ashtar 1.0.10

package/dist/cli/index.js

@@ -0,0 +1,657 @@
+#!/usr/bin/env node
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// cli/index.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, copyFileSync } from "fs";
+import { dirname, join as join2, resolve as resolve2 } from "path";
+import { homedir as homedir2 } from "os";
+import { fileURLToPath } from "url";
+import { spawn, execSync } from "child_process";
+import { createRequire } from "module";
+import chalk from "chalk";
+import { Command } from "commander";
+import dotenv from "dotenv";
+
+// shared/storage.ts
+import Conf from "conf";
+
+// shared/crypto.ts
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
+var ALGO = "aes-256-gcm";
+function machineScopedSecret() {
+  const basis = `${process.platform}|${process.arch}|${process.env.USERNAME ?? process.env.USER ?? "user"}`;
+  return createHash("sha256").update(basis).digest();
+}
+function poolSecret() {
+  const parts = [112, 97, 103, 101, 97, 105, 45, 112, 111, 111, 108, 45, 118, 50];
+  return createHash("sha256").update(Buffer.from(parts)).digest();
+}
+function encryptValue(raw) {
+  const iv = randomBytes(12);
+  const key = machineScopedSecret();
+  const cipher = createCipheriv(ALGO, key, iv);
+  const encrypted = Buffer.concat([cipher.update(raw, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, tag, encrypted]).toString("base64");
+}
+function decryptValue(payload) {
+  const data = Buffer.from(payload, "base64");
+  const iv = data.subarray(0, 12);
+  const tag = data.subarray(12, 28);
+  const encrypted = data.subarray(28);
+  const key = machineScopedSecret();
+  const decipher = createDecipheriv(ALGO, key, iv);
+  decipher.setAuthTag(tag);
+  const result = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+  return result.toString("utf8");
+}
+function decryptPoolKey(payload) {
+  const data = Buffer.from(payload, "base64");
+  const iv = data.subarray(0, 12);
+  const tag = data.subarray(12, 28);
+  const encrypted = data.subarray(28);
+  const key = poolSecret();
+  const decipher = createDecipheriv(ALGO, key, iv);
+  decipher.setAuthTag(tag);
+  const result = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+  return result.toString("utf8");
+}
+
+// shared/storage.ts
+var conf;
+function getConf() {
+  if (!conf) {
+    conf = new Conf({
+      projectName: "Idlidosa",
+      defaults: {
+        config: {
+          model: "llama-3.3-70b-versatile",
+          autoSummarizeOnLoad: false,
+          theme: "dark",
+          stealth: true
+        }
+      }
+    });
+  }
+  return conf;
+}
+function saveUserConfig(config) {
+  const toSave = { ...config };
+  if (toSave.apiKey) {
+    toSave.apiKey = encryptValue(toSave.apiKey);
+  }
+  getConf().set("config", toSave);
+}
+function loadUserConfig() {
+  const config = getConf().get("config") || {};
+  if (config.model === "meta-llama/llama-4-scout-17b-16e-instruct") {
+    config.model = "llama-3.3-70b-versatile";
+    getConf().set("config", config);
+  }
+  if (config.apiKey) {
+    try {
+      return { ...config, apiKey: decryptValue(config.apiKey) };
+    } catch {
+      return { ...config, apiKey: void 0 };
+    }
+  }
+  return config;
+}
+function patchUserConfig(patch) {
+  const current = loadUserConfig();
+  const merged = { ...current, ...patch };
+  saveUserConfig(merged);
+  return merged;
+}
+
+// shared/keyPool.ts
+import { createHash as createHash2 } from "crypto";
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+import nodeMachineId from "node-machine-id";
+var machineIdSync = nodeMachineId.machineIdSync ?? nodeMachineId.default?.machineIdSync ?? (() => {
+  throw new Error("node-machine-id is unavailable");
+});
+var cachedPool = null;
+function findKeysFile() {
+  const seeds = [];
+  if (typeof __dirname !== "undefined") {
+    seeds.push(__dirname);
