klyro 0.1.47 → 0.1.48

package/dist/agent/registry.js

@@ -16,6 +16,9 @@
  * The result is wrapped in retryingAdapter by default. Pass
  * { retry: false } to skip.
  */
+import * as fsSync from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 import { httpChatAdapter } from './provider-adapter.js';
 import { anthropicAdapter } from './anthropic-adapter.js';
 import { retryingAdapter } from './retry.js';
@@ -63,9 +66,57 @@ function normalizeProviderName(name) {
         return lower;
     return PROVIDER_ALIASES[lower];
 }
+/**
+ * Persisted provider settings (sync read — for CLIs that must not go async).
+ * Env still wins; ~/.klyro/settings.json + credentials are the fallback so
+ * `klyro run` works in fresh terminals with zero env vars.
+ *
+ * Reads the files directly (no module imports) to avoid any import cycle
+ * between agent/ and cli/ layers.
+ */
+function persistedProviderSettings() {
+    try {
+        const home = process.env.KLYRO_CONFIG_DIR ?? (os.homedir() || process.cwd());
+        const cfgPaths = process.env.KLYRO_CONFIG
+            ? [process.env.KLYRO_CONFIG]
+            : [path.join(home, '.klyro', 'settings.json'), path.join(home, '.klyro', 'config.json')];
+        let cfg = {};
+        for (const p of cfgPaths) {
+            try {
+                const parsed = JSON.parse(fsSync.readFileSync(p, 'utf-8'));
+                if (parsed && typeof parsed === 'object') {
+                    cfg = parsed;
+                    break;
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+        const credFile = process.env.KLYRO_CREDENTIALS_FILE ?? path.join(home, '.klyro', 'credentials.json');
+        let creds = {};
+        try {
+            creds = JSON.parse(fsSync.readFileSync(credFile, 'utf-8'));
+        }
+        catch { /* none */ }
+        const keyOf = (p) => typeof creds[p] === 'string' && creds[p].length > 0 ? creds[p] : undefined;
+        const baseURL = (cfg.baseUrl ?? cfg.baseURL);
+        const provider = cfg.provider;
+        const model = (cfg.model ?? cfg['model.default']);
+        const apiKey = (cfg.apiKey ?? cfg.api_key) ??
+            (provider ? keyOf(provider) : undefined) ??
+            keyOf('openai') ??
+            keyOf('anthropic');
+        return { baseURL, apiKey, provider, model };
+    }
+    catch {
+        return {};
+    }
+}
 export function buildProvider(opts = {}) {
-    const baseURL = opts.baseURL ?? process.env.KLYRO_BASE_URL;
-    const apiKey = opts.apiKey ?? process.env.KLYRO_API_KEY;
+    const saved = persistedProviderSettings();
+    const baseURL = opts.baseURL ?? process.env.KLYRO_BASE_URL ?? saved.baseURL;
+    const apiKey = opts.apiKey ?? process.env.KLYRO_API_KEY ?? saved.apiKey;
     const timeoutMs = opts.timeoutMs ?? 60_000;
     // Resolve provider (with aliases like 9router -> openrouter -> openai)
     let provider;

package/dist/cli/auth.d.ts

@@ -2,6 +2,20 @@
  * 2.2 — klyro login / logout / aliases
  * Stores masked key → ~/.klyro/credentials.json 0600
  */
+export declare function credPath(): string;
+/** Persist one provider key (0600). Never logs or returns the key. */
+export declare function saveKey(provider: string, key: string): Promise<void>;
+/** Which providers have stored keys (names only — never values). */
+export declare function storedProviders(): string[];
+export declare const LOGIN_DEFAULTS: Record<string, {
+    baseUrl: string;
+    model: string;
+}>;
+/**
+ * `klyro login` — full one-time setup. Persists provider + base URL + model
+ * to ~/.klyro/settings.json and the key to ~/.klyro/credentials.json (0600),
+ * so every future terminal picks them up with no env vars.
+ */
 export declare function runLogin(): Promise<number>;
 export declare function runLogout(provider?: string): Promise<number>;
 export declare function getStoredKey(provider: string): string | undefined;

