muonroi-cli 1.8.4 → 1.9.0

package/dist/src/index.js

@@ -24,8 +24,7 @@ import { createAbortContext } from "./orchestrator/abort.js";
 import { completeDelegation, failDelegation, loadDelegation } from "./orchestrator/delegations.js";
 import { Agent } from "./orchestrator/orchestrator.js";
 import { createPendingCallsLog } from "./orchestrator/pending-calls.js";
-import { getProviderCapabilities } from "./providers/capabilities.js";
-import { listStoredProviders, loadKeyForProvider, setKeyForProvider } from "./providers/keychain.js";
+import { loadKeyForProvider, setKeyForProvider } from "./providers/keychain.js";
 import { detectProviderForModel } from "./providers/runtime.js";
 import { loadConfig } from "./storage/config.js";
 import { loadUsage } from "./storage/usage-cap.js";
@@ -35,7 +34,7 @@ import { runScriptManagedUninstall } from "./utils/install-manager.js";
 import { getApiKey, getBaseURL, getCurrentModel, saveUserSettings } from "./utils/settings.js";
 import { runUpdate } from "./utils/update-checker.js";
 import { buildVerifyPrompt, getVerifyCliError } from "./verify/entrypoint.js";
-// Hydrate chat secrets from OS keychain before CLI bootstrap
+// Hydrate chat secrets (no-op now: secrets live in the environment/env-store)
 await hydrateChatEnvFromKeychain();
 const exitCleanlyOnSigterm = () => {
     process.exit(0);
@@ -61,6 +60,78 @@ export function appendCrashLog(label, msg) {
         /* crash.log is best-effort diagnostics; the logger itself must never throw */
     }
 }
+/**
+ * Arm the event-loop freeze diagnostics for this TUI session.
+ *
+ * Every existing hang guard in this codebase (provider stall watchdog, turn
+ * watchdog) is driven by a timer, so all of them are blind to a blocked event
+ * loop — a timer cannot fire while the JS thread is stuck. Measured live
+ * 2026-07-16 (session 90c3ff533826): the TUI froze 304.5s, input replayed on
+ * recovery, and the 120s stall watchdog only rescued the turn 6.7s AFTER the
+ * loop came back. This closes that blind spot: the monitor reports the block
+ * once the loop frees up, and — when armed — the CPU profiler supplies the
+ * stack captured DURING it.
+ *
+ * Best-effort: never let diagnostics break the CLI.
+ */
+async function startFreezeDiagnostics() {
+    try {
+        const { getLoopBlockThresholdMs, isLoopProfileEnabled } = await import("./utils/settings.js");
+        const { startEventLoopMonitor } = await import("./utils/event-loop-monitor.js");
+        const { logger } = await import("./utils/logger.js");
+        const thresholdMs = getLoopBlockThresholdMs();
+        if (thresholdMs <= 0)
+            return;
+        const profiler = isLoopProfileEnabled()
+            ? await (await import("./utils/loop-profiler.js")).createLoopProfiler()
+            : null;
+        if (profiler) {
+            // Bound segment size. Loop-driven ON PURPOSE: it cannot rotate during a
+            // block, so the segment covering a freeze survives to be captured.
+            const rotateTimer = setInterval(() => profiler.rotate(), 30_000);
+            rotateTimer.unref?.();
+        }
+        logger.info("cli", `[freeze] diagnostics armed (threshold ${thresholdMs}ms)`, {
+            thresholdMs,
+            profiler: profiler ? "on" : "off",
+        });
+        startEventLoopMonitor({
+            thresholdMs,
+            onBlock: (block) => {
+                logger.warn("cli", `[freeze] event loop blocked for ${block.blockedMs}ms — UI was frozen and no timer could fire`, {
+                    blockedMs: block.blockedMs,
+                    breadcrumb: block.breadcrumb,
+                    detectedAt: block.detectedAt,
+                    profiler: profiler ? "armed" : "off (set MUONROI_LOOP_PROFILE=1 for the culprit stack)",
+                });
+                if (!profiler)
+                    return;
+                void profiler
+                    .capture(block.breadcrumb ?? "unknown")
+                    .then((res) => {
+                    if (res) {
+                        // The leaf is usually a native primitive (`now`, a regex step) —
+                        // true but useless as a headline. Lead with the first frame that
+                        // has a file:line, i.e. OUR code.
