dexto 1.14.6 → 2.0.0-beta.1

package/dist/cli/utils/dexto-auth-check.js

@@ -25,7 +25,7 @@
  */
 import chalk from 'chalk';
 import * as p from '@clack/prompts';
-import { isAuthenticated } from '../auth/index.js';
+import { canUseDextoProvider } from './dexto-setup.js';
 import { getEffectiveLLMConfig } from '../../config/effective-llm.js';
 /**
  * Check if user is configured to use Dexto Nova credits but is not authenticated.
@@ -43,7 +43,7 @@ import { getEffectiveLLMConfig } from '../../config/effective-llm.js';
  * const result = await checkDextoAuthState(true, 'coding-agent');
  * if (!result.shouldContinue) {
  *   if (result.action === 'login') {
- *     await handleLoginCommand();
+ *     await signInForDextoModels();
  *   } else if (result.action === 'setup') {
  *     await handleSetupCommand();
  *   }
@@ -57,9 +57,8 @@ export async function checkDextoAuthState(interactive = true, agentId = 'coding-
     if (!effectiveLLM || effectiveLLM.provider !== 'dexto-nova') {
         return { shouldContinue: true };
     }
-    // Using dexto-nova provider - check if authenticated
-    const authenticated = await isAuthenticated();
-    if (authenticated) {
+    // Using dexto-nova provider - check the sign-in can run Dexto models
+    if (await canUseDextoProvider()) {
         return { shouldContinue: true };
     }
     // User is configured for Dexto Nova credits but not logged in

package/dist/cli/utils/dexto-setup.d.ts

@@ -1,8 +1,7 @@
+export { canUseDextoProvider } from '@dexto/agent-management';
 /**
- * Check if user can use Dexto provider.
- * Requires BOTH:
- * 1. User has usable Dexto auth state from `dexto login`
- * 2. Has DEXTO_API_KEY (from auth config or environment)
+ * Signs in to Dexto asking to spend credits (`cloud:write`), as choosing Dexto models needs. A
+ * sign-in that only reads keeps what it had and gains that.
  */
-export declare function canUseDextoProvider(): Promise<boolean>;
+export declare function signInForDextoModels(): Promise<void>;
 //# sourceMappingURL=dexto-setup.d.ts.map

package/dist/cli/utils/dexto-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dexto-setup.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/dexto-setup.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ5D"}
+{"version":3,"file":"dexto-setup.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/dexto-setup.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;GAGG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D"}

package/dist/cli/utils/dexto-setup.js

@@ -1,17 +1,20 @@
-// packages/cli/src/cli/utils/dexto-setup.ts
-import { getDextoApiKey, isAuthenticated } from '../auth/index.js';
+// Setting this machine up for Dexto models: whether they can run, and signing in so they can.
+export { canUseDextoProvider } from '@dexto/agent-management';
 /**
- * Check if user can use Dexto provider.
- * Requires BOTH:
- * 1. User has usable Dexto auth state from `dexto login`
- * 2. Has DEXTO_API_KEY (from auth config or environment)
+ * Signs in to Dexto asking to spend credits (`cloud:write`), as choosing Dexto models needs. A
+ * sign-in that only reads keeps what it had and gains that.
  */
-export async function canUseDextoProvider() {
-    const authenticated = await isAuthenticated();
-    if (!authenticated)
-        return false;
-    const apiKey = await getDextoApiKey();
-    if (!apiKey)
-        return false;
-    return true;
+export async function signInForDextoModels() {
+    const [{ login }, { nodeSignInContext }] = await Promise.all([
+        import('../commands/auth/sign-in-commands.js'),
+        import('../commands/auth/sign-in-context.js'),
+    ]);
+    await login(await nodeSignInContext(), {
+        profile: null,
+        org: null,
+        device: false,
+        browser: true,
+        scopes: ['cloud:write'],
+        apiKey: null,
+    });
 }

