berget 2.0.6 → 2.1.1

package/AGENTS.md

@@ -56,6 +56,10 @@ Functional, modular Koa + TypeScript services with schema-first approach and cod
 
 #### devops
 
+# ⚠️ ABSOLUTE RULE: kubectl apply NEVER
+
+**THIS RULE HAS NO EXCEPTIONS - APPLIES TO ALL ENVIRONMENTS: DEV, STAGING, PRODUCTION**
+
 Declarative GitOps infrastructure with FluxCD, Kustomize, Helm, and operators.
 
 **Use when:**
@@ -70,6 +74,159 @@ Declarative GitOps infrastructure with FluxCD, Kustomize, Helm, and operators.
 - Operator-first approach
 - SemVer with release candidates
 
+## 🚨 CRITICAL: WHY kubectl apply DESTROYS GITOPS
+
+**kubectl apply is fundamentally incompatible with GitOps because it:**
+
+1. **Overwrites FluxCD metadata** - The `kubectl.kubernetes.io/last-applied-configuration` annotation gets replaced with kubectl's version, breaking FluxCD's tracking
+2. **Breaks the single source of truth** - Your cluster state diverges from Git state, making Git no longer authoritative
+3. **Creates synchronization conflicts** - FluxCD cannot reconcile differences between Git and cluster state
+4. **Makes debugging impossible** - Manual changes are invisible in Git history
+5. **Undermines the entire GitOps model** - The promise of "Git as source of truth" is broken
+
+## 📋 EXACTLY WHAT GETS DESTROYED
+
+When you run `kubectl apply`, these critical metadata fields are corrupted:
+
+```yaml
+# BEFORE: FluxCD-managed resource
+metadata:
+  annotations:
+    kubectl.kubernetes.io/last-applied-configuration: |
+      {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"name":"app","namespace":"default"},"spec":{"template":{"spec":{"containers":[{"image":"nginx:1.21","name":"nginx"}]}}}}
+    kustomize.toolkit.fluxcd.io/checksum: a1b2c3d4e5f6
+    kustomize.toolkit.fluxcd.io/ssa: Merge
+
+# AFTER: kubectl apply destroys this
+metadata:
+  annotations:
+    kubectl.kubernetes.io/last-applied-configuration: |
+      {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"name":"app","namespace":"default"},"spec":{"template":{"spec":{"containers":[{"image":"nginx:1.22","name":"nginx"}]}}}}
+    # kustomize.toolkit.fluxcd.io/checksum: GONE!
+    # kustomize.toolkit.fluxcd.io/ssa: GONE!
+```
+
+## 🔥 CONSEQUENCES OF USING kubectl apply
+
+**Immediate Impact:**
+- FluxCD loses track of the resource
+- Future Git commits may not apply correctly
+- Resource becomes "orphaned" from GitOps control
+
+**Long-term Damage:**
+- Cluster drift becomes undetectable
+- Rollback capabilities are compromised
+- Audit trail is broken
+- Team loses trust in GitOps process
+
+**Recovery Required:**
+- Manual intervention to restore FluxCD metadata
+- Potential resource recreation
+- Downtime during recovery
+- Complete audit of affected resources
+
+## 🚨 KRITISKA REGLER FÖR FLUXCD-kluster
+
+# ⚠️ ABSOLUT ALDRIG: kubectl apply
+
+**DENNA REGLER HAR INGA UNDTAG - GÄLLER ALLTID: DEV, STAGING, PRODUCTION**
+
+**ABSOLUT ALDRIG använd `kubectl apply` i FluxCD-hanterade kluster!**
+
+### ❌ FORBUDNA OPERATIONER
+
+```bash
+# ❌ ALDRIG GÖR DETTA!
+kubectl apply -f deployment.yaml
+kubectl apply -f kustomization.yaml
+kubectl apply -f flux-system/  # SPECIELT INTE FLUXCD-MANIFEST!
+kubectl create -f ...
+kubectl replace -f ...
+kubectl edit deployment/...
+kubectl patch deployment/...
+```
+
+### ✅ TILLÅTNA OPERATIONER (Read-Only)
+
+```bash
+# ✅ SÄKERT FÖR DIAGNOSTIK
+kubectl get pods
+kubectl describe deployment/app
+kubectl logs -f pod/name
+kubectl get events
+kubectl top nodes
+```
+
+### 🔄 RÄTT SÄTT ATT GÖRA ÄNDRINGAR
+
+1. **Git är sanningens källa** - alla ändringar måste gå via Git repository
+2. **FluxCD synkroniserar automatiskt** - ändra YAML-filer, inte klustret direkt
+3. **Använd PR workflow** - commit ändringar, skapa PR, låt FluxCD hantera deployment
+
+### 🚨 VAD HÄNDER OM DU ÄNDÅ ANVÄNDER kubectl apply?
+
+**DET HÄNDER OM DU ANVÄNDER kubectl apply:**
+
+- **Förstör FluxCD-metadata** - `kubectl.kubernetes.io/last-applied-configuration` skrivs över
+- **Breakar GitOps-modellen** - klustret divergerar från Git-repository
+- **FluxCD kan inte synkronisera** - konflikter mellan Git-state och kluster-state
+- **Svår att diagnostisera** - manuella ändringar är osynliga i Git-historiken
+
+**RESULTATET: FluxCD FÖRLORAR KONTROLLEN OCH KLUSTRET BLIR O-SYNKRONISERAT FRÅN GIT!**
+
+### 🆘 NÖDSITUATIONER
+
+```bash
+# Pausa FluxCD temporärt
+flux suspend kustomization app-name
+
+# Gör nödvändiga ändringar i Git
+git commit -m "emergency fix"
+git push
+
+# Återuppta FluxCD
+flux resume kustomization app-name
+```
+
+### 💡 MINNESREGEL
+
+> **"Git first, kubectl never"**
+> 
+> Om du måste använda `kubectl apply` - gör det inte. Gör en ändring i Git istället.
+
+### 📋 CHECKLIST FÖR ÄNDRINGAR
+
+- [ ] Ändring gjord i Git repository?
+- [ ] PR skapad och granskad?
+- [ ] FluxCD synkroniserar korrekt?
+- [ ] Ingen `kubectl apply` använd?
+- [ ] Kluster-state matchar Git-state?
+
+**VIKTIGT:** Dessa regler gäller ALLTID, även i utvecklingsmiljöer och tester!
+
+### 💡 MINNESREGEL
+
+> **"Git first, kubectl never"**
+> 
+> Om du måste använda `kubectl apply` - gör det inte. Gör en ändring i Git istället.
+
+### 📋 CHECKLIST FÖR ÄNDRINGAR
+
+- [ ] Ändring gjord i Git repository?
+- [ ] PR skapad och granskad?
+- [ ] FluxCD synkroniserar korrekt?
+- [ ] Ingen `kubectl apply` använd?
+- [ ] Kluster-state matchar Git-state?
+
+**VIKTIGT:** Dessa regler gäller ALLTID, även i utvecklingsmiljöer och tester!
+
+---
+
+## ⚠️ ABSOLUT SLUTREGEL: INGA UNDTAG
+
+**kubectl apply är FÖRBJUDET i ALLA FluxCD-kluster, ALLTID, utan undantag.**
+**Detta inkluderar: dev, staging, production, testmiljöer, lokala kluster, ALLT.**
+
 **Helm Values Configuration Process:**
 
