moderado 0.3.9 → 0.4.8

package/README.md

@@ -2,7 +2,7 @@
 
 > **A lightweight, provider-independent CLI coding agent with dynamic NVIDIA NIM discovery, free-first AUTO routing, and an uncompromised human-in-the-loop approval boundary.**
 
-[![Version](https://img.shields.io/badge/version-v0.3.0%2B2609221-blue.svg)](file:///d:/projects/moderado/VERSION)
+[![Latest release](https://img.shields.io/github/v/release/marcuz-apl/moderado)](https://github.com/marcuz-apl/moderado/releases/latest)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](file:///d:/projects/moderado/LICENSE)
 [![Standards: Alfazen](https://img.shields.io/badge/standard-alfazen--coding-green.svg)](https://github.com/marcuz-apl/alfazen-skills)
 
@@ -88,15 +88,18 @@ npm install -g moderado
 moderado --help
 ```
 
-moderado@0.3.0 is live on the public npm registry (latest tag points at 0.3.0).
+The latest published release is 0.4.8. Its `/login` command uses the Moderado
+Gateway for model routes and inference; `/connect` remains available for direct
+providers. The previous 0.3.10 release is self-contained and works without the
+Gateway. Both releases use the `moderado` command name.
+
+Install the latest release with `npm install -g moderado`. To stay on the
+self-contained 0.3.10 CLI, run `npm install -g moderado@0.3.10`.
+
 Any npm-compatible installer works (bun add -g moderado,
-pnpm add -g moderado, npx -y moderado@latest --help), and prebuilt
-dependency-free binaries (moderado-win-x64.exe, moderado-macos-arm64,
-moderado-linux-x64) are attached to the
-GitHub Release v0.3.0 at https://github.com/marcuz-apl/moderado/releases/tag/v0.3.0.
-The curl installer (`scripts/install.sh`, Linux x64 + macOS arm64), the
-Homebrew tap, and the Scoop bucket are available; the winget and AUR
-submissions are pending. See docs/DISTRIBUTION.md in the repository.
+pnpm add -g moderado, npx -y moderado@latest --help). Prebuilt binaries and the
+curl installer are documented in the root README. Windows installation options
+are npm and Scoop. See `docs/DISTRIBUTION.md` in the repository.
 To build from source instead:
 
 ```bash
@@ -111,44 +114,58 @@ Maintainers can install a verified release artifact directly with
 `npm install -g ./moderado-<version>.tgz`. See
 [docs/RELEASING.md](../../docs/RELEASING.md) for the review procedure.
 
-### Connect a provider
+### Connect to the Moderado Gateway
+
+Run `/login` in the TUI and choose the public Gateway for keyless inference.
+Browser authorization or a Moderado Cloud `mrd_` API key is optional for account
+features. `/model` lists configured Gateway routes: `auto` follows Gateway
+routing, while selecting a route pins requests to it. Existing BYOK and local
+provider profiles remain independent.
+
+Use `/connect` to connect directly to OpenRouter, NVIDIA NIM, Agnes AI,
+OrcaRouter, Ollama, LM Studio, or a custom OpenAI-compatible provider. `/login`
+selects the Moderado Gateway; `/connect` selects a direct provider.
+
+Cloud OAuth credentials last 30 days and have no refresh token; authorize again
+after expiry. On Windows, credentials are stored in Windows Credential Manager.
+On other platforms, the current credential store is memory-only, so log in again
+after starting a new CLI process.
 
-Open Moderado and use `/connect`. NVIDIA NIM is the default free-first provider;
-OpenRouter, Agnes AI, and compatible OpenAI-style endpoints are also supported.
-On Windows, newly saved provider keys go to Windows Credential Manager and
-`~/.moderado/config.json` retains only a credential reference. On other
-platforms, use an environment variable such as `NVIDIA_API_KEY` or
-`OPENROUTER_API_KEY`.
+Cloud connections use their configured Gateway URL. Loopback URLs such as
+`http://127.0.0.1:4788/v1` are treated as local development; HTTPS URLs for a
+NAS, VPS, or other remote host are used as configured. To set the URL before
+first login, define `MODERADO_CLOUD_BASE_URL`. `MODERADO_CLOUD_ENV=development`
+and `MODERADO_CLOUD_ENV=production` remain available as explicit overrides.
 
 Run `moderado doctor` to inspect local setup without exposing secrets. Add
 `--connectivity` only when you want an optional live model-catalog check.
 `npm test` never performs live provider calls.
 ## Getting Started & Development
 
-### Connect a provider in the TUI
+### Log in and select a model in the TUI
 
 Run `moderado` to open the TUI immediately. A fresh installation does not require
 an API key or a preselected model. The welcome card shows **No model connected —
-use `/connect`** until you add one.
+use `/login`** until you add one.
 