package/dist/cli/utils/provider-setup.js

@@ -260,7 +260,7 @@ export async function selectProvider() {
  */
 export function getProviderDisplayName(provider) {
     if (provider === 'dexto-nova')
-        return 'Dexto Nova';
+        return 'Dexto';
     if (isLLMProvider(provider)) {
         return PROVIDER_REGISTRY[provider]?.label || provider;
     }

package/dist/cli/utils/scaffolding-utils.d.ts

@@ -1,9 +1,15 @@
 import * as p from '@clack/prompts';
-export declare function getDextoCliVersion(): string;
-export declare function getDextoVersionRange(): string;
+/**
+ * The range a scaffolded project asks for `packageName` (an `@dexto/*` package): the version the
+ * CLI itself runs, since dexto versions apart from them. A package the CLI doesn't install, such as
+ * @dexto/image-bundler, takes @dexto/core's, as the @dexto/* packages version together.
+ */
+export declare function dextoPackageRange(packageName: string, cliRoot?: string): string;
+/** The range a scaffolded project asks for a peer of @dexto/core, such as zod: core's own. */
+export declare function dextoPeerRange(peerName: string, cliRoot?: string): string;
 export declare function isLocalDependencySpecifier(specifier: string): boolean;
 export declare function hasVersionInPackageSpecifier(specifier: string): boolean;
-export declare function pinDextoPackageIfUnversioned(specifier: string, versionRange: string): string;
+export declare function pinDextoPackageIfUnversioned(specifier: string, rangeFor: (packageName: string) => string): string;
 /**
  * Validates a project name against the standard regex
  * @param name - The project name to validate

package/dist/cli/utils/scaffolding-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffolding-utils.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/scaffolding-utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AA8CpC,wBAAgB,kBAAkB,IAAI,MAAM,CAM3C;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOrE;AAED,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAK5F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMpE;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACtC,WAAW,GAAE,MAA2B,EACxC,aAAa,GAAE,MAAiD,GACjE,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACjC,WAAW,EAAE,MAAM,EACnB,iBAAiB,GAAE,MAAM,EAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACjC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,SAAS,GAClC,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7F;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/E;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BjF;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,EACD,cAAc,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE"}
+{"version":3,"file":"scaffolding-utils.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/scaffolding-utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAqCpC;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,MAAyB,GAAG,MAAM,CAMjG;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAAyB,GAAG,MAAM,CAS3F;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOrE;AAED,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED,wBAAgB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAC1C,MAAM,CAKR;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMpE;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACtC,WAAW,GAAE,MAA2B,EACxC,aAAa,GAAE,MAAiD,GACjE,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACjC,WAAW,EAAE,MAAM,EACnB,iBAAiB,GAAE,MAAM,EAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACjC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,SAAS,GAClC,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7F;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/E;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BjF;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,EACD,cAAc,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE"}

