    res.end("<h1>Login failed</h1><p>No token received. Close this window and try again.</p>");
-                    return;
-                }
+            // Only handle /callback — return 404 for everything else
+            if (url.pathname !== "/callback") {
+                res.writeHead(404, { "Content-Type": "text/html" });
+                res.end("<h1>Not found</h1><p>This server only handles OAuth callbacks.</p>");
+                return;
+            }
+            // Prevent double-processing (e.g. browser retry, double-click)
+            if (resolved) {
                 res.writeHead(200, { "Content-Type": "text/html" });
-                res.end("<h1>Login successful!</h1><p>You can close this window and return to your terminal.</p>");
-                clearTimeout(timeout);
-                server.close();
-                // Fetch user info with the token
-                try {
-                    const meRes = await fetch(`${API_BASE}/api/v1/me`, {
-                        headers: { Authorization: `Bearer ${token}` },
-                    });
-                    if (!meRes.ok) {
-                        const errBody = await meRes.text().catch(() => "");
-                        reject(new Error(`Failed to fetch user info (${meRes.status}: ${errBody})`));
-                        return;
-                    }
-                    const { user } = (await meRes.json());
-                    const payload = parseJWTPayload(token);
-                    resolve({
-                        token,
-                        email: user.email,
-                        tier: user.tier,
-                        expiresAt: payload?.exp
-                            ? new Date(payload.exp * 1000).toISOString()
-                            : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
-                    });
-                }
-                catch (err) {
-                    reject(err);
+                res.end("<h1>Already processed</h1><p>You can close this window.</p>");
+                return;
+            }
+            // Extract token from raw query string, not URLSearchParams
+            // (URLSearchParams decodes '+' as space per x-www-form-urlencoded, corrupting JWT signatures)
+            const rawQuery = (req.url ?? "").split("?")[1] ?? "";
+            const tokenMatch = rawQuery.match(/(?:^|&)token=([^&]+)/);
+            const token = tokenMatch ? decodeURIComponent(tokenMatch[1]) : null;
+            if (!token) {
+                res.writeHead(400, { "Content-Type": "text/html" });
+                res.end("<h1>Login failed</h1><p>No token received. Close this window and try again.</p>");
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end("<h1>Login successful!</h1><p>You can close this window and return to your terminal.</p>");
+            resolved = true;
+            clearTimeout(timeout);
+            server.close();
+            // Fetch user info with the token
+            try {
+                const meRes = await fetch(`${API_BASE}/api/v1/me`, {
+                    headers: { Authorization: `Bearer ${token}` },
+                });
+                if (!meRes.ok) {
+                    const errBody = await meRes.text().catch(() => "");
+                    reject(new Error(`Failed to fetch user info (${meRes.status}: ${errBody})`));
+                    return;
                 }
+                const { user } = (await meRes.json());
+                const payload = parseJWTPayload(token);
+                resolve({
+                    token,
+                    email: user.email,
+                    tier: user.tier,
+                    expiresAt: payload?.exp
+                        ? new Date(payload.exp * 1000).toISOString()
+                        : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
+                });
+            }
+            catch (err) {
+                reject(err);
             }
         });
         server.listen(CLI_CALLBACK_PORT, "127.0.0.1", () => {

package/dist/cli/config.d.ts

@@ -1,6 +1,7 @@
 import type { ArchByteConfig } from "../agents/runtime/types.js";
 interface ConfigOptions {
     args: string[];
+    raw?: boolean;
 }
 export declare function handleConfig(options: ConfigOptions): Promise<void>;
 /**