 1. **Documentation First Approach:**
@@ -206,8 +363,12 @@ BERGET_API_KEY=your_api_key_here
 
 All agents follow these principles:
 
-- Never work directly in main branch
+- **NEVER work directly in main branch** - ALWAYS use pull requests
+- **NEVER use 'git add .'** - ALWAYS add specific files with 'git add path/to/file'
+- **ALWAYS clean up test files, documentation files, and temporary artifacts before committing**
+- **ALWAYS ensure git history maintains production quality** - no test commits, no debugging code
+- **ALWAYS create descriptive commit messages following project conventions**
+- **ALWAYS run tests and build before creating PR**
 - Follow branch strategy and commit conventions
 - Create PRs for new functionality
-- Run tests before committing
 - Address reviewer feedback promptly

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "berget",
-    "version": "2.0.6",
+    "version": "2.1.1",
     "main": "dist/index.js",
     "bin": {
         "berget": "dist/index.js"

package/dist/src/commands/chat.js

@@ -57,8 +57,7 @@ function registerChatCommands(program) {
         .command(command_structure_1.SUBCOMMANDS.CHAT.RUN)
         .description('Run a chat session with a specified model')
         .argument('[message]', 'Message to send directly (skips interactive mode)')
-        .option('-m, --model <model>', 'Model to use (default: deepseek-r1)')
-        .option('--no-reasoning', 'Disable reasoning mode (adds </think> to messages)')
+        .option('-m, --model <model>', 'Model to use (default: glm-4.7)')
         .option('-t, --temperature <temp>', 'Temperature (0-1)', parseFloat)
         .option('--max-tokens <tokens>', 'Maximum tokens to generate', parseInt)
         .option('-k, --api-key <key>', 'API key to use for this chat session')

package/dist/src/commands/code.js

@@ -68,7 +68,18 @@ function mergeConfigurations(currentConfig, latestConfig) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const client = (0, client_1.createAuthenticatedClient)();
-            const modelConfig = (0, config_loader_1.getModelConfig)();
+            // Get model config with fallback for init scenario
+            let modelConfig;
+            try {
+                modelConfig = (0, config_loader_1.getModelConfig)();
+            }
+            catch (error) {
+                // Fallback to defaults when no config exists (init scenario)
+                modelConfig = {
+                    primary: 'berget/glm-4.7',
+                    small: 'berget/gpt-oss',
+                };
+            }
             console.log(chalk_1.default.blue('🤖 Using AI to merge configurations...'));
             const mergePrompt = `You are a configuration merge specialist. Merge these two OpenCode configurations:
 