package/dist/cli/utils/scaffolding-utils.js

@@ -1,55 +1,63 @@
 import fs from 'fs-extra';
 import path from 'path';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import chalk from 'chalk';
 import { getDextoPackageRoot } from '@dexto/agent-management';
 import { executeWithTimeout } from './execute.js';
 import { textOrExit } from './prompt-helpers.js';
 import { getPackageManager, getPackageManagerInstallCommand } from './package-mgmt.js';
-function readVersionFromPackageJson(packageJsonPath) {
-    if (!existsSync(packageJsonPath)) {
-        return undefined;
-    }
-    try {
-        const content = readFileSync(packageJsonPath, 'utf-8');
-        const pkg = JSON.parse(content);
-        if (typeof pkg.version === 'string' && pkg.version.length > 0) {
-            return pkg.version;
-        }
-    }
-    catch {
-        // Ignore parse/read errors and fall back.
-    }
-    return undefined;
-}
-function resolveCliPackageVersion() {
+/** The installed dexto package's folder: the package.json above this module, or the standalone binary's. */
+function cliPackageRoot() {
     const scriptDir = path.dirname(fileURLToPath(import.meta.url));
-    const localPackageJsonPath = path.resolve(scriptDir, '../../../package.json');
-    const localVersion = readVersionFromPackageJson(localPackageJsonPath);
-    if (localVersion) {
-        return localVersion;
-    }
+    const local = path.resolve(scriptDir, '../../..');
+    if (existsSync(path.join(local, 'package.json')))
+        return local;
     const packageRoot = getDextoPackageRoot();
-    if (packageRoot) {
-        const packageJsonPath = path.join(packageRoot, 'package.json');
-        const packageVersion = readVersionFromPackageJson(packageJsonPath);
-        if (packageVersion) {
-            return packageVersion;
+    if (packageRoot !== undefined && existsSync(path.join(packageRoot, 'package.json')))
+        return packageRoot;
+    throw new Error("Could not find the dexto CLI's package.json");
+}
+/**
+ * The package.json of the copy of `packageName` the CLI at `cliRoot` loads: the first in the
+ * node_modules folders above it, as ES modules resolve (never NODE_PATH or global folders).
+ */
+function installedPackage(packageName, cliRoot) {
+    for (let dir = realpathSync(cliRoot);; dir = path.dirname(dir)) {
+        const packageJson = path.join(dir, 'node_modules', packageName, 'package.json');
+        if (path.basename(dir) !== 'node_modules' && existsSync(packageJson)) {
+            const pkg = JSON.parse(readFileSync(packageJson, 'utf-8'));
+            if (typeof pkg === 'object' && pkg !== null)
+                return { ...pkg };
         }
+        if (path.dirname(dir) === dir)
+            return null;
     }
-    return process.env.DEXTO_CLI_VERSION;
 }
-const cliPackageVersion = resolveCliPackageVersion();
-export function getDextoCliVersion() {
-    const version = process.env.DEXTO_CLI_VERSION ?? cliPackageVersion;
-    if (!version) {
-        throw new Error('Could not determine dexto CLI version');
-    }
-    return version;
+function installedVersion(packageName, cliRoot) {
+    const version = installedPackage(packageName, cliRoot)?.version;
+    return typeof version === 'string' && version.length > 0 ? version : null;
+}
+/**
+ * The range a scaffolded project asks for `packageName` (an `@dexto/*` package): the version the
+ * CLI itself runs, since dexto versions apart from them. A package the CLI doesn't install, such as
+ * @dexto/image-bundler, takes @dexto/core's, as the @dexto/* packages version together.
+ */
+export function dextoPackageRange(packageName, cliRoot = cliPackageRoot()) {
+    const version = installedVersion(packageName, cliRoot) ?? installedVersion('@dexto/core', cliRoot);
+    if (version === null)
+        throw new Error(`Could not find the @dexto/core the dexto CLI at ${cliRoot} runs`);
+    return `^${version}`;
 }
-export function getDextoVersionRange() {
-    return `^${getDextoCliVersion()}`;
+/** The range a scaffolded project asks for a peer of @dexto/core, such as zod: core's own. */
+export function dextoPeerRange(peerName, cliRoot = cliPackageRoot()) {
+    const peers = installedPackage('@dexto/core', cliRoot)?.peerDependencies;
+    const range = typeof peers === 'object' && peers !== null
+        ? Object.entries(peers).find(([name]) => name === peerName)?.[1]
+        : undefined;
+    if (typeof range !== 'string')
+        throw new Error(`The @dexto/core the dexto CLI at ${cliRoot} runs has no ${peerName} peer`);
+    return range;
 }
 export function isLocalDependencySpecifier(specifier) {
     return (specifier.startsWith('.') ||
@@ -69,14 +77,14 @@ export function hasVersionInPackageSpecifier(specifier) {
     }
     return true;
 }
-export function pinDextoPackageIfUnversioned(specifier, versionRange) {
+export function pinDextoPackageIfUnversioned(specifier, rangeFor) {
     if (isLocalDependencySpecifier(specifier))
         return specifier;
     if (!specifier.startsWith('@dexto/'))
         return specifier;
     if (hasVersionInPackageSpecifier(specifier))
         return specifier;
-    return `${specifier}@${versionRange}`;
+    return `${specifier}@${rangeFor(specifier)}`;
 }
 /**
  * Validates a project name against the standard regex

