ghost-dragon 4.2.1

package/dist/commands/chat.d.ts

@@ -0,0 +1,22 @@
+/**
+ * dragon chat / dragon ask — the Dragon agent: a Claude-Code-style terminal
+ * coding agent that runs tools locally, reasons with a pluggable brain (Claude
+ * by default), and is wired into Wyrm long-term memory by default.
+ *
+ *   dragon chat                 interactive agent — edits files, runs commands,
+ *                               remembers across sessions via Wyrm
+ *   dragon ask "…"              one-shot (read-only unless --auto); pipeable
+ *
+ *   --brain claude|openai|local   reasoning model        (default: config/claude)
+ *   --model <id>                  override the model
+ *   --no-wyrm                     disable Wyrm memory for this run
+ *   --no-portal                   don't expose the hosted account assistant tool
+ *   --auto                        auto-approve file writes + shell (use with care)
+ *   --cwd <dir>                   run the agent against another directory
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+import type { Command } from 'commander';
+import { type DragonConfig } from '../config.js';
+export declare function registerChatCommands(program: Command, _config: DragonConfig): void;
+//# sourceMappingURL=chat.d.ts.map

package/dist/commands/chat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAsKxE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,QAmI3E"}

package/dist/commands/chat.js

@@ -0,0 +1,422 @@
+/**
+ * dragon chat / dragon ask — the Dragon agent: a Claude-Code-style terminal
+ * coding agent that runs tools locally, reasons with a pluggable brain (Claude
+ * by default), and is wired into Wyrm long-term memory by default.
+ *
+ *   dragon chat                 interactive agent — edits files, runs commands,
+ *                               remembers across sessions via Wyrm
+ *   dragon ask "…"              one-shot (read-only unless --auto); pipeable
+ *
+ *   --brain claude|openai|local   reasoning model        (default: config/claude)
+ *   --model <id>                  override the model
+ *   --no-wyrm                     disable Wyrm memory for this run
+ *   --no-portal                   don't expose the hosted account assistant tool
+ *   --auto                        auto-approve file writes + shell (use with care)
+ *   --cwd <dir>                   run the agent against another directory
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+import { loadConfig, saveConfig } from '../config.js';
+import { C, error, info, success } from '../utils.js';
+import { saveSession, loadLastSession, exportMarkdown } from '../agent/session.js';
+import { panel, chrome, kv, statusDot, tidyPath } from '../ui.js';
+import { getBrain, BrainConfigError } from '../brain/index.js';
+import { Wyrm } from '../wyrm/mcp.js';
+import { BWRAP } from '../agent/tools.js';
+import { runAgent, buildSystemPrompt, buildToolSpecs } from '../agent/loop.js';
+import { recordTurn, traceEnabled } from '../agent/trace.js';
+import { loadSkillLibrary } from '../agent/skills.js';
+import { makeStackTools } from '../agent/stack.js';
+import { loadMcpHub } from '../agent/mcp.js';
+import { makeTaskTool } from '../agent/task.js';
+import { resolveAuth } from '../auth.js';
+import { streamAgent, AgentError, SURFACES } from '../agent.js';
+import { readFileSync, existsSync } from 'node:fs';
+import { createInterface } from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+function expandFileRefs(text) {
+    return text.replace(/@(\S+)/g, (match, path) => {
+        if (path === '-' || !existsSync(path))
+            return match;
+        try {
+            return `\n\n--- ${path} ---\n${readFileSync(path, 'utf-8')}\n--- end ${path} ---\n\n`;
+        }
+        catch {
+            return match;
+        }
+    });
+}
+async function readStdinAll() {
+    const chunks = [];
+    for await (const c of stdin)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString('utf-8');
+}
+/** The hosted account.ghosts.lk assistant, exposed to the agent as one tool. */
+function makePortalTool() {
+    if (resolveAuth().mode === 'none')
+        return null;
+    const spec = {
+        name: 'portal_ask',
+        description: "Ask the Ghost Protocol account portal assistant about the operator's licenses, product catalog, security services/pricing, or to book an engagement. Account/business questions only — not coding.",