+                        const suspect = res.hotStack.find((f) => !f.endsWith("(native)")) ?? res.hotStack[0];
+                        logger.warn("cli", `[freeze] blocked in: ${suspect ?? "(unattributed)"}`, {
+                            hotStack: res.hotStack,
+                            file: res.file,
+                            blockedMs: block.blockedMs,
+                        });
+                    }
+                })
+                    .catch((err) => {
+                    logger.error("cli", `[freeze] profile capture failed: ${err?.message}`, { error: err });
+                });
+            },
+        });
+    }
+    catch (err) {
+        // Diagnostics must never take the CLI down with them.
+        appendCrashLog("FREEZE_DIAG", err instanceof Error ? (err.stack ?? err.message) : String(err));
+    }
+}
 process.on("uncaughtException", (err) => {
     appendCrashLog("UNCAUGHT", err.stack || err.message);
     console.error("Fatal:", err.message);
@@ -111,7 +182,7 @@ setRenderSink((lineOrChunk) => {
 // Provider console URLs are sourced from providers/capabilities.ts via ProviderCapabilities.consoleSignupURL().
 /**
  * Try to find an API key for the model the CLI is about to run with.
- * Resolution: env (legacy MUONROI_API_KEY) → OS keychain → settings.json.
+ * Resolution: per-provider env var (env-store), else OAuth sentinel.
  * Returns null if nothing usable is configured anywhere.
  */
 async function resolveKeyForModel(modelId) {
@@ -154,188 +225,7 @@ async function hasOAuthForModel(modelId) {
         return false;
     }
 }
-/**
- * First-run wizard. If the keychain already has keys, prints a hint
- * (model probably doesn't match any stored provider). Otherwise prompts
- * for provider + key and persists to the OS keychain.
- */
-/**
- * Supported splash providers — mirrors SPLASH_PROVIDERS in ui/app.tsx.
- * The wizard only surfaces these; other providers still work programmatically.
- */
-const WIZARD_PROVIDERS = ["deepseek", "siliconflow"];
-async function firstRunWizard(currentModel) {
-    let rl;
-    try {
-        rl = createInterface({ input: process.stdin, output: process.stderr });
-        const ask = (q) => new Promise((resolve) => rl.question(q, (answer) => resolve(answer)));
-        process.stderr.write("\nWelcome to muonroi-cli!\n\n");
-        const stored = await listStoredProviders();
-        if (stored.length > 0) {
-            process.stderr.write(`Keys already in keychain for: ${stored.join(", ")}\n`);
-            if (currentModel) {
-                const provider = detectProviderForModel(currentModel);
-                process.stderr.write(`Current model '${currentModel}' uses provider '${provider}', which has no stored key.\n`);
-            }
-            process.stderr.write("\nOptions:\n" +
-                "  1. Run with a model that matches a stored provider:\n" +
-                "       muonroi-cli --model <model-id>\n" +
-                "  2. Open /providers inside the TUI to add another key.\n" +
-                "  3. muonroi-cli keys set <provider>\n\n");
-            rl.close();
-            return null;
-        }
-        process.stderr.write("Pick how you want to add credentials:\n\n");
-        process.stderr.write("  1. Paste an API key (most common)\n");
-        process.stderr.write("  2. Import an encrypted bundle file (from another device)\n");
-        process.stderr.write("  3. Sync from a Bitwarden vault\n");
-        process.stderr.write("  4. Skip — set up later via /providers inside the TUI\n\n");
-        const actionChoice = (await ask("Choice [1-4, default 1]: ")).trim() || "1";
-        if (actionChoice === "4") {
-            process.stderr.write("\nSkipped. Open /providers inside the TUI to add a key any time.\n");
-            rl.close();
-            return null;
-        }
-        if (actionChoice === "2") {
-            const file = (await ask("Path to bundle file: ")).trim();
-            if (!file) {
-                process.stderr.write("No file provided. Aborted.\n");
-                rl.close();
-                return null;
-            }
-            const passphrase = await ask("Bundle passphrase: ");
-            try {
-                const { readFileSync: readFile } = await import("node:fs");
-                const { decryptBundle } = await import("./cli/keys-bundle.js");
-                const raw = readFile(file, "utf8");
-                const bundle = JSON.parse(raw);
-                const payload = decryptBundle(bundle, passphrase);
-                let imported = 0;
-                for (const [prov, key] of Object.entries(payload.providers)) {
-                    if (!WIZARD_PROVIDERS.includes(prov))
-                        continue;
-                    if (typeof key !== "string" || key.length < 20)
-                        continue;
-                    const ok = await setKeyForProvider(prov, key);
-                    if (ok) {
-                        imported++;
-                        process.stderr.write(`  ✓ ${prov} → keychain\n`);
-                    }
-                }
-                process.stderr.write(`\nImported ${imported} key(s). Launch the TUI to start.\n`);
-                rl.close();
-                // Return any imported key just so caller treats setup as done.