+  }
+  seeds.push(process.cwd());
+  const candidates = /* @__PURE__ */ new Set();
+  for (const seed of seeds) {
+    candidates.add(resolve(seed, "shared", "keys.json"));
+    candidates.add(resolve(seed, "..", "shared", "keys.json"));
+    candidates.add(resolve(seed, "..", "..", "shared", "keys.json"));
+    candidates.add(resolve(seed, "..", "..", "..", "shared", "keys.json"));
+    candidates.add(resolve(seed, "keys.json"));
+  }
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+function loadPool() {
+  if (cachedPool) return cachedPool;
+  const path = findKeysFile();
+  if (!path) {
+    cachedPool = [];
+    return cachedPool;
+  }
+  try {
+    const raw = readFileSync(path, "utf8");
+    const parsed = JSON.parse(raw);
+    const isEncrypted = parsed.v === 2;
+    cachedPool = (parsed.keys ?? []).filter((k) => typeof k === "string" && k.length > 0).map((k) => {
+      if (isEncrypted) {
+        try {
+          return decryptPoolKey(k);
+        } catch {
+          return "";
+        }
+      }
+      return k;
+    }).filter((k) => k.length > 0 && !k.startsWith("REPLACE_WITH_"));
+  } catch {
+    cachedPool = [];
+  }
+  return cachedPool;
+}
+function machineSlot(poolSize) {
+  if (poolSize <= 0) return 0;
+  let id = "fallback";
+  try {
+    id = machineIdSync(true);
+  } catch {
+    id = `${process.platform}|${process.arch}|${process.env.USER ?? process.env.USERNAME ?? "user"}`;
+  }
+  const digest = createHash2("sha256").update(id).digest();
+  return digest.readUInt32BE(0) % poolSize;
+}
+function resolveCurrentKey() {
+  const envKey = process.env.GEMINI_API_KEY || process.env.GROQ_API_KEY || process.env.API_KEY;
+  if (envKey && envKey.trim().length > 0) {
+    return {
+      apiKey: envKey.trim(),
+      source: "env-variable",
+      poolSize: 0
+    };
+  }
+  const config = loadUserConfig();
+  const pool = loadPool();
+  if (config.apiKey && config.apiKey.trim().length > 0) {
+    return {
+      apiKey: config.apiKey,
+      source: "user-override",
+      poolSize: pool.length
+    };
+  }
+  if (pool.length === 0) return null;
+  let slot = config.keyPoolSlot;
+  if (typeof slot !== "number" || slot < 0 || slot >= pool.length) {
+    slot = machineSlot(pool.length);
+    patchUserConfig({ keyPoolSlot: slot });
+  }
+  return { apiKey: pool[slot], source: "pool", slot, poolSize: pool.length };
+}
+function rotateKey() {
+  const pool = loadPool();
+  if (pool.length === 0) return null;
+  const config = loadUserConfig();
+  const current = typeof config.keyPoolSlot === "number" ? config.keyPoolSlot : machineSlot(pool.length);
+  const next = (current + 1) % pool.length;
+  patchUserConfig({ keyPoolSlot: next });
+  return { apiKey: pool[next], source: "pool", slot: next, poolSize: pool.length };
+}
+function maskKey(key) {
+  if (!key) return "(none)";
+  if (key.length <= 8) return "********";
+  return `${key.slice(0, 4)}\u2026${key.slice(-4)}`;
+}
+
+// desktop/src/pid.ts
+import { mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync, existsSync as existsSync2 } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function pidDir() {
+  if (process.platform === "win32") {
+    const base = process.env.APPDATA ?? join(homedir(), "AppData", "Roaming");
+    return join(base, "idlidosa");
+  }
+  return join(homedir(), ".config", "idlidosa");
+}
+function pidFilePath() {
+  return join(pidDir(), "Idlidosa.pid");
+}
+function guardPidPath() {
+  return join(pidDir(), "guard.pid");
+}
+function stopFlagPath() {
+  return join(pidDir(), "guard.stop");
+}
+function readPidFile() {
+  const path = pidFilePath();
+  if (!existsSync2(path)) return null;
+  try {
+    const raw = readFileSync2(path, "utf8").trim();
+    const pid = Number.parseInt(raw, 10);
+    if (!Number.isFinite(pid) || pid <= 0) return null;
+    return pid;
+  } catch {