-Use `/connect` to add NVIDIA NIM. NVIDIA NIM starts with `AUTO` free-first
-routing, so choosing a model is optional; use `/model` later to pin one. Obtain
-an NVIDIA key from [build.nvidia.com](https://build.nvidia.com), or set it as
-`NVIDIA_API_KEY` before launching Moderado.
+Use `/login` for the public Moderado Gateway and `/model` to browse configured routes.
+Cloud `auto` follows the Gateway's configured pool; choosing a route in `/model`
+pins it for subsequent requests. Existing direct BYOK and local profiles remain
+available separately.
 
 ### Sessions and usage
 
 Moderado stores sessions per workspace in `~/.moderado/sessions/`. Use
 `/session` to create, resume, export, or compact a local conversation. Session
 exports redact recognized API-key prefixes. The status line uses only
-provider-reported token usage. It shows the calculated cost when the selected
-model exposes prompt and completion prices, and **Cost unknown** otherwise.
+provider-reported token usage. It shows `$0.00` for Moderado Cloud free routes,
+calculates cost when a model exposes prompt and completion prices, and shows
+**Cost unknown** when a metered model's pricing is unavailable.
 
-`/connect` also accepts an OpenAI-compatible base URL, API key, and explicit
-model ID for providers such as OpenRouter, Z.AI, DeepSeek, Moonshot, and
-Mistral. Compatibility depends on each provider supporting `/v1/models` and
-streaming `/v1/chat/completions` with tool calls. Provider credentials are saved
-in `~/.moderado/config.json`; protect that file and never commit it.
+Saved OpenAI-compatible profiles continue to support providers such as
+OpenRouter, Z.AI, DeepSeek, Moonshot, and Mistral. Compatibility depends on each
+provider supporting `/v1/models` and streaming `/v1/chat/completions` with tool
+calls. Cloud keys are never written in plaintext to `~/.moderado/config.json`.
 