package/dist/cli/config.js

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import chalk from "chalk";
 import { CONFIG_DIR, CONFIG_PATH } from "./constants.js";
+import { maskKey } from "./utils.js";
 const VALID_PROVIDERS = ["anthropic", "openai", "google"];
 export async function handleConfig(options) {
     const [action, key, value] = options.args;
@@ -22,7 +23,7 @@ export async function handleConfig(options) {
             console.error(chalk.red("Usage: archbyte config get <key>"));
             process.exit(1);
         }
-        getConfig(key);
+        getConfig(key, options.raw);
         return;
     }
     if (action === "path") {
@@ -52,6 +53,13 @@ function saveConfig(config) {
         fs.mkdirSync(CONFIG_DIR, { recursive: true });
     }
     fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+    // Restrict permissions — config contains API keys in profiles
+    try {
+        fs.chmodSync(CONFIG_PATH, 0o600);
+    }
+    catch {
+        // Windows doesn't support chmod
+    }
 }
 function showConfig() {
     const config = loadConfig();
@@ -149,7 +157,7 @@ function setConfig(key, value) {
         console.log(chalk.green(`Set ${key} = ${key.includes("key") ? maskKey(value) : value}`));
     }
 }
-function getConfig(key) {
+function getConfig(key, raw = false) {
     const config = loadConfig();
     const profiles = (config.profiles ?? {});
     const active = config.provider;
@@ -160,9 +168,13 @@ function getConfig(key) {
             break;
         case "api-key":
         case "apiKey":
-        case "key":
-            console.log(profile?.apiKey ?? config.apiKey ?? "");
+        case "key": {
+            const apiKey = profile?.apiKey ?? config.apiKey ?? "";
+            // Mask by default to prevent accidental exposure in logs/recordings.
+            // Use `archbyte config get api-key --raw` for the unmasked value.
+            console.log(raw ? apiKey : (apiKey ? maskKey(apiKey) : ""));
             break;
+        }
         case "model":
             console.log(profile?.model ?? config.model ?? "");
             break;
@@ -171,11 +183,6 @@ function getConfig(key) {
             process.exit(1);
     }
 }
-function maskKey(key) {
-    if (key.length <= 8)
-        return "****";
-    return key.slice(0, 6) + "..." + key.slice(-4);
-}
 /**
  * Resolve the full ArchByteConfig from config file + env vars.
  * Supports profiles (new) and legacy flat config (backward compat).
@@ -184,8 +191,11 @@ function maskKey(key) {
 export function resolveConfig() {
     const config = loadConfig();
     const provider = process.env.ARCHBYTE_PROVIDER ?? config.provider;
-    // Reject unknown providers
+    // Reject unknown providers with a helpful message
     if (provider && !VALID_PROVIDERS.includes(provider)) {
+        if (process.env.ARCHBYTE_PROVIDER) {
+            console.error(chalk.red(`Invalid ARCHBYTE_PROVIDER="${provider}". Must be: ${VALID_PROVIDERS.join(", ")}`));
+        }
         return null;
     }
     // Resolve API key + model from profiles first, then legacy flat keys

package/dist/cli/constants.js

@@ -1,6 +1,7 @@
 // Shared constants for the ArchByte CLI.
 // Single source of truth for URLs, ports, paths, and timeouts.
 import * as path from "path";
+import { resolveHome } from "./utils.js";
 // ─── API ───
 export const API_BASE = process.env.ARCHBYTE_API_URL ?? "https://api.heartbyte.io";
 export const SITE_URL = "https://archbyte.heartbyte.io";
@@ -8,7 +9,9 @@ export const SITE_URL = "https://archbyte.heartbyte.io";
 export const DEFAULT_PORT = 3847;
 export const CLI_CALLBACK_PORT = 19274;
 // ─── Paths ───
-export const CONFIG_DIR = path.join(process.env.HOME ?? process.env.USERPROFILE ?? ".", ".archbyte");
+// resolveHome() throws if HOME/USERPROFILE is unset (e.g. in bare containers),
+// giving a clear error instead of silently writing to "./.archbyte".
+export const CONFIG_DIR = path.join(resolveHome(), ".archbyte");
 export const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 export const CREDENTIALS_PATH = path.join(CONFIG_DIR, "credentials.json");
 /** Project-local .archbyte directory name */

package/dist/cli/license-gate.d.ts

@@ -1,4 +1,4 @@
-type GatedAction = "scan" | "analyze" | "generate";
+type GatedAction = "analyze" | "generate";
 /**
  * Pre-flight license check. Must be called before scan/analyze/generate.
  *

package/dist/cli/license-gate.js

@@ -28,8 +28,9 @@ export async function requireLicense(action) {
         console.error(chalk.gray("Free tier includes unlimited scans. No credit card required."));
         process.exit(1);
     }
-    // Token expired locally
-    if (new Date(creds.expiresAt) < new Date()) {
+    // Token expired locally (treat invalid dates as expired — fail-closed)
+    const expiry = new Date(creds.expiresAt);
+    if (isNaN(expiry.getTime()) || expiry < new Date()) {
         console.error();
         console.error(chalk.red("Session expired."));
         console.error(chalk.gray("Run `archbyte login` to refresh your session."));