package/dist/cli/auth.js

@@ -3,37 +3,82 @@
  * Stores masked key → ~/.klyro/credentials.json 0600
  */
 import * as fs from 'node:fs/promises';
+import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import * as readline from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
-function credPath() {
+export function credPath() {
+    // KLYRO_CREDENTIALS_FILE override exists for tests; real users get ~/.klyro/credentials.json.
+    if (process.env.KLYRO_CREDENTIALS_FILE)
+        return process.env.KLYRO_CREDENTIALS_FILE;
     const home = os.homedir() || process.cwd();
     return path.join(home, '.klyro', 'credentials.json');
 }
+/** Persist one provider key (0600). Never logs or returns the key. */
+export async function saveKey(provider, key) {
+    const creds = {};
+    try {
+        const raw = await fs.readFile(credPath(), 'utf-8');
+        Object.assign(creds, JSON.parse(raw));
+    }
+    catch { /* ignore */ }
+    creds[provider] = key.trim();
+    await fs.mkdir(path.dirname(credPath()), { recursive: true });
+    await fs.writeFile(credPath(), JSON.stringify(creds, null, 2), { mode: 0o600 });
+    try {
+        await fs.chmod(credPath(), 0o600);
+    }
+    catch { /* ignore on Windows */ }
+}
+/** Which providers have stored keys (names only — never values). */
+export function storedProviders() {
+    try {
+        const raw = fsSync.readFileSync(credPath(), 'utf-8');
+        const creds = JSON.parse(raw);
+        return Object.keys(creds).filter((k) => typeof creds[k] === 'string' && creds[k].length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+export const LOGIN_DEFAULTS = {
+    openai: { baseUrl: 'https://api.openai.com/v1', model: 'gpt-4o-mini' },
+    anthropic: { baseUrl: 'https://api.anthropic.com/v1', model: 'claude-3-5-sonnet-20240620' },
+    local: { baseUrl: 'http://localhost:11434/v1', model: 'llama3.2' },
+};
+/**
+ * `klyro login` — full one-time setup. Persists provider + base URL + model
+ * to ~/.klyro/settings.json and the key to ~/.klyro/credentials.json (0600),
+ * so every future terminal picks them up with no env vars.
+ */
 export async function runLogin() {
     const rl = readline.createInterface({ input: stdin, output: stdout });
     try {
-        const provider = (await rl.question('Provider (anthropic/openai) [openai]: ')) || 'openai';
-        const key = await rl.question('API key (input hidden, paste): ');
-        if (!key.trim()) {
+        const providerRaw = (await rl.question('Provider (openai/anthropic/local) [openai]: ')) || 'openai';
+        const provider = providerRaw.trim().toLowerCase();
+        const defs = LOGIN_DEFAULTS[provider] ?? LOGIN_DEFAULTS.openai;
+        const keyPrompt = provider === 'local' ? 'API key (empty for local Ollama): ' : 'API key (paste): ';
+        const key = await rl.question(keyPrompt);
+        if (!key.trim() && provider !== 'local') {
             process.stderr.write('No key provided\n');
             return 2;
         }
-        const creds = {};
-        try {
-            const raw = await fs.readFile(credPath(), 'utf-8');
-            Object.assign(creds, JSON.parse(raw));
-        }
-        catch { /* ignore */ }
-        creds[provider] = key.trim();
-        await fs.mkdir(path.dirname(credPath()), { recursive: true });
-        await fs.writeFile(credPath(), JSON.stringify(creds, null, 2), { mode: 0o600 });
-        try {
-            await fs.chmod(credPath(), 0o600);
+        const baseUrl = ((await rl.question(`Base URL [${defs.baseUrl}]: `)) || defs.baseUrl).trim();
+        const model = ((await rl.question(`Model [${defs.model}]: `)) || defs.model).trim();
+        const storeProvider = provider === 'local' ? 'openai' : provider;
+        if (key.trim()) {
+            await saveKey(storeProvider, key);
+            process.stdout.write(`Saved ${storeProvider} key to ${credPath()} (0600)\n`);
         }
-        catch { /* ignore on Windows */ }
-        process.stdout.write(`Saved ${provider} key to ${credPath()} (0600)\n`);
+        // Persist non-secret settings (merged with existing config, never clobbers).
+        const { loadConfig, saveConfig } = await import('./config.js');
+        const cfg = await loadConfig();
+        cfg.provider = storeProvider;
+        cfg.baseUrl = baseUrl;
+        cfg.model = model;
+        await saveConfig(cfg);
+        process.stdout.write(`Saved provider settings (applies to all terminals — no env vars needed)\n`);
         return 0;
     }
     finally {
@@ -63,9 +108,10 @@ export async function runLogout(provider) {
 }
 export function getStoredKey(provider) {
     try {
-        const raw = require('node:fs').readFileSync(credPath(), 'utf-8');
+        const raw = fsSync.readFileSync(credPath(), 'utf-8');
         const creds = JSON.parse(raw);
-        return creds[provider];
+        const v = creds[provider];
+        return typeof v === 'string' && v.length > 0 ? v : undefined;
     }
     catch {
         return undefined;