 ### 1. Build & Test
 ```bash
@@ -213,4 +230,8 @@ Run `moderado doctor` to check the local Node runtime, workspace, Moderado home
 
 ## Windows credential storage
 
-On Windows, /connect saves provider API keys in Windows Credential Manager and stores only a provider credential reference in ~/.moderado/config.json. Existing plaintext keys remain usable for compatibility. Migrate them explicitly with moderado doctor --migrate-credentials; a failed migration leaves the existing configuration unchanged. On other platforms, set the provider environment variable (for example, NVIDIA_API_KEY or OPENROUTER_API_KEY).
+On Windows, `/login` stores Moderado Cloud credentials in Windows Credential
+Manager and keeps only a credential reference in `~/.moderado/config.json`.
+Non-Windows platforms use the current memory-only credential store, so log in
+again for each new CLI process. Existing BYOK environment variables and saved
+profiles remain independent.

package/dist/commands/chat.d.ts

@@ -10,7 +10,7 @@ export declare function formatSessionExitSummary(session: StoredSession, modelId
 export declare function createAgentTask(request: string, mode: 'Plan' | 'Execute'): string;
 export declare function createReviewTask(changedFiles: string[]): string;
 export declare function createReviewToolRegistry(): IToolRegistry;
-export declare const STANDARD_SLASH_COMMANDS: readonly ["/connect", "/model", "/init", "/btw", "/mcp", "/session", "/queue", "/workflow", "/review", "/map", "/budget", "/skills", "/clear", "/help", "/exit", "/quit"];
+export declare const STANDARD_SLASH_COMMANDS: readonly ["/connect", "/login", "/model", "/init", "/btw", "/mcp", "/session", "/queue", "/workflow", "/review", "/map", "/budget", "/skills", "/clear", "/help", "/exit", "/quit"];
 export declare function levenshteinDistance(a: string, b: string): number;
 export interface SlashCommandAdvice {
     isSlashCommand: boolean;
@@ -89,7 +89,7 @@ export declare function resolveLocalMetaQuery(input: string, context: LocalMetaQ
 export declare function shouldFastRouteWebSearch(input: string): boolean;
 /** Environment configuration overrides the optional persistent search endpoint. */
 export declare function resolveWebSearchEndpoint(config: ModeradoConfig): string | undefined;
-export declare function formatDirectWebSearchAnswer(result: ToolResult): string;
+export declare function formatDirectWebSearchAnswer(result: ToolResult, modelConnected?: boolean): string;
 /** Environment configuration overrides the persistent search provider preference. */
 export declare function resolveWebSearchProvider(config: ModeradoConfig): WebSearchProviderName | undefined;
 export declare function resolveWebSearchOptions(config: ModeradoConfig): WebSearchToolOptions;

package/dist/commands/chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAkG,kBAAkB,EAA0D,MAAM,iBAAiB,CAAC;AAC7M,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAoB,aAAa,EAAE,eAAe,EAAyB,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AAC3L,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAmC,cAAc,EAAkK,MAAM,cAAc,CAAC;AAU/O,OAAO,EAAyH,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACtK,OAAO,EAAkC,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQrG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAazF;AASD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGjF;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,IAAI,aAAa,CAQxD;AAED,eAAO,MAAM,uBAAuB,2KAiB1B,CAAC;AAEX,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAuBhE;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CA6D3E;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAC1D,OAAO,EAAE,MAAM,EACf,gBAAgB,GAAE,MAAM,EAAO,GAC9B,MAAM,CASR;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACnF,qBAAqB,EAAE,MAAM,EAC7B,cAAc,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACnD,cAAc,SAAK,EACnB,YAAY,SAAY,EACxB,gBAAgB,GAAE,MAAM,EAAO,GAC9B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAiBtC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGzF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/F;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,KAAK,CAAM;IAEnB,IAAI,KAAK,IAAI,SAAS,MAAM,EAAE,CAE7B;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAO3B,KAAK,IAAI,MAAM,GAAG,SAAS;IAI3B,KAAK,IAAI,IAAI;IAKb,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI5B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,cAAc,IAAI,IAAI;IAMtB,WAAW,IAAI,MAAM,GAAG,SAAS;CASlC;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EACnF,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,IAAI,CAiDN;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,OAAO,CAIrG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAaxD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa3D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIxD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CA6BvG;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CASnF;AAKD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAQtE;AACD,qFAAqF;AACrF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,qBAAqB,GAAG,SAAS,CAGlG;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,oBAAoB,CAEpF;AAED,8GAA8G;AAC9G,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAMlF;AAID,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAElH;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,0BAA0B,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC3G;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,qBAAqB,EAC9B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,EAAE,SAAS,GAAE,oBAAyB,GAAG,OAAO,CAAC,aAAa,CAAC,CAE9J;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5D,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,eAAe,CAAC;IACzC,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAChD;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,IAAI,EACzC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC9F,QAAQ,EAAE,aAAa,GAAG,SAAS,EACnC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1E,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,CAAC,EAAE,WAAW,GACtB,OAAO,CAAC,IAAI,CAAC,CAoGf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAy4BnH"}