package/dist/cli/mcp.js

@@ -1,16 +1,9 @@
-import { execSync, spawnSync } from "child_process";
+import { spawnSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
 import chalk from "chalk";
-function isInPath(cmd) {
-    try {
-        execSync(`which ${cmd}`, { stdio: "ignore" });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
+import { isInPath } from "./utils.js";
+import { CONFIG_DIR } from "./constants.js";
 export async function handleMcpInstall() {
     console.log();
     console.log(chalk.bold.cyan("ArchByte MCP Setup"));
@@ -30,7 +23,7 @@ export async function handleMcpInstall() {
         console.log();
     }
     // ─── Codex CLI ───
-    const codexDir = path.join(process.env.HOME ?? process.env.USERPROFILE ?? ".", ".codex");
+    const codexDir = path.join(CONFIG_DIR, "../.codex");
     const codexConfig = path.join(codexDir, "config.toml");
     if (fs.existsSync(codexDir)) {
         console.log(chalk.white("Detected Codex CLI."));
@@ -46,7 +39,10 @@ export async function handleMcpInstall() {
             configured = true;
         }
         else {
-            const block = `
+            // Ensure a trailing newline before appending the TOML block
+            // so headers don't merge with the last line of the existing file.
+            const needsNewline = existing.length > 0 && !existing.endsWith("\n");
+            const block = `${needsNewline ? "\n" : ""}
 [mcp_servers.archbyte]
 type = "stdio"
 command = "npx"