package/dist/cli/utils/version-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-check.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/version-check.ts"],"names":[],"mappings":"AAiBA;;GAEG;AACH,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACzB;AAkJD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA6DxF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAatE"}
+{"version":3,"file":"version-check.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/version-check.ts"],"names":[],"mappings":"AAiBA;;GAEG;AACH,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACzB;AAkJD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA6DxF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CActE"}

package/dist/cli/utils/version-check.js

@@ -220,7 +220,8 @@ export async function checkForUpdates(currentVersion) {
 export function displayUpdateNotification(updateInfo) {
     const message = `Update available: ${chalk.gray(updateInfo.current)} ${chalk.gray('→')} ${chalk.green(updateInfo.latest)}\n` +
         `Run: ${chalk.cyan(updateInfo.updateCommand)}`;
-    console.log(boxen(message, {
+    // A notice, not a result: stderr, so stdout stays what the command printed.
+    console.error(boxen(message, {
         padding: 1,
         margin: { top: 1, bottom: 1, left: 0, right: 0 },
         borderColor: 'yellow',

package/dist/index-main.js

@@ -47,43 +47,31 @@ process.env.DEXTO_CLI_VERSION = cliVersion;
 import { logger, startLlmRegistryAutoUpdate, DextoAgent, isPath } from '@dexto/core';
 import { getAllSupportedModels, getProviderFromModel } from '@dexto/llm';
 import { applyImageDefaults, cleanNullValues, AgentConfigSchema, loadImage, resolveServicesFromConfig, toDextoAgentOptions, } from '@dexto/agent-config';
-import { registerConfiguredSkillPrompts, getDextoPackageRoot, resolveAgentPath, loadAgentConfig, findDextoProjectRoot, globalPreferencesExist, loadGlobalPreferences, resolveBundledScript, enrichAgentConfig, isDextoAuthEnabled, createModelAuthResolver, resolveApiKeyForProvider, getPrimaryApiKeyEnvVar, } from '@dexto/agent-management';
+import { registerConfiguredSkillPrompts, getDextoPackageRoot, resolveAgentPath, loadAgentConfig, findDextoProjectRoot, globalPreferencesExist, loadGlobalPreferences, resolveBundledScript, enrichAgentConfig, isDextoAuthEnabled, createModelAuthResolver, dextoGateway, dextoMcp, resolveApiKeyForProvider, getPrimaryApiKeyEnvVar, } from '@dexto/agent-management';
 import { validateCliOptions, handleCliOptionsError } from './cli/utils/options.js';
 import { validateAgentConfig } from './cli/utils/config-validation.js';
 import { applyCLIOverrides, applyStartupLLMFallback, applyUserPreferences, } from './config/cli-overrides.js';
 import { registerRunCommand } from './cli/commands/run/register.js';
 import { registerSessionCommand } from './cli/commands/session/register.js';
 import { registerSearchCommand } from './cli/commands/search/register.js';
-import { registerAuthCommand } from './cli/commands/auth/register.js';
-import { registerBillingCommand } from './cli/commands/billing/register.js';
 import { registerCloudCommand } from './cli/commands/cloud/register.js';
+import { isRootJsonHelp, rootHelpJson } from './cli/help-json.js';
 import { registerMcpCommand } from './cli/commands/mcp/register.js';
 import { registerImageCommand } from './cli/commands/image/register.js';
 import { registerPluginCommand } from './cli/commands/plugin/register.js';
 import { registerAgentsCommand } from './cli/commands/agents/register.js';
-import { registerDeployCommand } from './cli/commands/deploy/register.js';
-import { registerSpanCommand } from './cli/commands/span/register.js';