+        parameters: { type: 'object', properties: { question: { type: 'string' }, surface: { type: 'string', enum: [...SURFACES] } }, required: ['question'] },
+    };
+    return {
+        spec,
+        async call(args) {
+            const surface = SURFACES.includes(String(args.surface)) ? String(args.surface) : 'dashboard';
+            try {
+                return await streamAgent({ messages: [{ role: 'user', content: String(args.question ?? '') }], surface, onDelta: () => { } });
+            }
+            catch (e) {
+                return e instanceof AgentError ? `portal error: ${e.message}` : `portal error: ${String(e instanceof Error ? e.message : e)}`;
+            }
+        },
+    };
+}
+function hasKey(p) {
+    const cfg = loadConfig();
+    return p === 'anthropic' ? !!(process.env.ANTHROPIC_API_KEY || cfg.brain?.keys?.anthropic) : !!(process.env.OPENAI_API_KEY || cfg.brain?.keys?.openai);
+}
+/** First-launch model picker (interactive). Persists the choice to config. */
+async function runPicker() {
+    const signedIn = resolveAuth().mode !== 'none';
+    const ready = (ok, need) => (ok ? C.accent('● ready') : C.faint('○ ' + need));
+    console.log();
+    console.log(`  ${chrome("CHOOSE DRAGON'S BRAIN")}`);
+    console.log(`  ${C.faint('Tools always run locally — this only picks the reasoning model.')}`);
+    console.log();
+    console.log(`  ${C.accent('1')}  Cloudflare worker  ${C.faint('· free · our infra')}   ${ready(signedIn, 'needs `dragon login`')}`);
+    console.log(`  ${C.accent('2')}  Claude             ${C.faint('· best for code')}    ${ready(hasKey('anthropic'), 'needs ANTHROPIC_API_KEY')}`);
+    console.log(`  ${C.accent('3')}  Local Ollama       ${C.faint('· private · free')}`);
+    console.log(`  ${C.accent('4')}  OpenAI             ${C.faint('· hosted')}         ${ready(hasKey('openai'), 'needs OPENAI_API_KEY')}`);
+    console.log();
+    const rl = createInterface({ input: stdin, output: stdout });
+    let ans = '';
+    try {
+        ans = (await rl.question(`  ${C.accent('▸')} pick ${C.faint('[1-4, default 1]')} `)).trim();
+    }
+    finally {
+        rl.close();
+    }
+    const provider = { '1': 'worker', '2': 'claude', '3': 'local', '4': 'openai' }[ans] ?? 'worker';
+    const cfg = loadConfig();
+    cfg.brain = { ...(cfg.brain ?? {}), provider };
+    saveConfig(cfg);
+    info(`brain → ${C.accent(provider)}. Change anytime with ${C.info('dragon config brain <name>')}.`);
+}
+/** Resolve the brain: explicit --brain, else configured (with a first-launch picker),
+ *  else gracefully fall back to the free Cloudflare worker / local Ollama. */
+const HOSTED = ['claude', 'worker', 'openai'];
+async function chooseBrain(opts) {
+    const tryGet = (provider) => {
+        try {
+            return getBrain({ provider, model: opts.model });
+        }
+        catch (e) {
+            error(e instanceof BrainConfigError ? e.message : String(e instanceof Error ? e.message : e));
+            return null;
+        }
+    };
+    if (opts.sovereign) {
+        // local brain only — nothing leaves the host
+        if (opts.brain && HOSTED.includes(opts.brain))
+            info(`sovereign mode — ignoring hosted brain '${opts.brain}', using local.`);
+        return tryGet(opts.brain && !HOSTED.includes(opts.brain) ? opts.brain : 'local');
+    }
+    if (opts.brain)
+        return tryGet(opts.brain);
+    if (!loadConfig().brain?.provider && stdin.isTTY)
+        await runPicker();
+    try {
+        return getBrain({ model: opts.model });
+    }
+    catch (e) {
+        if (!(e instanceof BrainConfigError)) {
+            error(String(e instanceof Error ? e.message : e));
+            return null;
+        }
+        if (resolveAuth().mode !== 'none') {
+            info(`${e.provider} brain unavailable — using the free Cloudflare brain.`);
+            return getBrain({ provider: 'worker' });
+        }
+        info(`${e.provider} brain unavailable — using local Ollama. (Run \`dragon login\` for the free Cloudflare brain.)`);
+        return tryGet('local');
+    }
+}
+/** Build brain + wyrm + portal + system prompt. Returns null after printing on a brain config error. */
+async function setup(opts, announce) {