package/dist/cli/setup.js

@@ -1,12 +1,12 @@
 import * as fs from "fs";
 import * as path from "path";
 import { fileURLToPath } from "url";
-import { execSync } from "child_process";
 import chalk from "chalk";
 import { resolveModel } from "../agents/runtime/types.js";
 import { createProvider } from "../agents/providers/router.js";
 import { select, spinner, confirm } from "./ui.js";
 import { CONFIG_DIR, CONFIG_PATH } from "./constants.js";
+import { isInPath, maskKey, isTTY, isValidEmail } from "./utils.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const PROVIDERS = [
@@ -49,13 +49,23 @@ function saveConfig(config) {
         fs.mkdirSync(CONFIG_DIR, { recursive: true });
     }
     fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+    // Restrict permissions — config contains API keys in profiles
+    try {
+        fs.chmodSync(CONFIG_PATH, 0o600);
+    }
+    catch {
+        // Windows doesn't support chmod
+    }
 }
-function maskKey(key) {
-    if (key.length <= 8)
-        return "****";
-    return key.slice(0, 6) + "..." + key.slice(-4);
-}
+/**
+ * Read a line from stdin with character masking (for API keys).
+ * Non-TTY fallback: reads from stdin as a line (for piped input / CI).
+ */
 function askHidden(prompt) {
+    if (!isTTY()) {
+        process.stdout.write(prompt);
+        return readLineFromStdin();
+    }
     return new Promise((resolve) => {
         process.stdout.write(prompt);
         const stdin = process.stdin;
@@ -93,7 +103,15 @@ function askHidden(prompt) {
         stdin.on("data", onData);
     });
 }
+/**
+ * Read a line of visible text from stdin.
+ * Non-TTY fallback: reads from stdin as a line (for piped input / CI).
+ */
 function askText(prompt) {
+    if (!isTTY()) {
+        process.stdout.write(prompt);
+        return readLineFromStdin();
+    }
     return new Promise((resolve) => {
         process.stdout.write(prompt);
         const stdin = process.stdin;
@@ -131,6 +149,32 @@ function askText(prompt) {
         stdin.on("data", onData);
     });
 }
+/**
+ * Non-TTY line reader. Reads a single line from stdin (for piped input).
+ */
+function readLineFromStdin() {
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        let buf = "";
+        const onData = (data) => {
+            buf += data;
+            const nl = buf.indexOf("\n");
+            if (nl !== -1) {
+                stdin.removeListener("data", onData);
+                stdin.pause();
+                resolve(buf.slice(0, nl).trim());
+            }
+        };
+        const onEnd = () => {
+            stdin.removeListener("data", onData);
+            resolve(buf.trim());
+        };
+        stdin.on("data", onData);
+        stdin.once("end", onEnd);
+    });
+}
 async function validateProviderSilent(providerName, apiKey, model) {
     try {
         const provider = createProvider({ provider: providerName, apiKey });
@@ -157,22 +201,13 @@ async function validateProviderSilent(providerName, apiKey, model) {
 function getProfiles(config) {
     return config.profiles ?? {};
 }
-function isInPath(cmd) {
-    try {
-        execSync(`which ${cmd}`, { stdio: "ignore" });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 export async function handleSetup() {
     console.log();
     console.log(chalk.bold.cyan("ArchByte Setup"));
     console.log(chalk.gray("Configure your model provider and API key.\n"));
     // Detect AI coding tools — suggest MCP instead of BYOK
     const hasClaude = isInPath("claude");
-    const codexDir = path.join(process.env.HOME ?? process.env.USERPROFILE ?? ".", ".codex");
+    const codexDir = path.join(CONFIG_DIR, "../.codex");
     const hasCodex = fs.existsSync(codexDir);
     if (hasClaude || hasCodex) {
         const tools = [hasClaude && "Claude Code", hasCodex && "Codex CLI"].filter(Boolean).join(" and ");
@@ -258,7 +293,7 @@ export async function handleSetup() {
     if (!profiles[provider])
         profiles[provider] = { apiKey: "" };
     profiles[provider].apiKey = apiKey;
-    // Step 2b: Email for this provider account (optional)
+    // Step 2b: Email for this provider account (optional, with validation)
     const existingEmail = profiles[provider].email;
     if (existingEmail) {
         console.log(chalk.gray(`\n  Account email: ${existingEmail}`));
@@ -270,16 +305,26 @@ export async function handleSetup() {
         if (emailIdx === 1) {
             const newEmail = await askText(chalk.bold("  Email: "));
             if (newEmail) {
-                profiles[provider].email = newEmail;
-                console.log(chalk.green(`  ✓ Email: ${newEmail}`));
+                if (!isValidEmail(newEmail)) {
+                    console.log(chalk.yellow(`  "${newEmail}" doesn't look like a valid email. Skipping.`));
+                }
+                else {
+                    profiles[provider].email = newEmail;
+                    console.log(chalk.green(`  ✓ Email: ${newEmail}`));
+                }
             }
         }
     }
     else {
         const email = await askText(chalk.bold(`  ${selected.label} account email ${chalk.gray("(optional, Enter to skip)")}: `));
         if (email) {
-            profiles[provider].email = email;
-            console.log(chalk.green(`  ✓ Email: ${email}`));
+            if (!isValidEmail(email)) {
+                console.log(chalk.yellow(`  "${email}" doesn't look like a valid email. Skipping.`));
+            }
+            else {
+                profiles[provider].email = email;
+                console.log(chalk.green(`  ✓ Email: ${email}`));
+            }
         }
     }
     // Step 3: Model selection
@@ -323,11 +368,14 @@ export async function handleSetup() {
     if (result === false) {
         let retries = 0;
         while (result === false && retries < 2) {
-            if (!await confirm("  Retry?"))
+            if (!await confirm("  Retry with a different key?"))
                 break;
             retries++;
             const newKey = await askHidden(chalk.bold("  API key: "));
-            if (newKey) {
+            if (!newKey) {
+                console.log(chalk.yellow("  No key entered. Retrying with existing key."));
+            }
+            else {