-                return imported > 0 ? "imported" : null;
-            }
-            catch (err) {
-                process.stderr.write(`\nImport failed: ${err.message}\n`);
-                rl.close();
-                return null;
-            }
-        }
-        if (actionChoice === "3") {
-            const password = await ask("Bitwarden master password: ");
-            try {
-                const { unlockWithPassword, listSecureNotesByPrefix } = await import("./cli/bw-vault.js");
-                const unlock = await unlockWithPassword(password);
-                if (!unlock.ok || !unlock.session) {
-                    process.stderr.write(`\nBitwarden unlock failed: ${unlock.error ?? "unknown error"}\n`);
-                    rl.close();
-                    return null;
-                }
-                const list = await listSecureNotesByPrefix(unlock.session, "muonroi-cli/");
-                if (!list.ok) {
-                    process.stderr.write(`\nBitwarden list failed: ${list.error}\n`);
-                    rl.close();
-                    return null;
-                }
-                let imported = 0;
-                for (const item of list.items) {
-                    const prov = item.name.slice("muonroi-cli/".length);
-                    if (!WIZARD_PROVIDERS.includes(prov))
-                        continue;
-                    if (item.notes.length < 20)
-                        continue;
-                    const ok = await setKeyForProvider(prov, item.notes);
-                    if (ok) {
-                        imported++;
-                        process.stderr.write(`  ✓ ${prov} → keychain\n`);
-                    }
-                }
-                process.stderr.write(`\nImported ${imported} key(s) from Bitwarden. Launch the TUI to start.\n`);
-                rl.close();
-                return imported > 0 ? "imported" : null;
-            }
-            catch (err) {
-                process.stderr.write(`\nBitwarden sync failed: ${err.message}\n`);
-                rl.close();
-                return null;
-            }
-        }
-        // Default path: paste an API key for one of WIZARD_PROVIDERS.
-        process.stderr.write("\nSupported providers:\n\n");
-        WIZARD_PROVIDERS.forEach((p, i) => {
-            process.stderr.write(`  ${i + 1}. ${p.padEnd(12)}  ${getProviderCapabilities(p).consoleSignupURL()}\n`);
-        });
-        process.stderr.write("\n");
-        const choice = (await ask(`Provider [1-${WIZARD_PROVIDERS.length}, default 1]: `)).trim();
-        const idx = choice ? Number.parseInt(choice, 10) - 1 : 0;
-        if (!Number.isFinite(idx) || idx < 0 || idx >= WIZARD_PROVIDERS.length) {
-            process.stderr.write("Invalid choice — aborted.\n");
-            rl.close();
-            return null;
-        }
-        const provider = WIZARD_PROVIDERS[idx];
-        if (!provider) {
-            process.stderr.write("Invalid choice — aborted.\n");
-            rl.close();
-            return null;
-        }
-        process.stderr.write(`\nGet a key here: ${getProviderCapabilities(provider).consoleSignupURL()}\n`);
-        const raw = await ask(`Paste your ${provider} API key: `);
-        const trimmed = raw.trim();
-        if (!trimmed) {
-            process.stderr.write("No key provided. Aborted.\n");
-            rl.close();
-            return null;
-        }
-        if (trimmed.length < 20) {
-            process.stderr.write("Key looks too short (< 20 chars). Aborted.\n");
-            rl.close();
-            return null;
-        }
-        try {
-            const ok = await setKeyForProvider(provider, trimmed);
-            if (ok) {
-                process.stderr.write(`\nStored ${provider} key in OS keychain.\n`);
-                process.stderr.write("Tip: run 'muonroi-cli keys export ~/keys.json' to back up + move to other devices.\n");
-                if (currentModel) {
-                    const currentProvider = detectProviderForModel(currentModel);
-                    if (currentProvider !== provider) {
-                        process.stderr.write(`\nNote: defaultModel '${currentModel}' is on '${currentProvider}'. ` +
-                            `Edit ~/.muonroi-cli/user-settings.json or rerun with --model to use ${provider}.\n`);
-                    }
-                }
-            }