@@ -267,20 +278,78 @@ function getProjectName() {
     return path_1.default.basename(process.cwd());
 }
 /**
- * Load the latest agent configuration from opencode.json
+ * Load the latest agent configuration from embedded config
  */
 function loadLatestAgentConfig() {
     return __awaiter(this, void 0, void 0, function* () {
-        try {
-            const configPath = path_1.default.join(__dirname, '../../opencode.json');
-            const configContent = yield (0, promises_1.readFile)(configPath, 'utf8');
-            const config = JSON.parse(configContent);
-            return config.agent || {};
-        }
-        catch (error) {
-            console.warn(chalk_1.default.yellow('⚠️  Could not load latest agent config, using fallback'));
-            return {};
-        }
+        // Return the latest agent configuration directly - no file reading needed
+        return {
+            fullstack: {
+                model: 'berget/glm-4.7',
+                temperature: 0.3,
+                top_p: 0.9,
+                mode: 'primary',
+                permission: { edit: 'allow', bash: 'allow', webfetch: 'allow' },
+                description: 'Router/coordinator agent for full-stack development with schema-driven architecture',
+                prompt: "Voice: Scandinavian calm—precise, concise, confident; no fluff. You are Berget Code Fullstack agent. Act as a router and coordinator in a monorepo. Bottom-up schema: database → OpenAPI → generated types. Top-down types: API → UI → components. Use openapi-fetch and Zod at every boundary; compile-time errors are desired when contracts change. Routing rules: if task/paths match /apps/frontend or React (.tsx) → use frontend; if /apps/app or Expo/React Native → app; if /infra, /k8s, flux-system, kustomization.yaml, Helm values → devops; if /services, Koa routers, services/adapters/domain → backend. If ambiguous, remain fullstack and outline the end-to-end plan, then delegate subtasks to the right persona. Security: validate inputs; secrets via FluxCD SOPS/Sealed Secrets. Documentation is generated from code—never duplicated.\n\nGIT WORKFLOW RULES (CRITICAL):\n- NEVER push directly to main branch - ALWAYS use pull requests\n- NEVER use 'git add .' - ALWAYS add specific files with 'git add path/to/file'\n- ALWAYS clean up test files, documentation files, and temporary artifacts before committing\n- ALWAYS ensure git history maintains production quality - no test commits, no debugging code\n- ALWAYS create descriptive commit messages following project conventions\n- ALWAYS run tests and build before creating PR\n\nCRITICAL: When all implementation tasks are complete and ready for merge, ALWAYS invoke @quality subagent to handle testing, building, and complete PR management including URL provision.",
+            },
+            frontend: {
+                model: 'berget/glm-4.7',
+                temperature: 0.4,
+                top_p: 0.9,
+                mode: 'primary',
+                permission: { edit: 'allow', bash: 'deny', webfetch: 'allow' },
+                note: 'Bash access is denied for frontend persona to prevent shell command execution in UI environments. This restriction enforces security and architectural boundaries.',
+                description: 'Builds Scandinavian, type-safe UIs with React, Tailwind, Shadcn.',
+                prompt: 'You are Berget Code Frontend agent. Voice: Scandinavian calm—precise, concise, confident. React 18 + TypeScript. Tailwind + Shadcn UI only via the design system (index.css, tailwind.config.ts). Use semantic tokens for color/spacing/typography/motion; never ad-hoc classes or inline colors. Components are pure and responsive; props-first data; minimal global state (Zustand/Jotai). Accessibility and keyboard navigation mandatory. Mock data only at init under /data via typed hooks (e.g., useProducts() reading /data/products.json). Design: minimal, balanced, quiet motion.\n\nIMPORTANT: You have NO bash access and cannot run git commands. When your frontend implementation tasks are complete, inform the user that changes are ready and suggest using /pr command to create a pull request with proper testing and quality checks.\n\nCODE QUALITY RULES:\n- Write clean, production-ready code\n- Follow React and TypeScript best practices\n- Ensure accessibility and responsive design\n- Use semantic tokens from design system\n- Test your components manually when possible\n- Document any complex logic with comments\n\nCRITICAL: When frontend implementation is complete, ALWAYS inform the user to use "/pr" command to handle testing, building, and pull request creation.',
+            },
+            backend: {
+                model: 'berget/glm-4.7',
+                temperature: 0.3,
+                top_p: 0.9,
+                mode: 'primary',
+                permission: { edit: 'allow', bash: 'allow', webfetch: 'allow' },
+                description: 'Functional, modular Koa + TypeScript services; schema-first with code quality focus.',