+    const brain = await chooseBrain(opts);
+    if (!brain)
+        return null;
+    const cwd = opts.cwd ? (opts.cwd.startsWith('/') ? opts.cwd : `${process.cwd()}/${opts.cwd}`) : process.cwd();
+    let wyrm = null;
+    let primed = null;
+    if (opts.wyrm !== false) {
+        wyrm = new Wyrm();
+        const ok = await wyrm.connect();
+        if (ok)
+            primed = await wyrm.prime(cwd);
+        else {
+            if (announce)
+                info('Wyrm memory unavailable — continuing without it.');
+            wyrm = null;
+        }
+    }
+    const portal = (opts.portal === false || opts.sovereign) ? null : makePortalTool();
+    const skills = loadSkillLibrary();
+    const stack = makeStackTools();
+    const mcp = await loadMcpHub(loadConfig().mcpServers);
+    if (mcp && announce)
+        info(`MCP: ${mcp.serverCount} server(s) connected (${mcp.toolSpecs().length} tools).`);
+    const task = makeTaskTool({ brain, skills, cwd });
+    const system = buildSystemPrompt({ cwd, wyrm: !!wyrm, portal: !!portal, brainId: `${brain.id}:${brain.model}`, skills: skills.count || undefined, primed });
+    return { brain, wyrm, portal, skills, stack, mcp, task, cwd, system, primed };
+}
+function banner(s, tools) {
+    const lines = [
+        kv('brain', C.info(`${s.brain.id}:${s.brain.model}`)),
+        kv('cwd', C.info(tidyPath(s.cwd))),
+        kv('state', `memory ${statusDot(!!s.wyrm)} ${s.wyrm ? C.info('wyrm') : C.faint('off')}   portal ${statusDot(!!s.portal)}   skills ${C.info(String(s.skills?.count ?? 0))}   tools ${C.info(String(tools.length))}`),
+    ];
+    console.log();
+    console.log(panel(lines, { title: chrome('DRAGON AGENT') }));
+    console.log(`  ${C.faint('/exit · /reset · /brain · /tools · /memory <q> · /auto · /plan · /save · @<file>')}`);
+}
+function makeRender() {
+    return {
+        onAssistantStart() { process.stdout.write(`\n  ${C.hot('◆')} `); },
+        onDelta(s) { process.stdout.write(s); },
+        onToolStart(summary) { process.stdout.write(`\n  ${C.faint('⚙ ' + summary)}`); },
+        onToolEnd(_summary, preview, ok) { process.stdout.write(`  ${ok ? C.accent('✓') : C.critical('✗')} ${C.faint(preview)}\n`); },
+    };
+}
+function makeApprove(rl, state) {
+    return async (summary, opts) => {
+        if (state.plan) {
+            console.log(`  ${C.faint('⊘ plan mode — declined: ' + summary)}`);
+            return false;
+        } // read-only
+        const dangerous = !!opts?.dangerous;
+        if (state.auto && !dangerous)
+            return true; // --auto covers safe in-cwd edits only — NEVER bash / outside-cwd
+        if (opts?.detail)
+            console.log('\n' + C.faint(opts.detail.split('\n').map((l) => '    ' + l).join('\n')));
+        const tag = dangerous ? C.critical('?') : C.accent('?');
+        const hint = dangerous ? (state.auto ? '[y/N — auto-approve does NOT cover this]' : '[y/N]') : '[y/N/a=always-safe]';
+        const ans = (await rl.question(`\n  ${tag} ${summary}  ${C.faint(hint)} `)).trim().toLowerCase();
+        if (ans === 'a' && !dangerous) {
+            state.auto = true;
+            return true;
+        }
+        return ans === 'y' || ans === 'yes';
+    };
+}
+export function registerChatCommands(program, _config) {
+    program
+        .command('chat')
+        .description('Dragon agent — codes, runs tools, remembers via Wyrm (interactive)')
+        .option('--brain <provider>', 'reasoning brain: claude | worker | local | openai | ghost')
+        .option('--model <id>', 'override the model id')
+        .option('--no-wyrm', 'disable Wyrm long-term memory for this session')
+        .option('--no-portal', "don't expose the hosted account assistant as a tool")
+        .option('--auto', 'auto-approve file writes + shell commands', false)
+        .option('--plan', 'read-only: the agent explores but makes no writes/shell', false)
+        .option('--sovereign', 'local brain + Wyrm only — nothing leaves the host', false)
+        .option('--sandbox', 'run shell in a bwrap jail (cwd writable, rest read-only)', false)
+        .option('--no-trace', 'do not record tool-use traces for DragonSpark training')
+        .option('--resume', 'resume the previous session', false)
+        .option('--cwd <dir>', 'run against a different working directory')