-            else {
-                process.stderr.write("\nOS keychain unavailable (keytar or secret service backend).\n" +
-                    "Linux: sudo dnf install libsecret (Fedora) or sudo apt-get install libsecret-1-0 (Ubuntu).\n" +
-                    "Key will be used for this session only. For persistence across runs:\n" +
-                    `  export ${provider.toUpperCase()}_API_KEY=...\n`);
-            }
-        }
-        catch (err) {
-            process.stderr.write(`\nWarning: failed to store key in keychain: ${err.message}\n`);
-        }
-        rl.close();
-        return trimmed;
-    }
-    catch {
-        rl?.close();
-        return null;
-    }
-}
-async function startInteractive(apiKey, baseURL, model, maxToolRounds, batchApi, session, initialMessage, permissionMode = "safe", injectHalt = false) {
+async function startInteractive(apiKey, baseURL, model, maxToolRounds, batchApi, session, initialMessage, permissionMode = "safe", injectHalt = false, injectHaltSprint = false) {
     // ── Plan 00-07 boot order ──────────────────────────────────────────────────
     // 1. redactor.installGlobalPatches() — already at top of file (line 6).
     // 2. loadConfig + loadUsage (validates storage paths, logs usage cap state).
@@ -401,6 +291,14 @@ async function startInteractive(apiKey, baseURL, model, maxToolRounds, batchApi,
     const { warmMcpClients } = await import("./mcp/client-pool.js");
     const { loadMcpServers } = await import("./utils/settings.js");
     await warmMcpClients(loadMcpServers(), !session);
+    // Register a factory for every credentialed provider, not just the session's.
+    // A model resolved for another provider (compaction, classify, a sub-agent,
+    // a mode-specific model) can then be routed to ITS OWN endpoint instead of
+    // being POSTed to the session provider's — the 404 in session 0c6728ba1a25
+    // (`gpt-5.4` → api.x.ai) existed only because the openai factory this
+    // redirect needs had never been built. Best-effort: never blocks boot.
+    const { warmProviderFactories } = await import("./providers/warm.js");
+    await warmProviderFactories();
     const agent = new Agent(apiKey, baseURL, model, maxToolRounds, {
         session,
         batchApi,
@@ -416,6 +314,14 @@ async function startInteractive(apiKey, baseURL, model, maxToolRounds, batchApi,
     const { relaunchWithSession } = await import("./ui/utils/relaunch.js");
     const renderer = await createCliRenderer({
         exitOnCtrlC: false,
+        // OpenTUI defaults openConsoleOnError:true — its process-level
+        // unhandledRejection/uncaughtException handler then calls console.show(),
+        // which focuses the debug console overlay and captures ALL keypresses.
+        // The overlay's keybindings have no hide/close action, so a stray rejection
+        // (e.g. a provider dropping a streaming socket) traps the user in a console
+        // they cannot dismiss. We surface errors in-band instead — keep it off.
+        // Toggle it deliberately with F12 (wired below).
+        openConsoleOnError: false,
         // We manage SIGINT ourselves (orchestrator abort → agent cleanup → renderer destroy).
         // Prevent OpenTUI from registering its own SIGINT/SIGTERM handler which would
         // call renderer.destroy() prematurely and race with our orderly shutdown.
@@ -426,10 +332,33 @@ async function startInteractive(apiKey, baseURL, model, maxToolRounds, batchApi,
             alternateKeys: true,
         },
     });
+    // Agent-mode: hand the renderer to the harness so it can snapshot the ACTUAL
+    // rendered cell grid (colors + attributes) via VisualFrame, not just the
+    // semantic tree. No-op outside agent-mode (runtime undefined).
+    {
+        const agentRt = globalThis.__muonroiAgentRuntime;
+        agentRt?.attachRenderer?.(renderer);
+    }
     // The TUI now owns the terminal — route fatal-handler behaviour away from
     // process.exit(1) (see the unhandledRejection handler above). Cleared in
     // restoreTerminalSync() the moment we begin tearing the terminal back down.
     setTuiActive(true);
+    // Armed only once the TUI owns the terminal: this hunts a freeze of the
+    // interactive session, and the logger only routes to debug.log (instead of
+    // stdout, which would corrupt the framebuffer) once the TUI is active.