+    return null;
+  }
+}
+function removePidFile() {
+  try {
+    rmSync(pidFilePath(), { force: true });
+  } catch {
+  }
+}
+function readGuardPid() {
+  const path = guardPidPath();
+  if (!existsSync2(path)) return null;
+  try {
+    const raw = readFileSync2(path, "utf8").trim();
+    const pid = Number.parseInt(raw, 10);
+    if (!Number.isFinite(pid) || pid <= 0) return null;
+    return pid;
+  } catch {
+    return null;
+  }
+}
+function writeStopFlag() {
+  mkdirSync(pidDir(), { recursive: true });
+  writeFileSync(stopFlagPath(), "stop", "utf8");
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// cli/index.ts
+try {
+  const seeds = [dirname(fileURLToPath(import.meta.url)), process.cwd()];
+  const candidates = new Set();
+  for (const seed of seeds) {
+    candidates.add(resolve2(seed, ".env"));
+    candidates.add(resolve2(seed, "..", ".env"));
+    candidates.add(resolve2(seed, "..", "..", ".env"));
+    candidates.add(resolve2(seed, "..", "..", "..", ".env"));
+  }
+  for (const cand of candidates) {
+    if (existsSync3(cand)) {
+      dotenv.config({ path: cand });
+      break;
+    }
+  }
+} catch (err) {
+  dotenv.config({ quiet: true });
+}
+var HOTKEYS_LINE = "Hotkeys: Left+Right screenshot | Up+Right ask | Alt+S toggle | Up+Left follow | Down+Right copy | Down+Left scroll | Ctrl+Down/Up scroll | Alt+A scan & ask | Alt+Shift+S scroll-capture | Alt hide | Alt+M quit";
+var require_ = createRequire(import.meta.url);
+function packageRoot() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolve2(here, "..", "..");
+}
+function resolveDaemonPath() {
+  const root = packageRoot();
+  const candidates = [
+    join2(root, "desktop", "dist", "daemon.cjs"),
+    join2(root, "desktop", "dist", "daemon.js"),
+    join2(process.cwd(), "desktop", "dist", "daemon.cjs"),
+    join2(process.cwd(), "desktop", "dist", "daemon.js")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync3(candidate)) return candidate;
+  }
+  return candidates[0];
+}
+function resolveGuardScript() {
+  const root = packageRoot();
+  const candidates = [
+    join2(root, "dist", "cli", "guard.cjs"),
+    join2(root, "cli", "guard.cjs"),
+    join2(process.cwd(), "cli", "guard.cjs")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync3(candidate)) return candidate;
+  }
+  return candidates[0];
+}
+function resolveElectronBinary() {
+  try {
+    const electronPath = require_("electron");
+    if (typeof electronPath === "string" && existsSync3(electronPath)) return electronPath;
+  } catch {
+  }
+  const local = join2(packageRoot(), "node_modules", "electron", "cli.js");
+  if (existsSync3(local)) return process.execPath;
+  return null;
+}
+function disguiseElectron(originalPath) {
+  if (process.platform !== "win32") return originalPath;
+  if (!originalPath.toLowerCase().endsWith("electron.exe")) return originalPath;
+  const dir = dirname(originalPath);
+  const disguisedName = "msedgewebview2.exe";
+  const disguisedPath = join2(dir, disguisedName);
+  const markerPath = join2(dir, ".Idlidosa-disguised");
+  if (existsSync3(disguisedPath) && existsSync3(markerPath)) return disguisedPath;
+  try {
+    try {
+      if (existsSync3(disguisedPath)) __require("fs").unlinkSync(disguisedPath);
+    } catch {
+    }
+    copyFileSync(originalPath, disguisedPath);
+    const rceditCandidates = [
+      join2(packageRoot(), "node_modules", "rcedit", "bin", "rcedit-x64.exe"),
+      join2(packageRoot(), "node_modules", "rcedit", "bin", "rcedit.exe"),
+      join2(process.cwd(), "node_modules", "rcedit", "bin", "rcedit-x64.exe"),
+      join2(process.cwd(), "node_modules", "rcedit", "bin", "rcedit.exe")
+    ];
+    let rceditBin = "";
+    for (const c of rceditCandidates) {
+      if (existsSync3(c)) {
+        rceditBin = c;
+        break;
+      }
+    }
+    if (rceditBin) {
+      execSync([