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAkG,kBAAkB,EAA0D,MAAM,iBAAiB,CAAC;AAC7M,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAoB,aAAa,EAAE,eAAe,EAAyB,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AAC3L,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAuD,cAAc,EAA+L,MAAM,cAAc,CAAC;AAUhS,OAAO,EAAyH,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACtK,OAAO,EAAkC,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQrG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAazF;AASD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGjF;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,IAAI,aAAa,CAQxD;AAED,eAAO,MAAM,uBAAuB,qLAkB1B,CAAC;AAEX,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAuBhE;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CA6D3E;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAC1D,OAAO,EAAE,MAAM,EACf,gBAAgB,GAAE,MAAM,EAAO,GAC9B,MAAM,CASR;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACnF,qBAAqB,EAAE,MAAM,EAC7B,cAAc,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACnD,cAAc,SAAK,EACnB,YAAY,SAAY,EACxB,gBAAgB,GAAE,MAAM,EAAO,GAC9B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAiBtC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGzF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/F;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,KAAK,CAAM;IAEnB,IAAI,KAAK,IAAI,SAAS,MAAM,EAAE,CAE7B;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAO3B,KAAK,IAAI,MAAM,GAAG,SAAS;IAI3B,KAAK,IAAI,IAAI;IAKb,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI5B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,cAAc,IAAI,IAAI;IAMtB,WAAW,IAAI,MAAM,GAAG,SAAS;CASlC;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EACnF,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,GACA,IAAI,CAiDN;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,OAAO,CAIrG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAaxD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAa3D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIxD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CA6BvG;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CASnF;AAKD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,UAAQ,GAAG,MAAM,CAQ9F;AACD,qFAAqF;AACrF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,qBAAqB,GAAG,SAAS,CAGlG;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,oBAAoB,CAEpF;AAED,8GAA8G;AAC9G,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAMlF;AAID,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAElH;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,0BAA0B,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC3G;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,qBAAqB,EAC9B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,EAAE,SAAS,GAAE,oBAAyB,GAAG,OAAO,CAAC,aAAa,CAAC,CAE9J;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5D,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,eAAe,CAAC;IACzC,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAChD;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,IAAI,EACzC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC9F,QAAQ,EAAE,aAAa,GAAG,SAAS,EACnC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1E,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,CAAC,EAAE,WAAW,GACtB,OAAO,CAAC,IAAI,CAAC,CAoGf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CA28BnH"}

package/dist/commands/chat.js

@@ -5,20 +5,20 @@ import { AgentLoop, PolicyManager, Router, cleanConversationalFiller, DEFAULT_MA
 import { NvidiaAdapter } from '../vendor/providers/index.js';
 import { createDefaultToolRegistry, ToolRegistry, canonicalizeRoot, createMcpTools, createWebSearchTool, discoverMcpServers, resolveInJail, WorkspaceCheckpointStore, WriteFileTool } from '../vendor/tools/index.js';
 import { McpServerConfigSchema } from '../vendor/contracts/index.js';
-import { getActiveConnection, loadConfig, removeMcpServer, resolveApiKey, resolveConnectionCredential, saveConnection, saveMcpServer, setMcpServerEnabled, storeConnectionCredential } from '../config.js';
+import { freeModelPolicyFor, getActiveConnection, loadConfig, removeMcpServer, requiresCredentialReference, resolveApiKey, resolveConnectionCredential, saveConnection, saveMcpServer, setMcpServerEnabled, storeConnectionCredential } from '../config.js';
 import { MemoryCredentialStore } from '../credentials.js';
 import { WindowsCredentialStore } from '../windows_credentials.js';
 import { TerminalApprovalHandler } from '../ui/terminal_approval.js';
 import { selectCompatibleModelOverlay, selectModelOverlay, showModelConnectionRequired } from '../ui/model_selector.js';
-import { connectProviderInteractive, isAuthenticationFailure, replaceProviderKeyInteractive } from '../ui/provider_connect.js';
+import { connectProviderInteractive, isAuthenticationFailure, isModeradoCloudOAuthConnection, loginModeradoCloudInteractive, replaceProviderKeyInteractive } from '../ui/provider_connect.js';
 import { initWorkspace } from './init.js';
 import { expandMentions, createWorkspaceFileSource } from '../ui/file_mentions.js';
 import { listFiles } from '../vendor/tools/index.js';
-import { exitCleanly, promptInteractiveTurn, renderChatAnswerDelta, renderChatComposerCursor, renderChatThoughtTimeUpdate, renderChatUsageUpdate, renderFullWelcomeScreen, renderWelcomePopupLayer, terminalCleanExitDone, wrapText } from '../ui/welcome.js';
+import { exitCleanly, promptInteractiveTurn, renderChatAnswerDelta, renderChatComposerCursor, renderChatThoughtTimeUpdate, renderChatUsageUpdate, renderGatewayFallbackUpdate, renderFullWelcomeScreen, renderWelcomePopupLayer, terminalCleanExitDone, wrapText } from '../ui/welcome.js';
 import { accumulateSessionUsage, compactSessionMessages, createSession, exportSessionMarkdown, formatSessionCost, SessionStore } from '../sessions.js';
 import { layerPromptBox, renderBoxLines, selectConfirmPopup, selectListPopup } from '../ui/popup.js';
 import { askModalChoice } from '../ui/prompt.js';
-import { findModelPricing } from '../model_pricing.js';
+import { findModelPricing, isFreeModelOption } from '../model_pricing.js';