+                prompt: "You are Berget Code Backend agent. Voice: Scandinavian calm—precise, concise, confident. TypeScript + Koa. Prefer many small pure functions; avoid big try/catch blocks. Routes thin; logic in services/adapters/domain. Validate with Zod; auto-generate OpenAPI. Adapters isolate external systems; domain never depends on framework. Test with supertest; idempotent and stateless by default. Each microservice emits an OpenAPI contract; changes propagate upward to types. Code Quality & Refactoring Principles: Apply Single Responsibility Principle, fail fast with explicit errors, eliminate code duplication, remove nested complexity, use descriptive error codes, keep functions under 30 lines. Always leave code cleaner and more readable than you found it.\n\nGIT WORKFLOW RULES (CRITICAL):\n- NEVER push directly to main branch - ALWAYS use pull requests\n- NEVER use 'git add .' - ALWAYS add specific files with 'git add path/to/file'\n- ALWAYS clean up test files, documentation files, and temporary artifacts before committing\n- ALWAYS ensure git history maintains production quality - no test commits, no debugging code\n- ALWAYS create descriptive commit messages following project conventions\n- ALWAYS run tests and build before creating PR\n\nCRITICAL: When all backend implementation tasks are complete and ready for merge, ALWAYS invoke @quality subagent to handle testing, building, and complete PR management including URL provision.",
+            },
+            devops: {
+                model: 'berget/glm-4.7',
+                temperature: 0.3,
+                top_p: 0.8,
+                mode: 'primary',
+                permission: { edit: 'allow', bash: 'allow', webfetch: 'allow' },
+                description: 'Declarative GitOps infra with FluxCD, Kustomize, Helm, operators.',
+                prompt: "You are Berget Code DevOps agent. Voice: Scandinavian calm—precise, concise, confident. Start simple: k8s/{deployment,service,ingress}. Add FluxCD sync to repo and image automation. Use Kustomize bases/overlays (staging, production). Add dependencies via Helm from upstream sources; prefer native operators when available (CloudNativePG, cert-manager, external-dns). SemVer with -rc tags keeps CI environments current. Observability with Prometheus/Grafana. No manual kubectl in production—Git is the source of truth.\n\nGIT WORKFLOW RULES (CRITICAL):\n- NEVER push directly to main branch - ALWAYS use pull requests\n- NEVER use 'git add .' - ALWAYS add specific files with 'git add path/to/file'\n- ALWAYS clean up test files, documentation files, and temporary artifacts before committing\n- ALWAYS ensure git history maintains production quality - no test commits, no debugging code\n- ALWAYS create descriptive commit messages following project conventions\n- ALWAYS run tests and build before creating PR\n\nHelm Values Configuration Process:\n1. Documentation First Approach: Always fetch official documentation from Artifact Hub/GitHub for the specific chart version before writing values. Search Artifact Hub for exact chart version documentation, check the chart's GitHub repository for official docs and examples, verify the exact version being used in the deployment.\n2. Validation Requirements: Check for available validation schemas before committing YAML files. Use Helm's built-in validation tools (helm lint, helm template). Validate against JSON schema if available for the chart. Ensure YAML syntax correctness with linters.\n3. Standard Workflow: Identify chart name and exact version. Fetch official documentation from Artifact Hub/GitHub. Check for available schemas and validation tools. Write values according to official documentation. Validate against schema (if available). Test with helm template or helm lint. Commit validated YAML files.\n4. Quality Assurance: Never commit unvalidated Helm values. Use helm dependency update when adding new charts. Test rendering with helm template --dry-run before deployment. Document any custom values with comments referencing official docs.",
+            },
+            app: {
+                model: 'berget/glm-4.7',
+                temperature: 0.4,
+                top_p: 0.9,
+                mode: 'primary',
+                permission: { edit: 'allow', bash: 'deny', webfetch: 'allow' },
+                note: 'Bash access is denied for app persona to prevent shell command execution in mobile/Expo environments. This restriction enforces security and architectural boundaries.',
+                description: 'Expo + React Native apps; props-first, offline-aware, shared tokens.',
+                prompt: "You are Berget Code App agent. Voice: Scandinavian calm—precise, concise, confident. Expo + React Native + TypeScript. Structure by components/hooks/services/navigation. Components are pure; data via props; refactor shared logic into hooks/stores. Share tokens with frontend. Mock data in /data via typed hooks; later replace with live APIs. Offline via SQLite/MMKV; notifications via Expo. Request permissions only when needed. Subtle, meaningful motion; light/dark parity.\n\nGIT WORKFLOW RULES (CRITICAL):\n- NEVER push directly to main branch - ALWAYS use pull requests\n- NEVER use 'git add .' - ALWAYS add specific files with 'git add path/to/file'\n- ALWAYS clean up test files, documentation files, and temporary artifacts before committing\n- ALWAYS ensure git history maintains production quality - no test commits, no debugging code\n- ALWAYS create descriptive commit messages following project conventions\n- ALWAYS run tests and build before creating PR\n\nCRITICAL: When all app implementation tasks are complete and ready for merge, ALWAYS invoke @quality subagent to handle testing, building, and complete PR management including URL provision.",