+        .action(async (opts) => {
+        const s = await setup(opts, true);
+        if (!s) {
+            process.exitCode = 1;
+            return;
+        }
+        const rl = createInterface({ input: stdin, output: stdout, terminal: stdin.isTTY === true });
+        const state = { auto: !!opts.auto, plan: !!opts.plan };
+        const toolCtx = { cwd: s.cwd, approve: makeApprove(rl, state), sandbox: !!opts.sandbox };
+        const messages = [];
+        if (opts.resume) {
+            const prior = loadLastSession();
+            if (prior) {
+                messages.push(...prior);
+                info(`resumed ${prior.length} messages from your last session`);
+            }
+            else
+                info('no previous session to resume');
+        }
+        const deps = { ...s, toolCtx, messages };
+        const render = makeRender();
+        banner(s, buildToolSpecs(s));
+        if (state.plan)
+            info('plan mode ON — read-only: the agent explores but makes no writes/shell (/plan to toggle).');
+        else if (state.auto)
+            info('auto-approve ON — safe in-cwd writes run without asking (bash still prompts).');
+        if (opts.sovereign)
+            info('sovereign mode — local brain + Wyrm only; nothing leaves the host.');
+        if (opts.sandbox)
+            info(BWRAP ? 'sandbox ON — shell runs in bwrap (cwd writable, secrets masked, network shared).' : 'sandbox requested but bwrap not found — shell runs unsandboxed (approval still applies).');
+        if (traceEnabled(opts.trace === false))
+            info('flywheel ON — turns logged to ~/.dragon/traces for DragonSpark (--no-trace to disable).');
+        let aborter = null;
+        const onSigint = () => { if (aborter) {
+            aborter.abort();
+            aborter = null;
+        }
+        else {
+            void cleanup().then(() => process.exit(0));
+        } };
+        const cleanup = async () => { process.off('SIGINT', onSigint); rl.close(); saveSession(messages, { cwd: s.cwd, brain: `${s.brain.id}:${s.brain.model}` }); await s.wyrm?.close(); await s.mcp?.close(); };
+        process.on('SIGINT', onSigint);
+        for (;;) {
+            let userIn;
+            try {
+                userIn = (await rl.question(`${C.accent('▸')} `)).trim();
+            }
+            catch {
+                break;
+            }
+            if (!userIn)
+                continue;
+            if (userIn === '/exit' || userIn === '/quit')
+                break;
+            if (userIn === '/reset') {
+                messages.length = 0;
+                state.auto = false;
+                info('conversation reset · auto-approve re-armed');
+                continue;
+            }
+            if (userIn === '/auto') {
+                state.auto = !state.auto;
+                if (state.auto)
+                    state.plan = false;
+                info(`auto-approve ${state.auto ? 'ON' : 'OFF'}`);
+                continue;
+            }
+            if (userIn === '/plan') {
+                state.plan = !state.plan;
+                if (state.plan)
+                    state.auto = false;
+                info(`plan mode ${state.plan ? 'ON — read-only' : 'OFF'}`);
+                continue;
+            }
+            if (userIn === '/brain') {
+                console.log(`  ${C.faint('brain:')} ${C.info(s.brain.id + ':' + s.brain.model)}`);
+                continue;
+            }
+            if (userIn === '/tools') {
+                console.log('  ' + buildToolSpecs(s).map((t) => t.name).join('  '));
+                continue;
+            }
+            if (userIn === '/clear') {
+                console.clear();
+                banner(s, buildToolSpecs(s));
+                continue;
+            }
+            if (userIn.startsWith('/save')) {
+                success(`transcript → ${exportMarkdown(messages, userIn.slice(5).trim() || undefined)}`);
+                continue;
+            }
+            if (userIn.startsWith('/memory')) {
+                const q = userIn.slice(7).trim();
+                if (!s.wyrm) {
+                    error('Wyrm is off this session');
+                    continue;
+                }
+                if (!q) {
+                    info('usage: /memory <query>');