 import { inspectGitWorkspace, readGitDiff } from '../vendor/tools/index.js';
 import { buildWorkspaceMap } from '../repo_map.js';
 import { evaluateTokenBudget, parseBudgetCommand } from '../budget.js';
@@ -64,6 +64,7 @@ export function createReviewToolRegistry() {
 }
 export const STANDARD_SLASH_COMMANDS = [
     '/connect',
+    '/login',
     '/model',
     '/init',
     '/btw',
@@ -169,7 +170,7 @@ export function formatTurnFailureAnswer(status, errorEvent, modelId, otherConnec
     const cleanDetail = rawDetail
         .replace(/^(?:NVIDIA NIM|OpenAI|OpenRouter|[a-zA-Z0-9_-]+)\s*(?:request failed|rate limit exceeded|service or model unavailable)?\s*(?:\([^)]*\))?\s*(?:during\s*streamChat)?:\s*/i, '')
         .trim();
-    return `⚠️ **Model Error (${errorEvent?.code || 'ERR_INFERENCE_FAILED'}):**\n${cleanDetail || 'Model returned no response.'}\n\n👉 **Suggestion:** The model \`${modelId}\` encountered an error. Switch models with \`/model\` or switch providers with \`/connect\`${altSuggestion}.`;
+    return `⚠️ **Model Error (${errorEvent?.code || 'ERR_INFERENCE_FAILED'}):**\n${cleanDetail || 'Model returned no response.'}\n\n👉 **Suggestion:** The model \`${modelId}\` encountered an error. Switch models with \`/model\`, connect directly with \`/connect\`, or reconnect to the Gateway with \`/login\`${altSuggestion}.`;
 }
 export function resolveTurnAssistantAnswer(result, previousHistoryLength, lastErrorEvent, streamedAnswer = '', currentModel = 'unknown', otherConnections = []) {
     if (result.status === 'cancelled') {
@@ -415,7 +416,7 @@ export function resolveWebSearchEndpoint(config) {
 }
 /** Provider results are raw page excerpts; strip block metadata so the no-provider fallback stays readable. */
 const SEARCH_BLOCK_METADATA = /^(title|url|published|author|highlights?|source|score|favicon)\s*:/i;
-export function formatDirectWebSearchAnswer(result) {
+export function formatDirectWebSearchAnswer(result, modelConnected = false) {
     if (result.status !== 'success')
         return `Web search failed: ${result.output}`;
     const lines = result.output
@@ -424,7 +425,7 @@ export function formatDirectWebSearchAnswer(result) {
         .filter((line) => line && line !== '...' && line !== '---' && !SEARCH_BLOCK_METADATA.test(line) && !/^https?:\/\//i.test(line));
     if (!lines.length)
         return 'Web search returned no readable content.';
-    return `${lines.slice(0, 10).join('\n')}\n\n(no model connected — raw search excerpt)`;
+    return `${lines.slice(0, 10).join('\n')}\n\n(${modelConnected ? 'model summary unavailable — ' : 'no model connected — '}raw search excerpt)`;
 }
 /** Environment configuration overrides the persistent search provider preference. */
 export function resolveWebSearchProvider(config) {
@@ -624,7 +625,7 @@ export async function executeBtwQuery(command, drawFrame, provider, currentModel
     if (!provider || !currentModel) {
         await drawFrame(renderBoxLines('By The Way (/btw)', [
             'No model or provider connected.',
-            'Connect a provider with /connect or select a model with /model first.',
+            'Use /login for the Gateway or /connect for a direct provider, then select a model with /model.',
             '',
             'Press Esc or Enter to return.',
         ], 72));
@@ -720,7 +721,7 @@ export async function handleChatSession(args, version, signal) {
     const activateConnection = (connection, explicitModel) => {
         activeConnection = connection;
         currentModel = explicitModel ?? connection.defaultModel ?? (connection.kind === 'nvidia-nim' ? 'auto' : undefined);
-        provider = new NvidiaAdapter({ apiKey: connection.apiKey, baseUrl: connection.baseUrl, providerId: connection.id, providerName: connection.displayName });
+        provider = new NvidiaAdapter({ apiKey: connection.id === 'moderado-cloud' ? undefined : connection.apiKey, baseUrl: connection.baseUrl, providerId: connection.id, providerName: connection.displayName });
     };
     if (activeConnection)
         activateConnection(activeConnection, args.model);
@@ -735,6 +736,14 @@ export async function handleChatSession(args, version, signal) {
             modelId: currentModel,
             mode: activeMode,
         });
+    if (activeSession.usage.available &&
+        !activeSession.usage.costKnown &&
+        activeSession.providerId === activeConnection?.id &&
+        freeModelPolicyFor(activeConnection?.id)?.freeCatalog) {
+        activeSession.usage.costKnown = true;
+        activeSession.usage.costUsd = 0;
+        sessionStore.save(activeSession);
+    }
     let sessionTokens = activeSession.usage.totalTokens;
     let isFirst = true;
     if (config.typescriptLanguageServer)
@@ -787,7 +796,7 @@ export async function handleChatSession(args, version, signal) {
         }
         else {
             const turn = await promptInteractiveTurn({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(), workspace: canonicalWorkspace, version,
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(), workspace: canonicalWorkspace, version,
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, initialMode: activeMode, initialAutoApprove: activeAutoApprove, isFirstTurn: isFirst, signal, chatQuestion: lastQuestion || undefined, chatAnswer: lastAnswer || undefined, chatThoughtTime: lastThoughtTime, outputTokenRate: lastOutputTokenRate, tokenUsage: lastTokenUsage,
                 queuedCommands: commandQueue.items,
                 onExit: exitMessage,
@@ -799,7 +808,7 @@ export async function handleChatSession(args, version, signal) {
                     }
                     if (activeConnection.kind === 'openai-compatible') {
                         const modelId = await selectCompatibleModelOverlay({
-                            apiKey: activeConnection.apiKey,
+                            apiKey: activeConnection.id === 'moderado-cloud' ? undefined : activeConnection.apiKey,
                             baseUrl: activeConnection.baseUrl,
                             providerId: activeConnection.id,
                             providerName: activeConnection.displayName,