+    await startFreezeDiagnostics();
+    // Deliberate debug-console toggle. With openConsoleOnError:false the overlay
+    // never auto-pops, so F12 is the ONLY way in — and, crucially, back out:
+    // console.toggle() hides it when it is visible+focused, so it can never trap.
+    try {
+        renderer.keyInput?.on("keypress", (key) => {
+            if (key?.name === "f12")
+                renderer.console.toggle();
+        });
+    }
+    catch {
+        /* keyInput/console are best-effort dev affordances — never block boot */
+    }
     /**
      * Restore terminal to main-screen mode before the process exits.
      *
@@ -616,6 +545,7 @@ async function startInteractive(apiKey, baseURL, model, maxToolRounds, batchApi,
             maxToolRounds,
             version: packageJson.version,
             injectHalt,
+            injectHaltSprint,
         },
         initialMessage,
         onExit,
@@ -733,7 +663,7 @@ async function runBackgroundDelegation(jobPath, options) {
         const model = explicitModel ? normalizeModelId(explicitModel) : undefined;
         // Resolve API key: explicit flag > legacy env/settings.apiKey > per-provider keychain
         // (matches the foreground flow — delegations were previously broken when the user
-        // only had a per-provider key in the OS keychain, e.g. deepseek.)
+        // only had a per-provider key in the environment, e.g. deepseek.)
         let apiKey = stringOption(options.apiKey) || getApiKey();
         if (!apiKey) {
             const modelForResolve = model ?? delegation.model ?? getCurrentModel("agent");
@@ -802,8 +732,8 @@ function resolveConfig(options) {
     // flag or MUONROI_MAX_TOOL_ROUNDS env.
     const maxToolRounds = parseInt(stringOption(options.maxToolRounds) || "100", 10) || 100;
     if (typeof options.apiKey === "string" && process.env.MUONROI_TEST_NO_PERSIST !== "1") {
-        // Persist to OS keychain (per-provider) instead of plaintext settings.json.
-        // Fire-and-forget: keychain write is async; if it fails (no keytar), the key still
+        // Persist to the env-store (per-provider) instead of plaintext settings.json.
+        // Fire-and-forget: env-store write is sync; the key is also set in process.env so it
         // works for this run via `apiKey` above and the user can re-supply it next invocation.
         void persistApiKeyToKeychain(options.apiKey, stringOption(options.model)).catch(() => { });
     }
@@ -852,6 +782,7 @@ program
     .option("--agent-fake-clock", "Use deterministic frame-counter clock")
     .option("--mock-llm <dir>", "Use fixture-based mock LLM from <dir> instead of real provider (E2E testing)")
     .option("--inject-halt", "TEST SEAM: render a synthetic halt recovery card after boot (harness E2E only)")
+    .option("--inject-halt-sprint", "TEST SEAM: render a synthetic sprint-failed recovery card after boot (harness E2E only)")
     .action(async (message, options) => {
     // Agent-mode: start the sidechannel runtime BEFORE any TUI or model work.
     // The runtime is exposed on globalThis so the renderer wiring (Task 1.6c)
@@ -978,50 +909,51 @@ program
     }
     changeDirectoryOrExit(options.directory);
     // Boot model registry BEFORE any key resolution path runs —
-    // detectProviderForModel consults the catalog's alias map to route e.g.
-    // "deepseek-v4-flash" to provider "siliconflow". With an empty registry
-    // it falls back to a prefix match ("deepseek") and the CLI loads the
-    // wrong provider's key. Affects both runBackgroundDelegation and the
-    // main interactive/headless path below.
+    // detectProviderForModel consults the catalog's alias map to route model
+    // ids to the correct provider. With an empty registry it falls back to a
+    // prefix match and the CLI may load the wrong provider's key. Affects both
+    // runBackgroundDelegation and the main interactive/headless path below.
     let catalogLoadFailed = false;
     await loadCatalog().catch(() => {
         catalogLoadFailed = true;
     });
+    // Load the env-store (~/.muonroi-cli/.env) into process.env and migrate any
+    // legacy keychain/settings keys BEFORE any key resolution. Best-effort.