package/dist/cli/config.d.ts

@@ -7,8 +7,8 @@ import { z } from 'zod';
 export declare const ConfigSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodString>;
     provider: z.ZodOptional<z.ZodEnum<{
-        anthropic: "anthropic";
         openai: "openai";
+        anthropic: "anthropic";
     }>>;
     baseUrl: z.ZodOptional<z.ZodString>;
     apiKey: z.ZodOptional<z.ZodString>;
@@ -31,6 +31,7 @@ declare function setByPath(obj: Record<string, unknown>, dotted: string, value:
 declare function deleteByPath(obj: Record<string, unknown>, dotted: string): boolean;
 declare function parseValue(raw: string): unknown;
 export declare function loadConfig(): Promise<Record<string, unknown>>;
+export declare function loadConfigSync(): Record<string, unknown>;
 export declare function loadMergedConfig(cwd?: string, flags?: Record<string, unknown>): Promise<Record<string, unknown>>;
 export declare function saveConfig(obj: Record<string, unknown>): Promise<void>;
 export declare function runConfig(args: string[]): Promise<number>;

package/dist/cli/config.js

@@ -217,6 +217,26 @@ export async function loadConfig() {
     }
     return {};
 }
+// --- Synchronous single-file load (for sync call sites like buildProvider) ---
+export function loadConfigSync() {
+    const files = [getConfigPath(), getLegacyConfigPath()];
+    for (const file of files) {
+        try {
+            const raw = fsSync.readFileSync(file, 'utf-8');
+            const obj = parseJsonc(raw, file);
+            return validateConfig(obj, file);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code === 'ENOENT')
+                continue;
+            // Corrupt config must not crash provider resolution — ignore here
+            // (klyro config/doctor surface the error properly).
+            return {};
+        }
+    }
+    return {};
+}
 // --- Merged load with 5-layer precedence ---
 export async function loadMergedConfig(cwd = process.cwd(), flags = {}) {
     const layers = [];