+                    continue;
+                }
+                console.log(C.faint(await s.wyrm.call('wyrm_recall', { query: q })));
+                continue;
+            }
+            if (userIn.startsWith('/')) {
+                error(`unknown command ${userIn}`);
+                continue;
+            }
+            aborter = new AbortController();
+            const before = messages.length;
+            try {
+                await runAgent(deps, expandFileRefs(userIn), render, aborter.signal);
+                process.stdout.write('\n\n');
+                if (traceEnabled(opts.trace === false))
+                    recordTurn(messages.slice(before), { cwd: s.cwd, brain: `${s.brain.id}:${s.brain.model}`, context: s.primed });
+            }
+            catch (e) {
+                aborter = null;
+                if (e?.name === 'AbortError') {
+                    process.stdout.write(`\n  ${C.faint('⊘ interrupted')}\n\n`);
+                    continue;
+                }
+                process.stdout.write('\n');
+                if (e instanceof BrainConfigError)
+                    error(e.message);
+                else
+                    error(String(e instanceof Error ? e.message : e));
+            }
+            aborter = null;
+        }
+        await cleanup();
+    });
+    program
+        .command('ask [prompt...]')
+        .description('One-shot Dragon agent question (read-only unless --auto; pipeable)')
+        .option('--brain <provider>', 'reasoning brain: claude | worker | local | openai | ghost')
+        .option('--model <id>', 'override the model id')
+        .option('--no-wyrm', 'disable Wyrm memory')
+        .option('--no-portal', "don't expose the hosted account assistant")
+        .option('--auto', 'allow file writes + shell (off = read-only)', false)
+        .option('--plan', 'read-only (deny all writes/shell)', false)
+        .option('--sovereign', 'local brain + Wyrm only — nothing leaves the host', false)
+        .option('--sandbox', 'run shell in a bwrap jail', false)
+        .option('--no-trace', 'do not record a trace for DragonSpark training')
+        .option('--cwd <dir>', 'working directory')
+        .action(async (parts = [], opts) => {
+        let prompt = parts.join(' ').trim();
+        if (prompt === '-' || (!prompt && !stdin.isTTY))
+            prompt = (await readStdinAll()).trim();
+        if (!prompt) {
+            error('no prompt. Pass args, pipe stdin, or use "-".');
+            process.exit(1);
+        }
+        const s = await setup(opts, false);
+        if (!s) {
+            process.exit(1);
+        }
+        const denied = [];
+        const toolCtx = {
+            cwd: s.cwd,
+            sandbox: !!opts.sandbox,
+            approve: async (summary, o) => { if (opts.auto && !opts.plan && !o?.dangerous)
+                return true; denied.push(summary); return false; },
+        };
+        const messages = [];
+        const deps = { ...s, toolCtx, messages };
+        const render = {
+            onAssistantStart() { },
+            onDelta(t) { process.stdout.write(t); },
+            onToolStart(summary) { process.stderr.write(C.faint(`⚙ ${summary}\n`)); },
+            onToolEnd(_s, preview, ok) { process.stderr.write(C.faint(`  ${ok ? '✓' : '✗'} ${preview}\n`)); },
+        };
+        try {
+            await runAgent(deps, expandFileRefs(prompt), render, new AbortController().signal);
+            process.stdout.write('\n');
+            if (traceEnabled(opts.trace === false))
+                recordTurn(messages, { cwd: s.cwd, brain: `${s.brain.id}:${s.brain.model}`, context: s.primed });
+            if (denied.length)
+                process.stderr.write(C.faint(`\n(${denied.length} mutating action(s) skipped — re-run with --auto to allow)\n`));
+        }
+        catch (e) {
+            if (e instanceof BrainConfigError)
+                error(e.message);
+            else
+                error(String(e instanceof Error ? e.message : e));
+            await s.wyrm?.close();
+            await s.mcp?.close();
+            process.exit(1);
+        }
+        await s.wyrm?.close();
+    });
+}
+//# sourceMappingURL=chat.js.map

package/dist/commands/config.d.ts

@@ -0,0 +1,18 @@
+/**
+ * dragon config — inspect + set the agent's brain and credentials.