+    try {
+        const { loadEnvFileIntoProcess } = await import("./providers/env-store.js");
+        loadEnvFileIntoProcess();
+        const { migrateLegacyKeysToEnv } = await import("./providers/keychain.js");
+        await migrateLegacyKeysToEnv();
+    }
+    catch (err) {
+        console.error(`[muonroi-cli] env-store init failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     if (options.backgroundTaskFile) {
         await runBackgroundDelegation(options.backgroundTaskFile, options);
         return;
     }
     const config = resolveConfig(options);
-    // No legacy key in env / settings — try the OS keychain for the resolved
-    // model's provider before falling back to the wizard.
-    if (!config.apiKey) {
+    // One auth mode per provider (OAuth XOR API key): if the resolved model's
+    // provider has an OAuth token, OAuth wins OUTRIGHT — a stored API key
+    // (env/flag/settings) is ignored, never blended. Only when there is no
+    // OAuth token do we fall back to the provider's env API key. The "oauth"
+    // sentinel satisfies downstream gating (which only checks for a truthy
+    // apiKey); the runtime injects Bearer headers.
+    {
         const modelForResolve = config.model ?? getCurrentModel("agent");
-        const keychainKey = await resolveKeyForModel(modelForResolve);
-        if (keychainKey) {
-            config.apiKey = keychainKey;
-        }
-        else if (await hasOAuthForModel(modelForResolve)) {
-            // OAuth-authenticated provider — runtime will inject Bearer headers.
-            // Set placeholder so downstream gating code (which only checks for
-            // a truthy apiKey) is satisfied.
+        if (await hasOAuthForModel(modelForResolve)) {
             config.apiKey = "oauth";
         }
-    }
-    // First-run wizard (interactive only, before any TUI code)
-    const isInteractive = !options.prompt && !options.verify && process.stdin.isTTY;
-    if (!config.apiKey && isInteractive) {
-        const modelForWizard = config.model ?? getCurrentModel("agent");
-        const wizardKey = await firstRunWizard(modelForWizard);
-        if (wizardKey) {
-            // Key is already persisted to the OS keychain by the wizard. We DO NOT
-            // write it back to settings.json (avoids resurrecting plaintext that
-            // 'keys cleanup-settings' just removed).
-            config.apiKey = wizardKey;
-        }
-        else {
-            process.exit(1);
+        else if (!config.apiKey) {
+            const envKey = await resolveKeyForModel(modelForResolve);
+            if (envKey)
+                config.apiKey = envKey;
         }
     }
+    // First run with no credentials does NOT block: boot straight into the TUI.
+    // The in-chat provider picker (/providers) handles auth on demand.
+    // Headless (`--prompt`/`--verify`) with no key still fails via requireApiKey.
+    const isInteractive = !options.prompt && !options.verify && process.stdin.isTTY;
     // Bootstrap EE auth (loads serverBaseUrl + token from ~/.experience/config.json)
     const { loadEEAuthToken, getCachedServerBaseUrl } = await import("./ee/auth.js");
     await loadEEAuthToken().catch(() => { });
@@ -1049,10 +981,15 @@ program
     // so each request doesn't re-probe.
     const { detectEEClientMode, describeMode } = await import("./ee/client-mode.js");
     detectEEClientMode()
-        .then((info) => {
+        .then(async (info) => {
         if (process.env.MUONROI_EE_DEBUG === "1") {
             console.error(`[muonroi-cli] ${describeMode(info)}`);
         }
+        // WhoAmI thin-client fallback: once the mode is cached, derive the working-style
+        // profile from the behavioral brain and prime the sync cache so the PIL picks it
+        // up from the next turn. Fire-and-forget, fail-open — never blocks boot.
+        const { warmWhoAmIFromBrain } = await import("./ee/bridge.js");
+        await warmWhoAmIFromBrain();
     })
         .catch(() => { });
     // Patch zod-to-json-schema for Zod v4 compat (fixes tool calls for DeepSeek etc.)