package/dist/cli/repl.js

@@ -6,6 +6,8 @@
  * via the global hooks installed by App.useEffect.
  */
 import React from 'react';
+import * as fsSync from 'node:fs';
+import * as nodePath from 'node:path';
 import { render } from 'ink';
 import { App } from '../tui/app.js';
 import { httpChatAdapter } from '../agent/provider-adapter.js';
@@ -28,16 +30,35 @@ export async function startRepl(opts = {}) {
     // Reuse the same provider resolution as legacy repl.ts — probes local
     // Ollama / LM Studio / vLLM when env is not fully set, so bare `klyro`
     // works with a local model just like `klyro chat` does.
-    const resolved = await resolveProvider();
+    let resolved = await resolveProvider();
     if (!resolved) {
-        process.stderr.write('klyro: no provider available.\n');
-        process.stderr.write(`  ${providerHelp(null)}\n`);
-        process.stderr.write('  Set KLYRO_BASE_URL and KLYRO_API_KEY, or run a local server (Ollama, LM Studio, vLLM).\n');
-        process.stderr.write('  Examples:\n');
-        process.stderr.write('    set KLYRO_BASE_URL=https://api.openai.com/v1\n');
-        process.stderr.write('    set KLYRO_API_KEY=sk-...\n');
-        process.stderr.write('    ollama serve   # then KLYRO_BASE_URL=http://localhost:11434/v1 KLYRO_MODEL=llama3.2\n');
-        return 2;
+        // First-run setup: ask ONCE (stdin is free — the Ink App is not mounted
+        // yet), persist to ~/.klyro, and continue. Every future terminal — this
+        // one, new windows, `klyro run` — picks it up with zero env vars.
+        const interactive = !opts.nonInteractive && (opts.forceTty || process.stdin.isTTY);
+        if (interactive) {
+            const { runFirstRunSetup } = await import('./setup.js');
+            const readline = await import('node:readline/promises');
+            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                const ans = await runFirstRunSetup((q) => rl.question(q));
+                if (!ans) {
+                    process.stderr.write('klyro: setup aborted — run `klyro login` when ready.\n');
+                    return 2;
+                }
+                process.stderr.write('klyro: saved — this and all future terminals will use it (change via /provider /model or `klyro config`).\n');
+            }
+            finally {
+                rl.close();
+            }
+            resolved = await resolveProvider();
+        }
+        if (!resolved) {
+            process.stderr.write('klyro: no provider available.\n');
+            process.stderr.write(`  ${providerHelp(null)}\n`);
+            process.stderr.write('  Run `klyro login` once (persists for all terminals), set KLYRO_BASE_URL and KLYRO_API_KEY, or run a local server (Ollama, LM Studio, vLLM).\n');
+            return 2;
+        }
     }
     const baseUrl = resolved.baseURL;
     const apiKey = resolved.apiKey;
@@ -215,12 +236,10 @@ export async function startRepl(opts = {}) {
             if (consoleRing.length > 200)
                 consoleRing.splice(0, consoleRing.length - 200);
             try {
-                const fs = require('node:fs');
-                const path = require('node:path');
                 const home = process.env.HOME ?? process.env.USERPROFILE ?? cwd;
-                const dir = path.join(home, '.klyro');
-                fs.mkdirSync(dir, { recursive: true });
-                fs.appendFileSync(path.join(dir, 'debug.log'), line + '\n');
+                const dir = nodePath.join(home, '.klyro');
+                fsSync.mkdirSync(dir, { recursive: true });
+                fsSync.appendFileSync(nodePath.join(dir, 'debug.log'), line + '\n');
             }
             catch { /* ignore */ }
         };
@@ -240,6 +259,20 @@ export async function startRepl(opts = {}) {
     patchConsole();
     installMouseTap();
     const EFFORT_STEPS = { low: 10, medium: 30, high: 50, max: 100 };
+    // Persisted provider settings: /model /provider write through to
+    // ~/.klyro/settings.json so new terminals inherit them. Touch flags keep
+    // /reload from clobbering explicit in-session switches.
+    let modelTouched = false;
+    let providerTouched = false;
+    async function persistProviderPatch(patch) {
+        try {
+            const { loadConfig, saveConfig } = await import('./config.js');
+            const cfg = await loadConfig();
+            Object.assign(cfg, patch);
+            await saveConfig(cfg);
+        }
+        catch { /* best-effort */ }
+    }
     // P1 session/permission state (commands.md Priority 1)
     let sessionLabel = '';
     let currentBranch = '';
@@ -276,10 +309,8 @@ export async function startRepl(opts = {}) {
     catch { /* best-effort */ }
     function persistMap(file, m) {
         try {
-            const fs = require('node:fs');
-            const path = require('node:path');
-            fs.mkdirSync(path.dirname(file), { recursive: true });
-            fs.writeFileSync(file, JSON.stringify(Object.fromEntries(m), null, 2), 'utf-8');
+            fsSync.mkdirSync(nodePath.dirname(file), { recursive: true });