+            },
+            security: {
+                model: 'berget/glm-4.7',
+                temperature: 0.2,
+                top_p: 0.8,
+                mode: 'subagent',
+                permission: { edit: 'deny', bash: 'allow', webfetch: 'allow' },
+                description: 'Security specialist for pentesting, OWASP compliance, and vulnerability assessments.',
+                prompt: "Voice: Scandinavian calm—precise, concise, confident. You are Berget Code Security agent. Expert in application security, penetration testing, and OWASP standards. Core responsibilities: Conduct security assessments and penetration tests, Validate OWASP Top 10 compliance, Review code for security vulnerabilities, Implement security headers and Content Security Policy (CSP), Audit API security, Check for sensitive data exposure, Validate input sanitization and output encoding, Assess dependency security and supply chain risks. Tools and techniques: OWASP ZAP, Burp Suite, security linters, dependency scanners, manual code review. Always provide specific, actionable security recommendations with priority levels.\n\nGIT WORKFLOW RULES (CRITICAL):\n- NEVER push directly to main branch - ALWAYS use pull requests\n- NEVER use 'git add .' - ALWAYS add specific files with 'git add path/to/file'\n- ALWAYS clean up test files, documentation files, and temporary artifacts before committing\n- ALWAYS ensure git history maintains production quality - no test commits, no debugging code\n- ALWAYS create descriptive commit messages following project conventions\n- ALWAYS run tests and build before creating PR",
+            },
+            quality: {
+                model: 'berget/glm-4.7',
+                temperature: 0.1,
+                top_p: 0.9,
+                mode: 'subagent',
+                permission: { edit: 'allow', bash: 'allow', webfetch: 'allow' },
+                description: 'Quality assurance specialist for testing, building, and PR management.',
+                prompt: "Voice: Scandinavian calm—precise, concise, confident. You are Berget Code Quality agent. Specialist in code quality assurance, testing, building, and pull request management.\\n\\nCore responsibilities:\\n  - Run comprehensive test suites (npm test, npm run test, jest, vitest)\\n  - Execute build processes (npm run build, webpack, vite, tsc)\\n  - Create and manage pull requests with proper descriptions\\n  - Monitor GitHub for Copilot/reviewer comments\\n  - Ensure code quality standards are met\\n  - Validate linting and formatting (npm run lint, prettier)\\n  - Check test coverage and performance benchmarks\\n  - Handle CI/CD pipeline validation\\n\\nGIT WORKFLOW RULES (CRITICAL - ENFORCE STRICTLY):\\n  - NEVER push directly to main branch - ALWAYS use pull requests\\n  - NEVER use 'git add .' - ALWAYS add specific files with 'git add path/to/file'\\n  - ALWAYS clean up test files, documentation files, and temporary artifacts before committing\\n  - ALWAYS ensure git history maintains production quality - no test commits, no debugging code\\n  - ALWAYS create descriptive commit messages following project conventions\\n  - ALWAYS run tests and build before creating PR\\n\\nCommon CLI commands:\\n  - npm test or npm run test (run test suite)\\n  - npm run build (build project)\\n  - npm run lint (run linting)\\n  - npm run format (format code)\\n  - npm run test:coverage (check coverage)\\n  - gh pr create (create pull request)\\n  - gh pr view --comments (check PR comments)\\n  - git add specific/files && git commit -m \\\"message\\\" && git push (NEVER use git add .)\\n\\nPR Workflow:\\n  1. Ensure all tests pass: npm test\\n  2. Build successfully: npm run build\\n  3. Create/update PR with clear description\\n  4. Monitor for reviewer comments\\n  5. Address feedback promptly\\n  6. Update PR with fixes\\n  7. Ensure CI checks pass\\n\\nAlways provide specific command examples and wait for processes to complete before proceeding.",
+            },
+        };
     });
 }
 /**
@@ -288,9 +357,8 @@ function loadLatestAgentConfig() {
  */
 function checkOpencodeInstalled() {
     return new Promise((resolve) => {
-        const child = (0, child_process_1.spawn)('opencode', ['--version'], {
+        const child = (0, child_process_1.spawn)('which', ['opencode'], {
             stdio: 'pipe',
-            shell: true,
         });
         child.on('close', (code) => {
             resolve(code === 0);
@@ -310,7 +378,6 @@ function installOpencode() {
             yield new Promise((resolve, reject) => {
                 const install = (0, child_process_1.spawn)('npm', ['install', '-g', 'opencode-ai'], {
                     stdio: 'inherit',
-                    shell: true,
                 });
                 install.on('close', (code) => {