@@ -1130,7 +1067,7 @@ program
         return;
     }
     const initialMessage = message.length > 0 ? message.join(" ") : undefined;
-    await startInteractive(config.apiKey, config.baseURL, config.model, config.maxToolRounds, options.batchApi === true, options.session, initialMessage, options.permission, options.injectHalt === true);
+    await startInteractive(config.apiKey, config.baseURL, config.model, config.maxToolRounds, options.batchApi === true, options.session, initialMessage, options.permission, options.injectHalt === true, options.injectHaltSprint === true);
 });
 program
     .command("models")
@@ -1220,41 +1157,31 @@ program
 });
 const keys = program
     .command("keys")
-    .description("Manage provider API keys via the OS keychain (set, list, delete, import-bw)");
+    .description("Manage provider API keys as environment variables (set, list, delete)");
 keys
     .command("set <provider>")
-    .description("Prompt for a provider API key and store it in the OS keychain")
-    .option("--bw", "Also write the key to a Bitwarden vault Secure Note (requires bw CLI + BW_SESSION)")
-    .option("--prefix <prefix>", "Bitwarden item name prefix when --bw is set (default: 'muonroi-cli/')", "muonroi-cli/")
-    .action(async (provider, opts) => {
+    .description("Prompt for a provider API key and store it as an environment variable")
+    .action(async (provider) => {
     const { runKeysSet } = await import("./cli/keys.js");
-    await runKeysSet(provider, { bw: opts.bw, itemPrefix: opts.prefix });
+    await runKeysSet(provider);
 });
 keys
     .command("list")
-    .description("Show provider keys currently stored in the OS keychain (masked)")
+    .description("Show provider keys currently set in the environment (masked)")
     .action(async () => {
     const { runKeysList } = await import("./cli/keys.js");
     await runKeysList();
 });
 keys
     .command("delete <provider>")
-    .description("Delete a stored provider key from the OS keychain")
+    .description("Delete a stored provider key from the environment")
     .action(async (provider) => {
     const { runKeysDelete } = await import("./cli/keys.js");
     await runKeysDelete(provider);
 });
-keys
-    .command("import-bw [providers...]")
-    .description("Import keys from a Bitwarden vault into the OS keychain (requires bw CLI + BW_SESSION)")
-    .option("--prefix <prefix>", "Vault item name prefix (default: 'muonroi-cli/')", "muonroi-cli/")
-    .action(async (providers, opts) => {
-    const { runKeysImportBw } = await import("./cli/keys.js");
-    await runKeysImportBw({ providers, itemPrefix: opts.prefix });
-});
 keys
     .command("login <provider>")
-    .description("Log in to a provider via OAuth subscription (supported: openai, google/agy, xai). 'google'/'agy' now uses agy client creds.")
+    .description("Log in to a provider via OAuth subscription (supported: openai, xai).")
     .action(async (provider) => {
     const { runKeysLogin } = await import("./cli/keys.js");
     await runKeysLogin(provider);
@@ -1268,28 +1195,21 @@ keys
 });
 keys
     .command("export <file>")
-    .description("Export all keychain keys to an encrypted portable bundle (move between devices)")
+    .description("Export all provider keys to an encrypted portable bundle (move between devices)")
     .action(async (file) => {
     const { runKeysExport } = await import("./cli/keys.js");
     await runKeysExport(file);
 });
 keys
     .command("import <file>")
-    .description("Import an encrypted bundle into the OS keychain (created by 'keys export')")
+    .description("Import an encrypted bundle of provider keys (created by 'keys export')")
     .action(async (file) => {
     const { runKeysImport } = await import("./cli/keys.js");
     await runKeysImport(file);
 });
-keys
-    .command("cleanup-settings")
-    .description("Strip plaintext API keys out of ~/.muonroi-cli/user-settings.json after migrating to keychain")
-    .action(async () => {
-    const { runKeysCleanupSettings } = await import("./cli/keys.js");
-    await runKeysCleanupSettings();
-});
 keys
     .command("set-chat <id>")
-    .description("Set a chat-service secret (discord-token, discord-guild-id, slack-token, slack-team-id) in the OS keychain")
+    .description("Set a chat-service secret (discord-token, discord-guild-id, slack-token, slack-team-id) in the environment")
     .action(async (id) => {
     const { runChatKeySet } = await import("./cli/keys.js");
     if (!["discord-token", "discord-guild-id", "slack-token", "slack-team-id"].includes(id)) {
@@ -1309,14 +1229,6 @@ keys
     }
     await runChatKeySet(id, value);
 });
-keys
-    .command("import-bw-chat [ids...]")