+ *
+ *   dragon config show
+ *   dragon config brain claude|openai|local
+ *   dragon config model claude-sonnet-4-6
+ *   dragon config local-model qwen2.5-coder:7b
+ *   dragon config key anthropic sk-ant-…      (stored in ~/.dragon/config.json, 0600)
+ *
+ * Env vars (ANTHROPIC_API_KEY / OPENAI_API_KEY / DRAGON_BRAIN / DRAGON_MODEL)
+ * always take precedence over stored config.
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+import type { Command } from 'commander';
+import { type DragonConfig } from '../config.js';
+export declare function registerConfigCommands(program: Command, _config: DragonConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/commands/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAkBxE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,QAsG7E"}

package/dist/commands/config.js

@@ -0,0 +1,136 @@
+/**
+ * dragon config — inspect + set the agent's brain and credentials.
+ *
+ *   dragon config show
+ *   dragon config brain claude|openai|local
+ *   dragon config model claude-sonnet-4-6
+ *   dragon config local-model qwen2.5-coder:7b
+ *   dragon config key anthropic sk-ant-…      (stored in ~/.dragon/config.json, 0600)
+ *
+ * Env vars (ANTHROPIC_API_KEY / OPENAI_API_KEY / DRAGON_BRAIN / DRAGON_MODEL)
+ * always take precedence over stored config.
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+import { loadConfig, saveConfig } from '../config.js';
+import { resolveProvider, PROVIDERS } from '../brain/index.js';
+import { resolveAuth } from '../auth.js';
+import { C, success, error } from '../utils.js';
+import { panel, chrome, statusDot } from '../ui.js';
+import { chmodSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+function lock() {
+    try {
+        chmodSync(join(homedir(), '.dragon', 'config.json'), 0o600);
+    }
+    catch { /* best-effort */ }
+}
+function redact(v) {
+    if (!v)
+        return C.faint('—');
+    return C.accent(`set (…${v.slice(-4)})`);
+}
+export function registerConfigCommands(program, _config) {
+    const cfg = program.command('config').description('Inspect + set the Dragon agent brain + credentials');
+    cfg
+        .command('show')
+        .description('Show current config (secrets redacted)')
+        .action(() => {
+        const c = loadConfig();
+        const a = resolveAuth();
+        console.log();
+        console.log(`  ${C.accent.bold('brain')}`);
+        console.log(`    provider:    ${C.info(resolveProvider())}  ${C.faint('(default')} ${C.faint(c.brain?.provider ?? 'claude')}${C.faint(')')}`);
+        console.log(`    model:       ${C.info(c.brain?.model ?? C.faint('default'))}`);
+        console.log(`    local model: ${C.info(c.brain?.localModel ?? 'qwen2.5-coder:7b')}  ${C.faint(c.brain?.localBaseURL ?? 'http://localhost:11434/v1')}`);
+        console.log(`    keys:        anthropic ${redact(process.env.ANTHROPIC_API_KEY ?? c.brain?.keys?.anthropic)}   openai ${redact(process.env.OPENAI_API_KEY ?? c.brain?.keys?.openai)}`);
+        console.log(`  ${C.accent.bold('portal')} (account.ghosts.lk)`);
+        console.log(`    endpoint:    ${C.info(a.apiBase)}`);
+        console.log(`    auth:        ${a.mode === 'none' ? C.faint('none') : C.accent(a.mode)}${a.email ? C.faint(' · ' + a.email) : ''}`);
+        console.log();
+    });
+    cfg
+        .command('brain <provider>')
+        .description(`Set the default reasoning brain: ${PROVIDERS.join(' | ')}`)
+        .action((provider) => {
+        const p = provider.toLowerCase();
+        if (!PROVIDERS.includes(p)) {
+            error(`unknown provider "${provider}". One of: ${PROVIDERS.join(', ')}`);
+            process.exitCode = 1;
+            return;
+        }
+        const c = loadConfig();
+        c.brain = { ...(c.brain ?? {}), provider: p };
+        saveConfig(c);
+        success(`default brain → ${p}`);
+    });
+    cfg
+        .command('model <id>')
+        .description('Set the hosted model id (claude/openai), e.g. claude-sonnet-4-6')
+        .action((id) => {
+        const c = loadConfig();
+        c.brain = { ...(c.brain ?? {}), model: id };
+        saveConfig(c);