                     if (code === 0) {
@@ -336,7 +403,7 @@ function installOpencode() {
             console.error(chalk_1.default.red('Failed to install OpenCode:'));
             console.error(error instanceof Error ? error.message : String(error));
             console.log(chalk_1.default.blue('\nAlternative installation methods:'));
-            console.log(chalk_1.default.blue('  curl -fsSL https://opencode.ai/install | bash'));
+            console.log(chalk_1.default.blue('  curl -fsSL https://opencode.ai/install | sh'));
             console.log(chalk_1.default.blue('  Or visit: https://opencode.ai/docs'));
             return false;
         }
@@ -407,12 +474,9 @@ function registerCodeCommands(program) {
             }
             else {
                 // Only require authentication if we don't have an API key
-                try {
-                    const authService = auth_service_1.AuthService.getInstance();
-                    // This will throw if not authenticated
-                    yield authService.whoami();
-                }
-                catch (error) {
+                const authService = auth_service_1.AuthService.getInstance();
+                const profile = yield authService.whoami();
+                if (!profile) {
                     console.log(chalk_1.default.red('❌ Not authenticated with Berget AI.'));
                     console.log(chalk_1.default.blue('To get started, you have two options:'));
                     console.log('');
@@ -436,62 +500,35 @@ function registerCodeCommands(program) {
             let keyName;
             try {
                 const apiKeyService = api_key_service_1.ApiKeyService.getInstance();
-                // Check for environment variable first (regardless of automation mode)
                 if (process.env.BERGET_API_KEY) {
-                    console.log(chalk_1.default.blue('🔑 Using BERGET_API_KEY from environment'));
-                    apiKey = process.env.BERGET_API_KEY;
-                    keyName = `env-key-${projectName}`;
-                }
-                else {
-                    // List existing API keys
-                    if (!options.yes) {
-                        console.log(chalk_1.default.blue('\n📋 Checking existing API keys...'));
+                    if (options.yes) {
+                        console.log(chalk_1.default.blue('🔑 Using BERGET_API_KEY from environment'));
+                        apiKey = process.env.BERGET_API_KEY;
+                        keyName = `env-key-${projectName}`;
                     }
-                    const existingKeys = yield apiKeyService.list();
-                    if (existingKeys.length > 0 && !options.yes) {
-                        console.log(chalk_1.default.blue('Found existing API keys:'));
+                    else {
+                        console.log(chalk_1.default.blue('\n📋 API key setup:'));
                         console.log(chalk_1.default.dim('─'.repeat(60)));
-                        existingKeys.forEach((key, index) => {
-                            console.log(`${chalk_1.default.cyan((index + 1).toString())}. ${chalk_1.default.bold(key.name)} (${key.prefix}...)`);
-                            console.log(chalk_1.default.dim(`   Created: ${new Date(key.created).toLocaleDateString('sv-SE')}`));
-                            console.log(chalk_1.default.dim(`   Last used: ${key.lastUsed ? new Date(key.lastUsed).toLocaleDateString('sv-SE') : 'Never'}`));
-                            if (index < existingKeys.length - 1)
-                                console.log();
-                        });
+                        console.log(`${chalk_1.default.cyan('1')} ${chalk_1.default.bold('Use existing API key')}`);
+                        console.log(chalk_1.default.dim('   Uses BERGET_API_KEY from environment'));
+                        console.log(`${chalk_1.default.cyan('2')} ${chalk_1.default.bold('Create a new API key')}`);
                         console.log(chalk_1.default.dim('─'.repeat(60)));
-                        console.log(chalk_1.default.cyan(`${existingKeys.length + 1}. Create a new API key`));
-                        // Get user choice
                         const choice = yield new Promise((resolve) => {
                             const rl = readline_1.default.createInterface({
                                 input: process.stdin,
                                 output: process.stdout,
                             });
-                            rl.question(chalk_1.default.blue('\nSelect an option (1-' +
-                                (existingKeys.length + 1) +
-                                '): '), (answer) => {
+                            rl.question(chalk_1.default.blue('\nSelect an option (1-2, default: 1): '), (answer) => {
                                 rl.close();
-                                resolve(answer.trim());
+                                resolve(answer.trim() || '1');
                             });
                         });
-                        const choiceIndex = parseInt(choice) - 1;
-                        if (choiceIndex >= 0 && choiceIndex < existingKeys.length) {