-import { registerTraceCommand } from './cli/commands/trace/register.js';
 import { registerInitCommand } from './cli/commands/init.js';
 import { ensureImageImporterConfigured } from './cli/utils/image-importer.js';
 const program = new Command();
-let dextoApiKeyBootstrapped = false;
+let earlierSignInsCarriedOver = false;
 let versionCheckPromise = null;
 let llmRegistryAutoUpdateStarted = false;
-async function ensureDextoApiKeyBootstrap() {
-    if (dextoApiKeyBootstrapped) {
+async function ensureDextoSignInsCarriedOver() {
+    if (earlierSignInsCarriedOver)
         return;
-    }
-    if (!isDextoAuthEnabled()) {
-        dextoApiKeyBootstrapped = true;
-        return;
-    }
-    const { getDextoApiKey } = await import('./cli/auth/index.js');
-    const dextoApiKey = await getDextoApiKey();
-    if (dextoApiKey) {
-        process.env.DEXTO_API_KEY = dextoApiKey;
-    }
-    dextoApiKeyBootstrapped = true;
+    const { carryOverEarlierSignIns } = await import('./cli/commands/auth/sign-in-context.js');
+    await carryOverEarlierSignIns();
+    earlierSignInsCarriedOver = true;
 }
 async function getVersionCheckResult() {
     if (!versionCheckPromise) {
@@ -105,7 +93,6 @@ program
     .description('AI-powered CLI and WebUI for interacting with MCP servers.')
     .version(cliVersion, '-v, --version', 'output the current version')
     .option('-a, --agent <id|path>', 'Agent ID or path to agent config file')
-    .option('--cloud-agent <id>', 'Connect the interactive CLI to a deployed cloud agent by ID')
     .option('-p, --prompt <text>', 'Start the interactive CLI and immediately run the prompt')
     .option('-s, --strict', 'Require all server connections to succeed')
     .option('--no-verbose', 'Disable verbose output')
@@ -147,9 +134,6 @@ program
     }
 }));
 registerImageCommand({ program });
-registerDeployCommand({ program });
-registerSpanCommand({ program });
-registerTraceCommand({ program });
 registerInitCommand({ program });
 // 4) `init-app` SUB-COMMAND
 program
@@ -296,7 +280,7 @@ registerPluginCommand({ program });
 async function bootstrapAgentFromGlobalOpts(options) {
     const { mode, modelOverride } = options;
     const isHeadlessRun = mode === 'headless-run';
-    await ensureDextoApiKeyBootstrap();
+    await ensureDextoSignInsCarriedOver();
     await ensureImageImporterConfigured();
     const globalOpts = program.opts();
     const effectiveModel = modelOverride ?? globalOpts.model;
@@ -359,6 +343,8 @@ async function bootstrapAgentFromGlobalOpts(options) {
         logLevel: isHeadlessRun ? 'error' : 'info',
         workspaceRoot,
     });
+    // Signed in: the session gets the Dexto MCP's tools beside the person's own servers.
+    enrichedConfig.mcpServers = dextoMcp.withDextoMcpServer(enrichedConfig.mcpServers, await dextoMcp.dextoMcpServer(dextoGateway.defaultDextoGatewayOptions()));
     if (isHeadlessRun) {
         // Force silent transport in headless mode even when agent config defines logger settings.
         // `dexto run` owns stderr formatting and should be the only writer.
@@ -383,6 +369,7 @@ async function bootstrapAgentFromGlobalOpts(options) {
         hostContext: { workspaceRoot },
         overrides: {
             authResolver: createModelAuthResolver(),
+            mcpAuthProviderFactory: dextoMcp.withDextoMcpAuth(null, dextoGateway.defaultDextoGatewayOptions()),
         },
     }));
     agent.setApprovalHandler((request) => handleHeadlessApproval(request, agent, undefined));
@@ -410,8 +397,6 @@ const runtimeCommandContext = {
 registerRunCommand(runtimeCommandContext);
 registerSessionCommand(runtimeCommandContext);
 registerSearchCommand(runtimeCommandContext);