@@ -815,7 +824,7 @@ export async function handleChatSession(args, version, signal) {
                         }
                         return modelId;
                     }
-                    const selection = await selectModelOverlay({ apiKey: activeConnection.apiKey, currentModel, signal, saveSelectionByDefault: true, drawFrame });
+                    const selection = await selectModelOverlay({ apiKey: activeConnection.id === 'moderado-cloud' ? undefined : activeConnection.apiKey, currentModel, signal, saveSelectionByDefault: true, drawFrame });
                     if (selection.modelId) {
                         currentModel = selection.modelId;
                         activeConnection = { ...activeConnection, defaultModel: selection.modelId };
@@ -824,11 +833,31 @@ export async function handleChatSession(args, version, signal) {
                     }
                     return selection.modelId;
                 },
+                onLogin: async (drawFrame) => {
+                    const connection = await loginModeradoCloudInteractive({
+                        signal,
+                        drawFrame,
+                        gatewayUrl: config.connections?.['moderado-cloud']?.baseUrl,
+                    });
+                    if (!connection)
+                        return currentModel;
+                    const runtimeConnection = requiresCredentialReference(connection) ? await storeConnectionCredential(connection, credentialStore) : connection;
+                    saveConnection(runtimeConnection);
+                    config = loadConfig();
+                    activateConnection(runtimeConnection);
+                    return currentModel ?? 'No model connected — use /login or /connect';
+                },
                 onConnect: async (drawFrame) => {
-                    const connection = await connectProviderInteractive({ signal, drawFrame, savedConnections: config.connections, connectProviders: config.connectProviders, resolveSavedConnection: (saved) => resolveConnectionCredential(saved, credentialStore) });
+                    const connection = await connectProviderInteractive({
+                        signal,
+                        drawFrame,
+                        savedConnections: config.connections,
+                        connectProviders: config.connectProviders,
+                        resolveSavedConnection: (saved) => resolveConnectionCredential(saved, credentialStore),
+                    });
                     if (!connection)
                         return currentModel;
-                    const runtimeConnection = process.platform === 'win32' ? await storeConnectionCredential(connection, credentialStore) : connection;
+                    const runtimeConnection = requiresCredentialReference(connection) ? await storeConnectionCredential(connection, credentialStore) : connection;
                     saveConnection(runtimeConnection);
                     config = loadConfig();
                     activateConnection(runtimeConnection);
@@ -1071,7 +1100,7 @@ export async function handleChatSession(args, version, signal) {
             lastTokenUsage = undefined;
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode,
                 autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer,
                 chatThoughtTime: lastThoughtTime, queuedCommands: commandQueue.items,
@@ -1087,7 +1116,7 @@ export async function handleChatSession(args, version, signal) {
             lastTokenUsage = undefined;
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode,
                 autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer,
                 chatThoughtTime: lastThoughtTime, queuedCommands: commandQueue.items,
@@ -1122,7 +1151,7 @@ export async function handleChatSession(args, version, signal) {
             }
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode,
                 autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer,
                 chatThoughtTime: lastThoughtTime,
@@ -1161,7 +1190,7 @@ export async function handleChatSession(args, version, signal) {
             lastTokenUsage = undefined;
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode,
                 autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer,
                 chatThoughtTime: lastThoughtTime,
@@ -1200,7 +1229,7 @@ export async function handleChatSession(args, version, signal) {
             lastOutputTokenRate = undefined;
             lastTokenUsage = undefined;
             process.stdout.write('\x1b[H\x1b[J');
-            process.stdout.write(renderFullWelcomeScreen({ model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(), usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode, autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer, chatThoughtTime: lastThoughtTime, queuedCommands: commandQueue.items }, process.stdout.rows));
+            process.stdout.write(renderFullWelcomeScreen({ model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(), usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode, autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer, chatThoughtTime: lastThoughtTime, queuedCommands: commandQueue.items }, process.stdout.rows));
             process.stdout.write(renderChatComposerCursor({ width: process.stdout.columns }, 0));
             continue;
         }
@@ -1210,7 +1239,8 @@ export async function handleChatSession(args, version, signal) {
         if (trimmed === '/help') {
             lastQuestion = trimmed;
             lastAnswer = 'Available slash commands:\n' +
-                '  /connect   - Connect a model provider\n' +
+                '  /connect  - Connect directly to an external or local provider\n' +
+                '  /login     - Connect to the Moderado Gateway or log in to Moderado Cloud\n' +
                 '  /model     - Switch active AI model\n' +
                 '  /init      - Scaffold AGENTS.md from workspace scan\n' +
                 '  /mcp       - Manage local MCP servers\n' +
@@ -1229,7 +1259,7 @@ export async function handleChatSession(args, version, signal) {