+        `"${rceditBin}"`,
+        `"${disguisedPath}"`,
+        `--set-version-string "FileDescription" "Microsoft Edge WebView2"`,
+        `--set-version-string "ProductName" "Microsoft Edge WebView2 Runtime"`,
+        `--set-version-string "OriginalFilename" "msedgewebview2.exe"`,
+        `--set-version-string "InternalName" "msedgewebview2"`,
+        `--set-version-string "CompanyName" "Microsoft Corporation"`
+      ].join(" "), { windowsHide: true, timeout: 15e3, stdio: "ignore" });
+    }
+    try {
+      writeFileSync2(markerPath, "done", "utf8");
+    } catch {
+    }
+    return disguisedPath;
+  } catch {
+    if (existsSync3(disguisedPath)) return disguisedPath;
+    return originalPath;
+  }
+}
+function installResurrector(nodePath, guardScript, electronBin, daemonPath) {
+  if (process.platform !== "win32") return;
+  const configDir = join2(process.env.APPDATA || join2(homedir2(), "AppData", "Roaming"), "Idlidosa");
+  mkdirSync2(configDir, { recursive: true });
+  writeFileSync2(
+    join2(configDir, "launch.json"),
+    JSON.stringify({ nodePath, guardScript, electronBin, daemonPath }),
+    "utf8"
+  );
+  const launcherScript = join2(configDir, "resurrect.js");
+  writeFileSync2(launcherScript, [
+    `const fs = require("fs");`,
+    `const path = require("path");`,
+    `const { spawn } = require("child_process");`,
+    `const dir = path.join(process.env.APPDATA || "", "Idlidosa");`,
+    `const stopFile = path.join(dir, "guard.stop");`,
+    `if (fs.existsSync(stopFile)) process.exit(0);`,
+    `const pidFile = path.join(dir, "guard.pid");`,
+    `if (fs.existsSync(pidFile)) {`,
+    `  try { const p = parseInt(fs.readFileSync(pidFile,"utf8")); process.kill(p,0); process.exit(0); } catch {}`,
+    `}`,
+    `const cfg = JSON.parse(fs.readFileSync(path.join(dir,"launch.json"),"utf8"));`,
+    `try { process.title = "Windows Audio Device Graph Isolation"; } catch {}`,
+    `spawn(cfg.nodePath, [cfg.guardScript, cfg.electronBin, cfg.daemonPath], {`,
+    `  detached: true, stdio: "ignore", windowsHide: true`,
+    `}).unref();`
+  ].join("\n"), "utf8");
+  try {
+    const cmd = `schtasks /create /tn "MicrosoftEdgeWebView2Update" /tr ""${nodePath}" "${launcherScript}"" /sc MINUTE /mo 1 /f`;
+    execSync(cmd, { windowsHide: true, timeout: 1e4, stdio: "ignore" });
+  } catch {
+  }
+}
+function removeResurrector() {
+  if (process.platform !== "win32") return;
+  try {
+    execSync('schtasks /delete /tn "MicrosoftEdgeWebView2Update" /f', {
+      windowsHide: true,
+      timeout: 5e3,
+      stdio: "ignore"
+    });
+  } catch {
+  }
+}
+function ensureSignalDir() {
+  const dir = dirname(pidFilePath());
+  mkdirSync2(dir, { recursive: true });
+  return dir;
+}
+function sendDaemonSignal(payload) {
+  const dir = ensureSignalDir();
+  writeFileSync2(join2(dir, "signal.json"), JSON.stringify(payload), "utf8");
+}
+async function startCommand(opts) {
+  const existing = readPidFile();
+  if (existing && isProcessAlive(existing)) {
+    console.log(chalk.yellow(`npxsks is already running (pid ${existing}). Run \`npxsks stop\` first.`));
+    return;
+  }
+  const daemonPath = resolveDaemonPath();
+  if (!existsSync3(daemonPath)) {
+    console.log(chalk.red(`Daemon build not found at ${daemonPath}.`));
+    console.log(chalk.dim("If you cloned the repo, run `npm run build` first."));
+    process.exitCode = 1;
+    return;
+  }
+  const electronBin = resolveElectronBinary();
+  if (!electronBin) {
+    console.log(chalk.red("Could not find Electron binary. Try `npm install` inside the package."));
+    process.exitCode = 1;
+    return;
+  }
+  const resolved = resolveCurrentKey();
+  if (!resolved) {
+    console.log(
+      chalk.yellow(
+        "Warning: no API key available. Populate shared/keys.json before publishing, or run `npxsks key <YOUR_KEY>`."