+            fsSync.writeFileSync(file, JSON.stringify(Object.fromEntries(m), null, 2), 'utf-8');
         }
         catch { /* best-effort */ }
     }
@@ -804,8 +835,10 @@ export async function startRepl(opts = {}) {
                 }
                 else {
                     queuedStatus({ model: next });
-                    queuedAppend({ id: `mdl2-${Date.now()}`, kind: 'text', text: `model switched to ${next} (takes effect on next prompt)`, role: 'assistant' });
+                    queuedAppend({ id: `mdl2-${Date.now()}`, kind: 'text', text: `model switched to ${next} (saved — new terminals inherit it)`, role: 'assistant' });
                     model = next;
+                    modelTouched = true;
+                    await persistProviderPatch({ model: next });
                 }
                 return;
             }
@@ -823,7 +856,9 @@ export async function startRepl(opts = {}) {
                     }
                     currentProvider = next;
                     adapter = buildAdapter(currentProvider, currentBaseUrl, currentApiKey);
-                    queuedAppend({ id: `prov2-${Date.now()}`, kind: 'text', text: `provider switched to ${next} (takes effect on next prompt)`, role: 'assistant' });
+                    providerTouched = true;
+                    await persistProviderPatch({ provider: next });
+                    queuedAppend({ id: `prov2-${Date.now()}`, kind: 'text', text: `provider switched to ${next} (saved — new terminals inherit it)`, role: 'assistant' });
                 }
                 return;
             }
@@ -844,9 +879,15 @@ export async function startRepl(opts = {}) {
                 return;
             }
             case 'login': {
-                const { runLogin } = await import('./auth.js');
-                const code = await runLogin();
-                queuedAppend({ id: `login-${Date.now()}`, kind: 'text', text: code === 0 ? 'login saved (0600)' : 'login failed', role: 'assistant' });
+                // NOTE: readline login cannot run inside the TUI (Ink owns stdin —
+                // prompts would garble). Secrets must also never echo into the
+                // transcript, so login lives outside: run it once, /reload picks it up.
+                queuedAppend({
+                    id: `login-${Date.now()}`,
+                    kind: 'text',
+                    text: 'To sign in, run `klyro login` in any terminal (asks once, saves for all terminals), then /reload here.\n(Interactive prompts cannot run inside the TUI — Ink owns stdin.)',
+                    role: 'assistant',
+                });
                 return;
             }
             case 'logout': {
@@ -2022,11 +2063,37 @@ export async function startRepl(opts = {}) {
             }
             case 'reload': {
                 try {
+                    // Re-resolve the provider so `klyro login` (or config edits) in
+                    // another terminal take effect here. Explicit in-session switches
+                    // (/model, /provider) are never clobbered.
+                    const fresh = await resolveProvider();
+                    const notes = [];
+                    if (fresh) {
+                        if (!modelTouched && fresh.model && fresh.model !== model) {
+                            model = fresh.model;
+                            queuedStatus({ model });
+                            notes.push(`model → ${model}`);
+                        }
+                        if (!providerTouched) {
+                            const { inferProviderFromBaseURL: infer } = await import('../agent/registry.js');
+                            const prov = infer(fresh.baseURL);
+                            currentProvider = prov;
+                            currentBaseUrl = fresh.baseURL;
+                            currentApiKey = fresh.apiKey;
+                            adapter = buildAdapter(currentProvider, currentBaseUrl, currentApiKey);
+                            notes.push(`provider → ${prov} (${fresh.baseURL}, ${fresh.source})`);
+                        }
+                    }
                     const ctx = await buildLevel6Context({ cwd });
                     ctxPrefix = ctx.formatted ? `\n\n<context>\n${ctx.formatted}\n</context>` : '';
                     const md = await import('../context/klyro-md.js').then((m) => m.loadKlyroMd(cwd)).catch(() => '');
                     klyroBlock = md ? `\n\n<KLYRO.md>\n${md.slice(0, 4000)}\n</KLYRO.md>` : '';
-                    queuedAppend({ id: `reload-${Date.now()}`, kind: 'text', text: 'reloaded project context + KLYRO.md', role: 'assistant' });
+                    queuedAppend({
+                        id: `reload-${Date.now()}`,
+                        kind: 'text',
+                        text: notes.length > 0 ? `reloaded: ${notes.join(', ')} + project context + KLYRO.md` : 'reloaded project context + KLYRO.md (provider unchanged)',
+                        role: 'assistant',
+                    });
                 }
                 catch (err) {
                     queuedAppend({ id: `reload-err-${Date.now()}`, kind: 'error', message: String(err) });