                 profiles[provider].apiKey = newKey;
                 console.log(chalk.green(`  ✓ API key: ${maskKey(newKey)}`));
             }
@@ -340,8 +388,71 @@ export async function handleSetup() {
                 s2.stop(result ? "valid" : "invalid", result ? "green" : "red");
             }
         }
+        // After retries exhausted — offer to switch providers
         if (result === false) {
-            console.log(chalk.yellow("  Warning: credentials unverified. Saving anyway."));
+            const others = PROVIDERS.filter((p) => p.name !== provider);
+            if (others.length > 0) {
+                console.log();
+                console.log(chalk.yellow("  Key didn't work. Try a different provider?"));
+                const switchIdx = await select("  Switch provider:", [
+                    ...others.map((p) => `${p.label} ${chalk.gray(p.hint)}`),
+                    chalk.gray("Skip — save as-is"),
+                ]);
+                if (switchIdx < others.length) {
+                    const alt = others[switchIdx];
+                    config.provider = alt.name;
+                    console.log(chalk.green(`\n  ✓ Provider: ${alt.label}`));
+                    const altKey = await askHidden(chalk.bold("  API key: "));
+                    if (!altKey) {
+                        console.log(chalk.yellow("  No key entered. Keeping original provider."));
+                        config.provider = provider;
+                    }
+                    else {
+                        if (!profiles[alt.name])
+                            profiles[alt.name] = { apiKey: "" };
+                        profiles[alt.name].apiKey = altKey;
+                        console.log(chalk.green(`  ✓ API key: ${maskKey(altKey)}`));
+                        // Model selection for the new provider
+                        const altModels = PROVIDER_MODELS[alt.name];
+                        if (altModels) {
+                            const mIdx = await select("\n  Choose a model:", altModels.map((m) => `${m.label} ${chalk.gray(m.hint)}`));
+                            const chosen = altModels[mIdx];
+                            if (chosen.id) {
+                                profiles[alt.name].model = chosen.id;
+                                console.log(chalk.green(`  ✓ Model: ${chosen.label}`));
+                            }
+                            else {
+                                const defaults = {
+                                    anthropic: "claude-opus-4-6",
+                                    openai: "gpt-5.2",
+                                    google: "gemini-2.5-pro",
+                                };
+                                const dm = defaults[alt.name] ?? resolveModel(alt.name, "standard");
+                                profiles[alt.name].model = dm;
+                                console.log(chalk.green(`  ✓ Model: ${dm} (default)`));
+                            }
+                        }
+                        const altValidationModel = profiles[alt.name].model ?? resolveModel(alt.name, "fast");
+                        const s3 = spinner(`Validating credentials with ${altValidationModel}`);
+                        result = await validateProviderSilent(alt.name, altKey, altValidationModel);
+                        if (result === "quota") {
+                            s3.stop("valid (quota exceeded — key accepted)", "yellow");
+                        }
+                        else {
+                            s3.stop(result ? "valid" : "invalid", result ? "green" : "red");
+                        }
+                        if (result === false) {
+                            console.log(chalk.yellow("  Warning: credentials unverified. Saving anyway."));
+                        }
+                    }
+                }
+                else {
+                    console.log(chalk.yellow("  Warning: credentials unverified. Saving anyway."));
+                }
+            }
+            else {
+                console.log(chalk.yellow("  Warning: credentials unverified. Saving anyway."));
+            }
         }
     }
     // Clean up legacy top-level keys
@@ -370,10 +481,16 @@ export async function handleSetup() {
             catch { /* ignore */ }
         }
         const templatePath = path.resolve(__dirname, "../../templates/archbyte.yaml");
-        let template = fs.readFileSync(templatePath, "utf-8");
-        template = template.replace("name: my-project", `name: ${projectName}`);
-        fs.writeFileSync(yamlPath, template, "utf-8");
-        yamlCreated = true;
+        if (!fs.existsSync(templatePath)) {
+            console.log(chalk.yellow("  Could not find archbyte.yaml template. Skipping."));
+            console.log(chalk.gray(`  Expected at: ${templatePath}`));
+        }
+        else {
+            let template = fs.readFileSync(templatePath, "utf-8");
+            template = template.replace("name: my-project", `name: ${projectName}`);
+            fs.writeFileSync(yamlPath, template, "utf-8");
+            yamlCreated = true;
+        }
     }
     // Generate README.md in .archbyte/
     writeArchbyteReadme(archbyteDir);
@@ -402,15 +519,19 @@ export async function handleSetup() {
     console.log();
     console.log(sep);
     console.log();
-    console.log("  " + chalk.bold("Next"));
+    console.log("  " + chalk.bold("Next steps"));
+    console.log();
     console.log("  " + chalk.cyan("archbyte run") + "            Analyze your codebase");
     if (hasClaude || hasCodex) {
         console.log("  " + chalk.cyan("archbyte mcp install") + "    Use from your AI tool");
     }
+    console.log("  " + chalk.cyan("archbyte status") + "         Check account and usage");
+    console.log("  " + chalk.cyan("archbyte --help") + "         See all commands");
     if (result === false) {
-        console.log(chalk.yellow("  Warning: credentials unverified. Saving anyway."));
         console.log();
+        console.log(chalk.yellow("  Warning: credentials unverified. Saving anyway."));
     }
+    console.log();
 }
 function writeArchbyteReadme(archbyteDir) {
     const readmePath = path.join(archbyteDir, "README.md");