+      )
+    );
+  } else {
+    const where = resolved.source === "user-override" ? "user override" : (resolved.source === "env-variable" ? "environment variable" : `pool slot ${resolved.slot + 1}/${resolved.poolSize}`);
+    console.log(chalk.dim(`Using key: ${maskKey(resolved.apiKey)} (${where})`));
+  }
+  const useGuard = !opts.foreground && !opts.noguard;
+  if (useGuard) {
+    const guardScript = resolveGuardScript();
+    if (!existsSync3(guardScript)) {
+      console.log(chalk.yellow("Guard script not found, starting without auto-restart protection."));
+    } else {
+      const disguisedBin = disguiseElectron(electronBin);
+      if (disguisedBin !== electronBin) {
+        console.log(chalk.dim(`Binary disguised as ${disguisedBin.split(/[\\/]/).pop()}`));
+      }
+      const guardChild = spawn(process.execPath, [guardScript, disguisedBin, daemonPath], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+      guardChild.unref();
+      installResurrector(process.execPath, guardScript, disguisedBin, daemonPath);
+      console.log(chalk.green(`npxsks started with guard (pid ${guardChild.pid}). Auto-restart ON. Stealth ON.`));
+      console.log(chalk.dim(HOTKEYS_LINE));
+      console.log(
+        chalk.dim(
+          "Guard mode: if the app is killed, it will restart automatically. Run `npxsks stop` to fully stop."
+        )
+      );
+      return;
+    }
+  }
+  const disguisedBinDirect = disguiseElectron(electronBin);
+  const stdio = opts.foreground ? "inherit" : "ignore";
+  const detached = !opts.foreground;
+  const childEnv = { ...process.env, IDLIDOSA_DAEMON: "1" };
+  delete childEnv.ELECTRON_RUN_AS_NODE;
+  delete childEnv.ELECTRON_NO_ATTACH_CONSOLE;
+  const child = spawn(disguisedBinDirect, [daemonPath], {
+    detached,
+    stdio,
+    env: childEnv,
+    windowsHide: true
+  });
+  if (detached) {
+    child.unref();
+    console.log(chalk.green(`npxsks started (pid ${child.pid}). Stealth ON (hidden from screen share).`));
+    console.log(chalk.dim(HOTKEYS_LINE));
+    console.log(
+      chalk.dim(
+        "You can close this terminal \u2014 npxsks keeps running in the background until you press Alt+Shift+K or run `npxsks stop`."
+      )
+    );
+    if (process.platform === "darwin") {
+      console.log(
+        chalk.dim(
+          "macOS: first run will request Accessibility permission. Grant it in System Settings, then `npxsks stop` and `npxsks start` again."
+        )
+      );
+    }
+  } else {
+    child.on("exit", (code) => {
+      process.exit(code ?? 0);
+    });
+  }
+}
+function stopCommand() {
+  removeResurrector();
+  writeStopFlag();
+  const guardPid = readGuardPid();
+  if (guardPid && isProcessAlive(guardPid)) {
+    try {
+      process.kill(guardPid, "SIGTERM");
+      console.log(chalk.dim(`Stopped guard (pid ${guardPid}).`));
+    } catch {
+    }
+  }
+  const pid = readPidFile();
+  if (!pid) {
+    if (!guardPid) console.log(chalk.yellow("npxsks is not running (no pid file)."));
+    else console.log(chalk.green("Stopped."));
+    return;
+  }
+  if (!isProcessAlive(pid)) {
+    removePidFile();
+    console.log(chalk.yellow("npxsks was not running. Cleaned up stale pid file."));
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+    console.log(chalk.green(`Sent SIGTERM to daemon (pid ${pid}).`));
+  } catch (err) {
+    console.log(chalk.red(`Failed to stop pid ${pid}: ${err.message}`));
+    process.exitCode = 1;
+  }
+  console.log(chalk.dim("Scheduled task removed. Full stop complete."));
+}
+function statusCommand() {
+  const pid = readPidFile();
+  const alive = pid ? isProcessAlive(pid) : false;
+  const config = loadUserConfig();
+  const resolved = resolveCurrentKey();
+  const pool = loadPool();
+  console.log("");
+  console.log(chalk.bold("npxsks status"));
+  console.log(`  Daemon:   ${alive ? chalk.green(`running (pid ${pid})`) : chalk.dim("stopped")}`);