package/dist/cli/setup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * First-run setup — "set once, works in every terminal".
+ *
+ * When Klyro starts with no provider anywhere (no env, no saved config, no
+ * stored keys, no local server), the TUI asks for provider details ONCE via
+ * readline (stdin is free — the Ink App is not mounted yet), persists them
+ * to ~/.klyro/settings.json + ~/.klyro/credentials.json (0600), and startup
+ * continues. The next terminal never asks again; changes happen explicitly
+ * via /provider, /model, `klyro login`, or `klyro config`.
+ *
+ * The `ask` callback is injected so this is unit-testable without a TTY.
+ */
+export interface SetupAnswers {
+    provider: 'openai' | 'anthropic';
+    baseUrl: string;
+    model: string;
+    keySaved: boolean;
+}
+/**
+ * Run the interactive setup. Returns answers, or null if the user aborted
+ * (empty provider choice) — the caller should exit(2) in that case.
+ */
+export declare function runFirstRunSetup(ask: (question: string) => Promise<string>): Promise<SetupAnswers | null>;

package/dist/cli/setup.js

@@ -0,0 +1,49 @@
+/**
+ * First-run setup — "set once, works in every terminal".
+ *
+ * When Klyro starts with no provider anywhere (no env, no saved config, no
+ * stored keys, no local server), the TUI asks for provider details ONCE via
+ * readline (stdin is free — the Ink App is not mounted yet), persists them
+ * to ~/.klyro/settings.json + ~/.klyro/credentials.json (0600), and startup
+ * continues. The next terminal never asks again; changes happen explicitly
+ * via /provider, /model, `klyro login`, or `klyro config`.
+ *
+ * The `ask` callback is injected so this is unit-testable without a TTY.
+ */
+import { LOGIN_DEFAULTS, saveKey } from './auth.js';
+import { loadConfig, saveConfig } from './config.js';
+import { assertSafeBaseURL } from '../chat.js';
+/**
+ * Run the interactive setup. Returns answers, or null if the user aborted
+ * (empty provider choice) — the caller should exit(2) in that case.
+ */
+export async function runFirstRunSetup(ask) {
+    const choiceRaw = await ask('No provider configured (one-time setup — saved for all terminals).\nProvider [1=openai-compatible, 2=anthropic, 3=local Ollama] [1]: ');
+    const choice = choiceRaw.trim() || '1';
+    if (choice !== '1' && choice !== '2' && choice !== '3')
+        return null;
+    const name = choice === '2' ? 'anthropic' : choice === '3' ? 'local' : 'openai';
+    const defs = LOGIN_DEFAULTS[name] ?? LOGIN_DEFAULTS.openai;
+    const key = await ask(name === 'local' ? 'API key (empty = none needed for local): ' : 'API key (paste, stored 0600): ');
+    if (!key.trim() && name !== 'local')
+        return null;
+    const baseRaw = await ask(`Base URL [${defs.baseUrl}]: `);
+    const baseUrl = (baseRaw.trim() || defs.baseUrl).trim();
+    try {
+        assertSafeBaseURL(baseUrl);
+    }
+    catch {
+        return null;
+    }
+    const modelRaw = await ask(`Model [${defs.model}]: `);
+    const model = (modelRaw.trim() || defs.model).trim();
+    const storeProvider = name === 'local' ? 'openai' : name;
+    if (key.trim())
+        await saveKey(storeProvider, key);
+    const cfg = await loadConfig();
+    cfg.provider = storeProvider;
+    cfg.baseUrl = baseUrl;
+    cfg.model = model;
+    await saveConfig(cfg);
+    return { provider: storeProvider, baseUrl, model, keySaved: key.trim().length > 0 };
+}