-registerAuthCommand(runtimeCommandContext);
-registerBillingCommand(runtimeCommandContext);
 registerCloudCommand(program);
 registerMcpCommand({ program });
 // 13) Main dexto CLI - Interactive (CLI) or run in other modes (--mode web/server/mcp)
@@ -424,9 +409,9 @@ program
     '  dexto --prompt "query"   Start interactive CLI and run the prompt\n' +
     '  dexto run "query"        Run one-off headless task\n\n' +
     'Session Management Commands:\n' +
-    '  dexto session list              List all sessions\n' +
-    '  dexto session history [id]      Show session history\n' +
-    '  dexto session delete <id>       Delete a session\n' +
+    "  dexto chat list                 List this machine's chats\n" +
+    "  dexto chat history [id]         Show a chat's messages\n" +
+    '  dexto chat delete <id>          Delete a chat\n' +
     '  dexto search <query>            Search across sessions\n' +
     '    Options: --session <id>, --role <user|assistant>, --limit <n>\n\n' +
     'Agent Selection:\n' +
@@ -442,7 +427,7 @@ program
     '  dexto --mode mcp         Run as MCP server\n\n' +
     'Docs: https://cli.dexto.ai')
     .action(withAnalytics('main', async () => {
-    await ensureDextoApiKeyBootstrap();
+    await ensureDextoSignInsCarriedOver();
     await ensureImageImporterConfigured();
     ensureLlmRegistryAutoUpdateStarted();
     // ——— ENV CHECK (optional) ———
@@ -483,9 +468,9 @@ program
     // the first positional argument as an agent name to avoid ambiguity with prompts.
     // ——— FORCE CLI MODE FOR PROMPT/SESSION FLAGS ———
     // If a prompt or session flag was provided, force CLI mode.
-    const modeForcedByChatFlags = Boolean(initialPrompt || opts.continue || opts.resume || opts.cloudAgent);
+    const modeForcedByChatFlags = Boolean(initialPrompt || opts.continue || opts.resume);
     if (modeForcedByChatFlags && opts.mode !== 'cli') {
-        console.error(`ℹ️  Forcing CLI mode due to --prompt/--continue/--resume/--cloud-agent.`);
+        console.error(`ℹ️  Forcing CLI mode due to --prompt/--continue/--resume.`);
         console.error(`   Original mode: ${opts.mode} → Overridden to: cli`);
         opts.mode = 'cli';
     }
@@ -495,28 +480,6 @@ program
         console.error('💡 For non-interactive runs, use `dexto run "<prompt>"`, or use --mode server for automation.');
         safeExit('main', 1, 'no-tty');
     }
-    if (opts.cloudAgent) {
-        if (opts.agent) {
-            console.error('❌ `--agent` and `--cloud-agent` are mutually exclusive. Use one chat target at a time.');
-            safeExit('main', 1, 'cloud-agent-conflict');
-        }
-        try {
-            const { startCloudChatCli } = await import('./cli/cloud-chat.js');
-            await startCloudChatCli({
-                cloudAgentId: String(opts.cloudAgent),
-                ...(initialPrompt ? { initialPrompt } : {}),
-                ...(opts.resume ? { resume: String(opts.resume) } : {}),
-                ...(opts.continue ? { continueMostRecent: true } : {}),
-            });
-            safeExit('main', 0);
-        }
-        catch (err) {
-            if (err instanceof ExitSignal)
-                throw err;
-            console.error(`❌ Cloud chat failed: ${err}`);
-            safeExit('main', 1, 'cloud-chat-error');
-        }
-    }
     // ——— Infer provider & API key from model ———
     if (opts.model) {
         if (opts.model.includes('/')) {
@@ -668,14 +631,11 @@ program
             const authCheck = await checkDextoAuthState(opts.interactive !== false, agentId);
             if (!authCheck.shouldContinue) {
                 if (authCheck.action === 'login') {