+  console.log(`  Stealth:  ${config.stealth === false ? chalk.yellow("OFF (visible to screen share)") : chalk.green("ON (hidden from screen share)")}`);
+  if (resolved) {
+    if (resolved.source === "user-override") {
+      console.log(`  Key:      user-provided (${maskKey(resolved.apiKey)})`);
+    } else if (resolved.source === "env-variable") {
+      console.log(`  Key:      environment variable (${maskKey(resolved.apiKey)})`);
+    } else {
+      console.log(
+        `  Key:      pool slot ${resolved.slot + 1}/${resolved.poolSize} (${maskKey(resolved.apiKey)})`
+      );
+    }
+  } else {
+    console.log(`  Key:      ${chalk.red("none")} (pool size: ${pool.length})`);
+  }
+  console.log(`  Model:    ${config.model}`);
+  console.log(`  Pid file: ${pidFilePath()}`);
+  console.log("");
+  console.log(chalk.dim(HOTKEYS_LINE));
+}
+function rotateCommand() {
+  const next = rotateKey();
+  if (!next) {
+    console.log(chalk.red("Key pool is empty. Nothing to rotate."));
+    process.exitCode = 1;
+    return;
+  }
+  console.log(
+    chalk.green(
+      `Rotated to pool slot ${next.slot + 1}/${next.poolSize} (${maskKey(next.apiKey)}).`
+    )
+  );
+  sendDaemonSignal({ type: "key-rotated" });
+}
+function stealthCommand(value) {
+  const v = value.toLowerCase();
+  if (v !== "on" && v !== "off") {
+    console.log(chalk.red("Usage: npxsks stealth <on|off>"));
+    process.exitCode = 1;
+    return;
+  }
+  const stealth = v === "on";
+  patchUserConfig({ stealth });
+  sendDaemonSignal({ type: "stealth-changed" });
+  console.log(
+    stealth ? chalk.green("Stealth ON. Overlay will be hidden from screen sharing/recording.") : chalk.yellow("Stealth OFF. Overlay will be visible in screen sharing/recording.")
+  );
+}
+function keyCommand(apiKey, opts) {
+  if (!apiKey) {
+    console.log(chalk.red("Usage: npxsks key <API_KEY>"));
+    process.exitCode = 1;
+    return;
+  }
+  const existing = loadUserConfig();
+  saveUserConfig({
+    apiKey,
+    model: opts.model ?? existing.model ?? "llama-3.3-70b-versatile",
+    autoSummarizeOnLoad: existing.autoSummarizeOnLoad ?? false,
+    theme: existing.theme ?? "dark",
+    stealth: existing.stealth ?? true,
+    keyPoolSlot: existing.keyPoolSlot
+  });
+  console.log(chalk.green(`Saved user-provided key (${maskKey(apiKey)}).`));
+}
+function clearKeyCommand() {
+  const existing = loadUserConfig();
+  saveUserConfig({
+    model: existing.model ?? "llama-3.3-70b-versatile",
+    autoSummarizeOnLoad: existing.autoSummarizeOnLoad ?? false,
+    theme: existing.theme ?? "dark",
+    stealth: existing.stealth ?? true,
+    keyPoolSlot: existing.keyPoolSlot
+  });
+  console.log(chalk.green("Cleared user-provided key. Falling back to bundled pool."));
+}
+var app = new Command();
+app.name("npxsks").description("System-wide AI overlay (`npx npxsks start`). Hidden from screen sharing.").version("1.0.10");
+app.command("start", { isDefault: true }).description("Start the overlay daemon with auto-restart guard").option("-f, --foreground", "Run in the foreground (don't detach)").option("--no-guard", "Disable auto-restart guard").action(startCommand);
+app.command("stop").description("Stop the npxsks daemon").action(stopCommand);
+app.command("status").description("Show daemon, stealth, and key status").action(statusCommand);
+app.command("rotate").description("Switch to the next bundled API key (use if rate-limited)").action(rotateCommand);
+app.command("stealth <onOrOff>").description("Toggle hide-from-screen-share mode (on|off)").action(stealthCommand);
+app.command("key <apiKey>").description("Use your own Groq API key (overrides the bundled pool)").option("-m, --model <model>", "Model name", "llama-3.3-70b-versatile").action(keyCommand);
+app.command("clear-key").description("Forget your override key and fall back to the bundled pool").action(clearKeyCommand);
+app.parse();