package/dist/providers.d.ts

@@ -15,9 +15,21 @@ export interface ProviderConfig {
     baseURL: string;
     apiKey: string;
     model: string;
-    source: 'env' | 'local-probe' | 'manual';
+    source: 'env' | 'config' | 'local-probe' | 'manual';
 }
-/** Resolve which provider to use. Does not throw; returns `null` if nothing is reachable. */
+/**
+ * Resolve which provider to use. Does not throw; returns `null` if nothing
+ * is reachable.
+ *
+ * Precedence (later lines are fallbacks, earlier wins):
+ *   1. KLYRO_BASE_URL env (+ KLYRO_API_KEY / KLYRO_MODEL)
+ *   2. Persisted config (~/.klyro/settings.json: baseUrl, provider, model,
+ *      apiKey) + stored credentials (~/.klyro/credentials.json) — set once
+ *      via `klyro login` or first-run setup, applies to ALL terminals.
+ *   3. KLYRO_API_KEY env alone (OpenAI default)
+ *   4. Stored credential keys alone (provider inferred from which key exists)
+ *   5. Local endpoint probe (Ollama / LM Studio / vLLM / llama.cpp)
+ */
 export declare function resolveProvider(): Promise<ProviderConfig | null>;
 /** Pretty-print a hint about how to configure the provider. */
 export declare function providerHelp(p: ProviderConfig | null): string;