             lastTokenUsage = undefined;
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode,
                 autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer,
                 chatThoughtTime: lastThoughtTime,
@@ -1262,7 +1292,7 @@ export async function handleChatSession(args, version, signal) {
             sessionStore.save(activeSession);
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode,
                 autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer,
                 chatThoughtTime: lastThoughtTime,
@@ -1282,7 +1312,7 @@ export async function handleChatSession(args, version, signal) {
             sessionStore.save(activeSession);
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
+                model: currentModel ?? 'No model connected — use /login or /connect', tokens: Math.round(sessionTokens), cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated, workspace: canonicalWorkspace, mode: activeMode,
                 autoApprove: activeAutoApprove, chatQuestion: lastQuestion, chatAnswer: lastAnswer,
                 chatThoughtTime: lastThoughtTime,
@@ -1294,8 +1324,12 @@ export async function handleChatSession(args, version, signal) {
         // Current-information lane: gather live evidence before inference so the model answers in one turn.
         let liveSearch;
         const liveSearchTool = tools.get('web_search');
-        if (activeMode === 'Execute' && shouldFastRouteWebSearch(trimmed) && liveSearchTool) {
+        if (shouldFastRouteWebSearch(trimmed) && liveSearchTool) {
             const searchStartedAt = Date.now();
+            if (!provider && activeSession.usage.totalTokens === 0) {
+                activeSession.usage.costKnown = true;
+                activeSession.usage.costUsd = 0;
+            }
             lastQuestion = trimmed;
             lastAnswer = 'Searching the web...';
             lastThoughtTime = 0;
@@ -1334,13 +1368,16 @@ export async function handleChatSession(args, version, signal) {
             }
         }
         if (!provider) {
-            process.stdout.write('\nNo provider is connected. Let\'s connect one before sending this task.\n');
-            const connection = await connectProviderInteractive({ signal, savedConnections: config.connections, connectProviders: config.connectProviders, resolveSavedConnection: (saved) => resolveConnectionCredential(saved, credentialStore) });
+            process.stdout.write('\nNo model is connected. Use /login for the Gateway or /connect for a direct provider.\n');
+            const connection = await loginModeradoCloudInteractive({
+                signal,
+                gatewayUrl: config.connections?.['moderado-cloud']?.baseUrl,
+            });
             if (!connection) {
-                process.stdout.write('No provider connected. Use /connect whenever you are ready.\n\n');
+                process.stdout.write('No provider connected. Use /login or /connect whenever you are ready.\n\n');
                 continue;
             }
-            const runtimeConnection = process.platform === 'win32' ? await storeConnectionCredential(connection, credentialStore) : connection;
+            const runtimeConnection = requiresCredentialReference(connection) ? await storeConnectionCredential(connection, credentialStore) : connection;
             saveConnection(runtimeConnection);
             config = loadConfig();
             activateConnection(runtimeConnection);
@@ -1379,8 +1416,8 @@ export async function handleChatSession(args, version, signal) {
                 const displayAnswer = streamedAnswer || lastAnswer;
                 process.stdout.write('\x1b[H\x1b[J');
                 process.stdout.write(renderFullWelcomeScreen({
-                    model: currentModel ?? 'No model connected — use /connect',
-                    tokens: Math.round(sessionTokens),
+                    model: currentModel ?? 'No model connected — use /login or /connect',
+                    tokens: Math.round(sessionTokens + (usageRecorded ? 0 : turnUsage?.usage.totalTokens ?? 0)),
                     cost: costLabel(),
                     usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated,
                     workspace: canonicalWorkspace,
@@ -1501,6 +1538,8 @@ export async function handleChatSession(args, version, signal) {
                 eventListener: (event) => {
                     if (event.type === 'model_change')
                         usedModels.add(event.newModelId);
+                    if (event.type === 'gateway_status')
+                        process.stdout.write(renderGatewayFallbackUpdate(event, process.stdout.columns || 80));
                     if (event.type === 'usage') {
                         turnUsage = event;
                         lastTokenUsage = event;
@@ -1514,7 +1553,7 @@ export async function handleChatSession(args, version, signal) {
                             requestAbort.abort();
                         }
                         if (budgetStopped || firstBudgetWarning || event.final || event.timestamp - lastUsagePaint >= 400) {
-                            process.stdout.write(renderChatUsageUpdate(event, process.stdout.columns || 80, budgetStopped ? 'Budget reached' : budgetWarningIssued ? 'Budget ≥80%' : undefined));
+                            process.stdout.write(renderChatUsageUpdate(event, process.stdout.columns || 80, budgetStopped ? 'Budget reached' : budgetWarningIssued ? 'Budget ≥80%' : undefined, `${Math.round(sessionTokens + event.usage.totalTokens)} tokens / ${costLabel()}`, process.stdout.rows || 24, activeMode));
                             lastUsagePaint = event.timestamp;
                         }
                     }
@@ -1554,28 +1593,42 @@ export async function handleChatSession(args, version, signal) {
                     throw error;
                 if (thinkingTimer)
                     clearInterval(thinkingTimer);
-                process.stdout.write(`\nThe saved ${activeConnection.displayName} API key was rejected. Enter a replacement key to retry once.\n`);