-                    // User wants to log in - run login flow then restart
-                    const { handleLoginCommand } = await import('./cli/commands/auth/login.js');
-                    await handleLoginCommand();
-                    // Verify key was actually provisioned (provisionKeys silently catches errors)
-                    const { canUseDextoProvider } = await import('./cli/utils/dexto-setup.js');
+                    const { canUseDextoProvider, signInForDextoModels } = await import('./cli/utils/dexto-setup.js');
+                    await signInForDextoModels();
                     if (!(await canUseDextoProvider())) {
-                        console.error('\n❌ API key provisioning failed. Please try again or run `dexto setup` to use a different provider.\n');
-                        safeExit('main', 1, 'dexto-key-provisioning-failed');
+                        console.error("\n❌ Signed in, but Dexto models can't run yet: allow spending credits when asked, or run `dexto setup` to use a different provider.\n");
+                        safeExit('main', 1, 'dexto-models-not-ready');
                     }
                     // After login, continue with startup (preferences unchanged, now authenticated)
                 }
@@ -777,6 +737,8 @@ program
             logLevel: 'info', // CLI uses info-level logging for visibility
             workspaceRoot,
         });
+        // Signed in: the session gets the Dexto MCP's tools beside the person's own servers.
+        enrichedConfig.mcpServers = dextoMcp.withDextoMcpServer(enrichedConfig.mcpServers, await dextoMcp.dextoMcpServer(dextoGateway.defaultDextoGatewayOptions()));
         // Validate enriched config + preflight credentials.
         // - Interactive modes (web/cli): warn and continue when credentials are missing
         // - Headless modes (server/mcp): treat missing credentials as errors
@@ -855,11 +817,13 @@ program
         // isInteractiveMode is already defined above for validateAgentConfig
         const { createFileSessionLoggerFactory } = await import('./utils/session-logger-factory.js');
         const sessionLoggerFactory = createFileSessionLoggerFactory();
-        const mcpAuthProviderFactory = opts.mode === 'cli'
+        // The Dexto MCP authorizes with the sign-in in every mode; other servers' own
+        // OAuth needs the interactive CLI.
+        const mcpAuthProviderFactory = dextoMcp.withDextoMcpAuth(opts.mode === 'cli'
             ? (await import('./cli/mcp/oauth-factory.js')).createMcpAuthProviderFactory({
                 logger,
             })
-            : null;
+            : null, dextoGateway.defaultDextoGatewayOptions());
         const services = await resolveServicesFromConfig(validatedConfig, image, {
             workspaceRoot,
         });
@@ -916,4 +880,19 @@ program
     });
 }, { timeoutMs: 0 }));
 // 14) PARSE & EXECUTE
-program.parseAsync(process.argv);
+// `dexto --help --json`: the commands and exit codes as JSON, for agents.
+// Internal inventory entry point for the repository build check.
+if (process.argv.slice(2).length === 1 && process.argv[2] === '--audit-agent-cli') {
+    const [{ auditProgram }, { cloudCommands }] = await Promise.all([
+        import('./cli/agent-audit.js'),
+        import('./cli/cloud/host.js'),
+    ]);
+    const commands = cloudCommands('', async () => {
+        throw new Error('Audit cannot sign in');
+    });
+    process.stdout.write(`${JSON.stringify(auditProgram(program, commands), null, 2)}\n`);
+}
+else if (isRootJsonHelp(process.argv.slice(2)))
+    process.stdout.write(`${JSON.stringify(rootHelpJson(program), null, 2)}\n`);
+else
+    program.parseAsync(process.argv);