package/dist/providers.js

@@ -18,7 +18,19 @@ const LOCAL_ENDPOINTS = [
     { name: 'vLLM', baseURL: 'http://localhost:8000/v1', defaultModel: 'meta-llama/Llama-3-8B-Instruct' },
     { name: 'llama.cpp', baseURL: 'http://localhost:8080/v1', defaultModel: 'local-model' },
 ];
-/** Resolve which provider to use. Does not throw; returns `null` if nothing is reachable. */
+/**
+ * Resolve which provider to use. Does not throw; returns `null` if nothing
+ * is reachable.
+ *
+ * Precedence (later lines are fallbacks, earlier wins):
+ *   1. KLYRO_BASE_URL env (+ KLYRO_API_KEY / KLYRO_MODEL)
+ *   2. Persisted config (~/.klyro/settings.json: baseUrl, provider, model,
+ *      apiKey) + stored credentials (~/.klyro/credentials.json) — set once
+ *      via `klyro login` or first-run setup, applies to ALL terminals.
+ *   3. KLYRO_API_KEY env alone (OpenAI default)
+ *   4. Stored credential keys alone (provider inferred from which key exists)
+ *   5. Local endpoint probe (Ollama / LM Studio / vLLM / llama.cpp)
+ */
 export async function resolveProvider() {
     const envBaseURL = process.env.KLYRO_BASE_URL;
     const envKey = process.env.KLYRO_API_KEY;
@@ -32,6 +44,62 @@ export async function resolveProvider() {
             source: 'env',
         };
     }
+    // Persisted config — the "set once, works in every terminal" layer.
+    try {
+        const { loadMergedConfig } = await import('./cli/config.js');
+        const { getStoredKey } = await import('./cli/auth.js');
+        const cfg = await loadMergedConfig(process.cwd(), {});
+        const cfgBase = (cfg.baseUrl ?? cfg.baseURL);
+        const cfgProvider = cfg.provider;
+        const cfgModel = (cfg.model ?? cfg['model.default']);
+        const cfgKey = (cfg.apiKey ?? cfg.api_key);
+        if (cfgBase) {
+            assertSafeBaseURL(cfgBase);
+            const key = envKey ?? cfgKey ?? getStoredKey(cfgProvider ?? 'openai') ?? getStoredKey('openai') ?? getStoredKey('anthropic') ?? '';
+            return {
+                baseURL: normalizeBaseURL(cfgBase),
+                apiKey: key,
+                model: envModel ?? cfgModel ?? 'gpt-4o-mini',
+                source: 'config',
+            };
+        }
+        if (cfgKey) {
+            return {
+                baseURL: normalizeBaseURL('https://api.openai.com/v1'),
+                apiKey: cfgKey,
+                model: envModel ?? cfgModel ?? 'gpt-4o-mini',
+                source: 'config',
+            };
+        }
+        // Stored keys alone (e.g. `klyro login` with defaults, or key-only setup).
+        const anthropicKey = getStoredKey('anthropic');
+        const openaiKey = getStoredKey('openai');
+        if (cfgProvider === 'anthropic' && anthropicKey) {
+            return {
+                baseURL: normalizeBaseURL('https://api.anthropic.com/v1'),
+                apiKey: anthropicKey,
+                model: envModel ?? cfgModel ?? 'claude-3-5-sonnet-20240620',
+                source: 'config',
+            };
+        }
+        if (openaiKey) {
+            return {
+                baseURL: normalizeBaseURL('https://api.openai.com/v1'),
+                apiKey: openaiKey,
+                model: envModel ?? cfgModel ?? 'gpt-4o-mini',
+                source: 'config',
+            };
+        }
+        if (anthropicKey) {
+            return {
+                baseURL: normalizeBaseURL('https://api.anthropic.com/v1'),
+                apiKey: anthropicKey,
+                model: envModel ?? cfgModel ?? 'claude-3-5-sonnet-20240620',
+                source: 'config',
+            };
+        }
+    }
+    catch { /* corrupted config must not break startup; probe below */ }
     if (envKey) {
         return {
             baseURL: normalizeBaseURL('https://api.openai.com/v1'),
@@ -43,12 +111,25 @@ export async function resolveProvider() {
     // Probe local endpoints
     for (const ep of LOCAL_ENDPOINTS) {
         if (await probeLocal(ep.baseURL)) {
-            return {
-                baseURL: ep.baseURL,
-                apiKey: '',
-                model: envModel ?? ep.defaultModel,
-                source: 'local-probe',
-            };
+            try {
+                const { loadMergedConfig } = await import('./cli/config.js');
+                const cfg = await loadMergedConfig(process.cwd(), {});
+                const cfgModel = (cfg.model ?? cfg['model.default']);
+                return {
+                    baseURL: ep.baseURL,
+                    apiKey: '',
+                    model: envModel ?? cfgModel ?? ep.defaultModel,
+                    source: 'local-probe',
+                };
+            }
+            catch {
+                return {
+                    baseURL: ep.baseURL,
+                    apiKey: '',
+                    model: envModel ?? ep.defaultModel,
+                    source: 'local-probe',
+                };
+            }
         }
     }
     return null;
@@ -80,5 +161,8 @@ export function providerHelp(p) {
     if (p?.source === 'env') {
         return `(env: ${p.baseURL}, model: ${p.model})`;
     }
-    return `(no provider configured — set KLYRO_BASE_URL + KLYRO_API_KEY, or run a local server like Ollama)`;
+    if (p?.source === 'config') {
+        return `(saved: ${p.baseURL}, model: ${p.model} — change via /provider /model or klyro config)`;
+    }
+    return `(no provider configured — run klyro login once, or set KLYRO_BASE_URL + KLYRO_API_KEY, or run a local server like Ollama)`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "0.1.47",
+  "version": "0.1.48",
   "description": "Klyro \u2014 autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",