+        success(`model → ${id}`);
+    });
+    cfg
+        .command('local-model <tag>')
+        .description('Set the local (Ollama) model tag, e.g. qwen2.5-coder:7b')
+        .action((tag) => {
+        const c = loadConfig();
+        c.brain = { ...(c.brain ?? {}), localModel: tag };
+        saveConfig(c);
+        success(`local model → ${tag}`);
+    });
+    cfg
+        .command('key <provider> <key>')
+        .description('Store an API key (anthropic | openai) in ~/.dragon/config.json (0600)')
+        .action((provider, key) => {
+        const p = provider.toLowerCase();
+        if (p !== 'anthropic' && p !== 'openai') {
+            error('provider must be "anthropic" or "openai"');
+            process.exitCode = 1;
+            return;
+        }
+        const c = loadConfig();
+        c.brain = { ...(c.brain ?? {}), keys: { ...(c.brain?.keys ?? {}), [p]: key } };
+        saveConfig(c);
+        lock();
+        success(`${p} key stored (config locked to 0600). Env vars still override.`);
+    });
+    cfg
+        .command('custom-url <url>')
+        .description('Set a custom OpenAI-compatible endpoint (OpenRouter / vLLM / LM Studio)')
+        .action((url) => { const c = loadConfig(); c.brain = { ...(c.brain ?? {}), customBaseURL: url }; saveConfig(c); success(`custom endpoint → ${url}  (use: dragon config brain custom)`); });
+    cfg
+        .command('custom-model <id>')
+        .description('Set the model id for the custom endpoint')
+        .action((id) => { const c = loadConfig(); c.brain = { ...(c.brain ?? {}), customModel: id }; saveConfig(c); success(`custom model → ${id}`); });
+    // `dragon brains` — the model picker, as a command.
+    program
+        .command('brains')
+        .description('List reasoning brains + which are ready (the model picker)')
+        .action(() => {
+        const c = loadConfig();
+        const a = resolveAuth();
+        const active = resolveProvider();
+        const hasA = !!(process.env.ANTHROPIC_API_KEY || c.brain?.keys?.anthropic);
+        const hasO = !!(process.env.OPENAI_API_KEY || c.brain?.keys?.openai);
+        const hasC = !!(process.env.DRAGON_OPENAI_BASE || c.brain?.customBaseURL);
+        const ollama = ['/usr/local/bin/ollama', '/usr/bin/ollama', join(homedir(), '.local/bin/ollama')].some((p) => existsSync(p));
+        const rows = [
+            ['claude', hasA, 'best for code', hasA ? '' : 'set ANTHROPIC_API_KEY'],
+            ['worker', a.mode !== 'none', 'free · our Cloudflare', a.mode !== 'none' ? '' : 'run `dragon login`'],
+            ['local', ollama, 'Ollama · private · free', ollama ? 'pull a model' : 'install Ollama'],
+            ['ghost', false, 'DragonSpark · our nano LLM', 'train + serve it'],
+            ['openai', hasO, 'GPT', hasO ? '' : 'set OPENAI_API_KEY'],
+            ['custom', hasC, 'any OpenAI-compatible endpoint', hasC ? '' : 'dragon config custom-url <url>'],
+        ];
+        const lines = rows.map(([id, ready, desc, need]) => `${id === active ? C.accent('▸') : ' '} ${statusDot(ready)} ${C.info(id.padEnd(7))} ${C.faint(desc)}${need ? C.faint('  · ' + need) : ''}`);
+        console.log();
+        console.log(panel(lines, { title: chrome('BRAINS') }));
+        console.log(`  ${C.faint('active:')} ${C.accent(active)}   ${C.faint('switch:')} dragon config brain <name>   ${C.faint('per-run:')} dragon chat --brain <name>`);
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/commands/doctor.d.ts

@@ -0,0 +1,11 @@
+/**
+ * dragon doctor — one-glance health check of everything the agent depends on:
+ * node, the active brain + readiness, auth, Wyrm memory, Ollama, the skill library,
+ * disk, and config-file permissions. Read-only; green/amber/red per check.
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+import type { Command } from 'commander';
+import { type DragonConfig } from '../config.js';
+export declare function registerDoctorCommands(program: Command, _config: DragonConfig): void;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAe5D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,QA8C7E"}