-    .option("--prefix <prefix>", "BW item name prefix", "muonroi-cli/chat-")
-    .description("Import chat-service secrets from Bitwarden vault into OS keychain")
-    .action(async (ids, opts) => {
-    const { runChatImportBw } = await import("./cli/keys.js");
-    await runChatImportBw({ ids: ids.length > 0 ? ids : undefined, itemPrefix: opts.prefix });
-});
 const usage = program.command("usage").description("Inspect cost ledger and find spend bloat");
 usage
     .command("report")
@@ -1391,7 +1303,7 @@ usage
 const mcp = program.command("mcp").description("Manage MCP server configuration");
 mcp
     .command("setup-research")
-    .description("Configure web research MCP servers (context7, fetch, tavily)")
+    .description("Configure web research (native fetch_url + web_search; optional MCPs for context7/muonroi-docs)")
     .action(async () => {
     const rl = createInterface({ input: process.stdin, output: process.stderr });
     const ask = (q) => new Promise((resolve) => rl.question(q, (a) => resolve(a)));
@@ -1410,20 +1322,10 @@ mcp
 });
 mcp
     .command("set <id>")
-    .description("Prompt for an MCP API key (e.g. tavily) and store it in the OS keychain")
-    .option("--bw", "Also write the key to a Bitwarden vault Secure Note (requires bw CLI + BW_SESSION)")
-    .option("--prefix <prefix>", "Bitwarden item name prefix when --bw is set (default: 'muonroi-cli/')", "muonroi-cli/")
-    .action(async (id, opts) => {
+    .description("Prompt for an MCP API key (e.g. tavily) and store it as an environment variable")
+    .action(async (id) => {
     const { runMcpKeysSet } = await import("./cli/keys.js");
-    await runMcpKeysSet(id, { bw: opts.bw, itemPrefix: opts.prefix });
-});
-mcp
-    .command("import-bw [keys...]")
-    .description("Import MCP secrets (e.g. tavily) from a Bitwarden vault into the OS keychain (requires bw CLI + BW_SESSION)")
-    .option("--prefix <prefix>", "Vault item name prefix (default: 'muonroi-cli/')", "muonroi-cli/")
-    .action(async (keys, opts) => {
-    const { runMcpImportBw } = await import("./cli/keys.js");
-    await runMcpImportBw({ keys, itemPrefix: opts.prefix });
+    await runMcpKeysSet(id);
 });
 program
     .command("mcp-driver")

package/dist/src/lsp/builtins.js

@@ -342,7 +342,9 @@ async function resolveNodeServerLaunch(root, binary, packageName, baseArgs, auto
     }
     if (!autoInstall)
         return null;
-    const cached = await lspNpmWhich(packageName);
+    // Pass `binary` explicitly: a package can ship several bins and the one named
+    // after the package is not always the language server (see lspNpmWhich).
+    const cached = await lspNpmWhich(packageName, binary);
     if (cached) {
         return { command: cached, args: baseArgs };
     }

package/dist/src/lsp/manager.d.ts

@@ -1,6 +1,6 @@
 import { type RuntimeLspServerDefinition } from "./builtins.js";
 import { type LspClientSession } from "./client.js";
-import type { LspDiagnosticFile, LspQueryInput, LspToolResponse, NormalizedLspSettings } from "./types.js";
+import type { ImpactOfChangeResult, LspDiagnosticFile, LspQueryInput, LspQueryResult, LspToolResponse, MutationPreviewResult, NormalizedLspSettings, PolicyAction } from "./types.js";
 interface WorkspaceLspManagerOptions {
     createClient?: (input: {
         serverId: string;
@@ -13,6 +13,10 @@ export interface WorkspaceLspManager {
     touchFile(filePath: string, waitForDiagnostics?: boolean): Promise<LspDiagnosticFile[]>;
     syncFile(filePath: string, content: string, save?: boolean, waitForDiagnostics?: boolean, diagnosticsTimeoutMs?: number): Promise<LspDiagnosticFile[]>;
     query(input: LspQueryInput): Promise<LspToolResponse>;
+    waitForDiagnostics(filePath: string, timeout: number): Promise<LspQueryResult>;
+    impactOfChange(filePath: string, query?: string, timeout?: number): Promise<ImpactOfChangeResult>;
+    lspMutationPreview(filePath: string, change: string): Promise<MutationPreviewResult>;
+    lspBeforeGrep(filePath: string, query?: string): Promise<PolicyAction>;
     close(): Promise<void>;
 }
 export declare function createWorkspaceLspManager(cwd: string, settings: NormalizedLspSettings, options?: WorkspaceLspManagerOptions): WorkspaceLspManager;