-                            // Use existing key
-                            const selectedKey = existingKeys[choiceIndex];
-                            keyName = selectedKey.name;
-                            // We need to rotate the key to get the actual key value
-                            console.log(chalk_1.default.yellow(`\n🔄 Rotating API key "${selectedKey.name}" to get the key value...`));
-                            if (yield confirm(chalk_1.default.yellow('This will invalidate the current key. Continue? (Y/n): '), options.yes)) {
-                                const rotatedKey = yield apiKeyService.rotate(selectedKey.id.toString());
-                                apiKey = rotatedKey.key;
-                                console.log(chalk_1.default.green(`✓ API key rotated successfully`));
-                            }
-                            else {
-                                console.log(chalk_1.default.yellow('Cancelled. Please select a different option or create a new key.'));
-                                return;
-                            }
+                        if (choice === '1') {
+                            console.log(chalk_1.default.blue('🔑 Using BERGET_API_KEY from environment'));
+                            apiKey = process.env.BERGET_API_KEY;
+                            keyName = `env-key-${projectName}`;
                         }
-                        else if (choiceIndex === existingKeys.length) {
-                            // Create new key
+                        else if (choice === '2') {
                             console.log(chalk_1.default.blue('\n🔑 Creating new API key...'));
                             const defaultKeyName = `opencode-${projectName}-${Date.now()}`;
                             const customName = yield getInput(chalk_1.default.blue(`Enter key name (default: ${defaultKeyName}): `), defaultKeyName, options.yes);
@@ -506,20 +543,21 @@ function registerCodeCommands(program) {
                             return;
                         }
                     }
-                    else {
-                        // No existing keys or automation mode - create new one
-                        if (!options.yes) {
-                            console.log(chalk_1.default.yellow('No existing API keys found.'));
-                            console.log(chalk_1.default.blue('Creating a new API key...'));
-                        }
-                        const defaultKeyName = `opencode-${projectName}-${Date.now()}`;
-                        const customName = yield getInput(chalk_1.default.blue(`Enter key name (default: ${defaultKeyName}): `), defaultKeyName, options.yes);
-                        keyName = customName;
-                        const createOptions = { name: keyName };
-                        const keyData = yield apiKeyService.create(createOptions);
-                        apiKey = keyData.key;
-                        console.log(chalk_1.default.green(`✓ Created new API key: ${keyName}`));
+                }
+                else {
+                    if (!options.yes) {
+                        console.log(chalk_1.default.yellow('No BERGET_API_KEY environment variable found.'));
+                        console.log(chalk_1.default.blue('Creating a new API key...'));
+                        console.log(chalk_1.default.dim('\n💡 Tip: Set BERGET_API_KEY environment variable to reuse an existing key:'));
+                        console.log(chalk_1.default.dim('   export BERGET_API_KEY=your_api_key_here'));
                     }
+                    const defaultKeyName = `opencode-${projectName}-${Date.now()}`;
+                    const customName = yield getInput(chalk_1.default.blue(`Enter key name (default: ${defaultKeyName}): `), defaultKeyName, options.yes);
+                    keyName = customName;
+                    const createOptions = { name: keyName };
+                    const keyData = yield apiKeyService.create(createOptions);
+                    apiKey = keyData.key;
+                    console.log(chalk_1.default.green(`✓ Created new API key: ${keyName}`));
                 }
             }
             catch (error) {
@@ -543,9 +581,13 @@ function registerCodeCommands(program) {
             }
             // Prepare .env file path for safe update
             const envPath = path_1.default.join(process.cwd(), '.env');
-            // Load latest agent configuration to ensure consistency
+            // Load latest agent configuration from our own codebase
             const latestAgentConfig = yield loadLatestAgentConfig();
-            const modelConfig = (0, config_loader_1.getModelConfig)();
+            // Use hardcoded defaults for init - never try to load from project
+            const modelConfig = {
+                primary: 'berget/glm-4.7',
+                small: 'berget/gpt-oss',
+            };
             // Create opencode.json config with optimized agent-based format
             const config = {
                 $schema: 'https://opencode.ai/config.json',
@@ -672,7 +714,21 @@ function registerCodeCommands(program) {
                             baseURL: 'https://api.berget.ai/v1',