-                const replacement = await replaceProviderKeyInteractive(activeConnection, { signal });
+                const cloudOAuth = isModeradoCloudOAuthConnection(activeConnection);
+                process.stdout.write(cloudOAuth
+                    ? '\nModerado Cloud rejected this browser login. Sign in again to retry once.\n'
+                    : `\nThe saved ${activeConnection.displayName} API key was rejected. Enter a replacement key to retry once.\n`);
+                const replacement = cloudOAuth
+                    ? await loginModeradoCloudInteractive({ signal, gatewayUrl: activeConnection.baseUrl })
+                    : await replaceProviderKeyInteractive(activeConnection, { signal });
                 if (!replacement)
                     throw error;
                 recordTurnUsage();
                 turnUsage = undefined;
                 usageRecorded = false;
-                const secured = process.platform === 'win32' ? await storeConnectionCredential(replacement, credentialStore) : replacement;
+                const secured = requiresCredentialReference(replacement) ? await storeConnectionCredential(replacement, credentialStore) : replacement;
                 saveConnection(secured);
                 config = loadConfig();
                 activateConnection(secured);
                 result = await runAgent();
             }
-            if (turnUsage && !turnUsage.estimated) {
+            if (turnUsage) {
                 let pricing;
+                const modelIds = new Set([...usedModels, result.selectedModel.id]);
+                const freePolicy = freeModelPolicyFor(activeConnection?.id);
+                let inventory = [];
                 try {
-                    if (usedModels.size <= 1)
-                        pricing = findModelPricing(await provider.discoverModels(signal), result.selectedModel.id);
+                    inventory = await provider.discoverModels(signal);
                 }
                 catch {
                     // A valid answer remains usable when the provider catalog is unavailable.
                 }
+                const allModelsAreFree = [...modelIds].every((modelId) => isFreeModelOption(inventory.find((entry) => entry.id === modelId) ?? { id: modelId }, modelId === result.selectedModel.id
+                    ? result.selectedModel.classification
+                    : router.classifyModel(modelId, args.profile.includes('local')), freePolicy));
+                if (allModelsAreFree)
+                    pricing = { prompt: '0', completion: '0' };
+                else if (!turnUsage.estimated && modelIds.size === 1)
+                    pricing = findModelPricing(inventory, result.selectedModel.id);
                 recordTurnUsage(pricing);
             }
             recordTurnUsage();
@@ -1584,13 +1637,27 @@ export async function handleChatSession(args, version, signal) {
                 sessionStore.save(activeSession);
             const otherConnections = Object.keys(config.connections ?? {}).filter((id) => id !== activeConnection?.id);
             const resolution = resolveTurnAssistantAnswer(result, conversationHistory.length, lastErrorEvent, streamedAnswer, currentModel, otherConnections);
-            lastAnswer = resolution.answer;
+            const searchFallback = result.status === 'failed' && liveSearch?.status === 'success'
+                ? formatDirectWebSearchAnswer(liveSearch, true)
+                : undefined;
+            const hasSearchFallback = searchFallback !== undefined && searchFallback !== 'Web search returned no readable content.';
+            lastAnswer = hasSearchFallback ? searchFallback : resolution.answer;
             if (budgetStopped) {
                 const note = `Token budget reached (${tokenBudget?.toLocaleString()} per task). Task stopped; usage may exceed the limit because providers report in chunks.`;
                 lastAnswer = [lastAnswer, note].filter(Boolean).join('\n\n');
                 streamedAnswer = lastAnswer;
             }
-            if (resolution.isError) {
+            if (resolution.isError && hasSearchFallback) {
+                conversationHistory = [...conversationHistory, { role: 'user', content: trimmed }, { role: 'assistant', content: lastAnswer }];
+                activeSession.messages = conversationHistory;
+                activeSession.providerId = activeConnection?.id;
+                activeSession.providerName = activeConnection?.displayName;
+                activeSession.modelId = currentModel;
+                activeSession.mode = activeMode;
+                sessionStore.save(activeSession);
+                streamedAnswer = lastAnswer;
+            }
+            else if (resolution.isError) {
                 streamedAnswer = lastAnswer;
             }
             else {
@@ -1628,12 +1695,12 @@ export async function handleChatSession(args, version, signal) {
             const cleanErr = rawErr
                 .replace(/^(?:NVIDIA NIM|OpenAI|OpenRouter|[a-zA-Z0-9_-]+)\s*(?:request failed|rate limit exceeded|service or model unavailable)?\s*(?:\([^)]*\))?\s*(?:during\s*streamChat)?:\s*/i, '')
                 .trim();
-            lastAnswer = `⚠️ **Error:** ${cleanErr || rawErr}\n\n👉 **Suggestion:** Switch models with \`/model\` or switch providers with \`/connect\`${altSuggestion}.`;
+            lastAnswer = `⚠️ **Error:** ${cleanErr || rawErr}\n\n👉 **Suggestion:** Switch models with \`/model\`, connect directly with \`/connect\`, or reconnect to the Gateway with \`/login\`${altSuggestion}.`;
             lastThoughtTime = Math.max(0.001, (Date.now() - startedAt) / 1000);
             lastOutputTokenRate = undefined;
             process.stdout.write('\x1b[H\x1b[J');
             process.stdout.write(renderFullWelcomeScreen({
-                model: currentModel ?? 'No model connected — use /connect',
+                model: currentModel ?? 'No model connected — use /login or /connect',
                 tokens: Math.round(sessionTokens),
                 cost: costLabel(),
                 usageAvailable: activeSession.usage.available, usageEstimated: activeSession.usage.estimated,