                             apiKey: '{env:BERGET_API_KEY}',
                         },
-                        models: (0, config_loader_1.getProviderModels)(),
+                        models: {
+                            'glm-4.7': {
+                                name: 'GLM-4.7',
+                                limit: { output: 4000, context: 90000 },
+                            },
+                            'gpt-oss': {
+                                name: 'GPT-OSS',
+                                limit: { output: 4000, context: 128000 },
+                                modalities: ['text', 'image'],
+                            },
+                            'llama-8b': {
+                                name: 'llama-3.1-8b',
+                                limit: { output: 4000, context: 128000 },
+                            },
+                        },
                     },
                 },
             };
@@ -964,7 +1020,6 @@ All agents follow these principles:
             const opencode = (0, child_process_1.spawn)('opencode', opencodeArgs, {
                 stdio: 'inherit',
                 env: env,
-                shell: true,
             });
             opencode.on('close', (code) => {
                 if (code !== 0) {
@@ -1004,7 +1059,6 @@ All agents follow these principles:
             // Spawn opencode serve process
             const opencode = (0, child_process_1.spawn)('opencode', serveArgs, {
                 stdio: 'inherit',
-                shell: true,
             });
             opencode.on('close', (code) => {
                 if (code !== 0) {
@@ -1057,7 +1111,18 @@ All agents follow these principles:
             console.log(chalk_1.default.dim(`  Agents: ${Object.keys(currentConfig.agent || {}).length} configured`));
             // Load latest agent configuration to ensure consistency
             const latestAgentConfig = yield loadLatestAgentConfig();
-            const modelConfig = (0, config_loader_1.getModelConfig)();
+            // Get model config with fallback for init scenario
+            let modelConfig;
+            try {
+                modelConfig = (0, config_loader_1.getModelConfig)();
+            }
+            catch (error) {
+                // Fallback to defaults when no config exists (init scenario)
+                modelConfig = {
+                    primary: 'berget/glm-4.7',
+                    small: 'berget/gpt-oss',
+                };
+            }
             // Create latest configuration with all improvements
             const latestConfig = {
                 $schema: 'https://opencode.ai/config.json',
@@ -1216,9 +1281,9 @@ All agents follow these principles:
                 if (((_c = (_b = currentConfig.agent) === null || _b === void 0 ? void 0 : _b.security) === null || _c === void 0 ? void 0 : _c.mode) !== 'subagent') {
                     console.log(chalk_1.default.cyan('  • Security agent converted to subagent (read-only)'));
                 }
-                // Check for GLM-4.6 optimizations
+                // Check for GLM-4.7 optimizations
                 if (!((_h = (_g = (_f = (_e = (_d = currentConfig.provider) === null || _d === void 0 ? void 0 : _d.berget) === null || _e === void 0 ? void 0 : _e.models) === null || _f === void 0 ? void 0 : _f[modelConfig.primary.replace('berget/', '')]) === null || _g === void 0 ? void 0 : _g.limit) === null || _h === void 0 ? void 0 : _h.context)) {
-                    console.log(chalk_1.default.cyan('  • GLM-4.6 token limits and auto-compaction'));
+                    console.log(chalk_1.default.cyan('  • GLM-4.7 token limits and auto-compaction'));
                 }
                 console.log(chalk_1.default.cyan('  • Latest agent prompts and improvements'));
             }
@@ -1443,7 +1508,7 @@ All agents follow these principles:
                     console.log(chalk_1.default.cyan('  • @quality subagent for testing and PR management'));
                     console.log(chalk_1.default.cyan('  • @security subagent for security reviews'));
                     console.log(chalk_1.default.cyan('  • Improved agent prompts and routing'));
-                    console.log(chalk_1.default.cyan('  • GLM-4.6 token optimizations'));
+                    console.log(chalk_1.default.cyan('  • GLM-4.7 token optimizations'));
                     console.log(chalk_1.default.blue('\nTry these new commands:'));
                     console.log(chalk_1.default.cyan('  @quality run tests and create PR'));
                     console.log(chalk_1.default.cyan('  @security review this code'));

package/dist/src/services/auth-service.js

@@ -60,12 +60,11 @@ class AuthService {
             try {
                 const { data: profile, error } = yield this.client.GET('/v1/users/me');
                 if (error) {
-                    throw new Error(error ? JSON.stringify(error) : 'Failed to get user profile');
+                    return null;
                 }
                 return profile;
             }
             catch (error) {
-                (0, error_handler_1.handleError)('Failed to get user profile', error);
                 return null;
             }
         });