myshell-tools 2.14.0 → 3.0.0

package/dist/infra/credentials.js

@@ -5,9 +5,11 @@
  * shape `{ claudeOauthToken?: string }` so the Claude OAuth token captured
  * during `myshell-tools login claude --code` is available across restarts.
  *
- * On startup, `applyStoredCredentials` injects the token into `process.env` so
- * that both the provider detection (`claude auth status`) and the spawned
- * `claude -p …` child process see it via the inherited environment.
+ * Token scoping: instead of injecting the token into the global `process.env`
+ * at startup (which would expose it to every child process), callers use
+ * `loadClaudeToken()` + `claudeEnv()` to build a scoped env object that is
+ * passed only to Claude CLI invocations.  Other providers (codex, opencode,
+ * npm) never see the token.
  *
  * Security: the file is written with mode 0o600 (owner-read-only) on POSIX
  * systems. The chmod is best-effort — a failure is silently ignored so the
@@ -66,6 +68,49 @@ export async function loadCredentials(homeDir) {
         return {};
     }
 }
+/**
+ * Load the stored Claude OAuth token. Returns `null` when no token is stored
+ * or when the credentials file is missing/corrupt. Never throws.
+ *
+ * This is a thin convenience wrapper over `loadCredentials` that returns the
+ * token string directly so callers don't need to destructure `Credentials`.
+ */
+export async function loadClaudeToken(homeDir) {
+    try {
+        const creds = await loadCredentials(homeDir);
+        return creds.claudeOauthToken ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build a child-process environment that injects the Claude OAuth token into
+ * ONLY the `CLAUDE_CODE_OAUTH_TOKEN` variable, leaving all other variables
+ * from `baseEnv` intact.
+ *
+ * Rules (pure — no I/O):
+ *  - Returns `baseEnv` unchanged when `token` is `null` (nothing stored).
+ *  - Returns `baseEnv` unchanged when `baseEnv.CLAUDE_CODE_OAUTH_TOKEN` is
+ *    already set — the user's explicitly-exported value always wins.
+ *  - Otherwise returns `{ ...baseEnv, CLAUDE_CODE_OAUTH_TOKEN: token }`.
+ *
+ * Pass the result as the `env` option to execa for Claude CLI spawns only.
+ * Never pass it to codex/opencode/npm children — they do not need it and
+ * should not see the token.
+ *
+ * Pure / never throws.
+ */
+export function claudeEnv(baseEnv, token) {
+    if (token === null) {
+        return baseEnv;
+    }
+    if (baseEnv['CLAUDE_CODE_OAUTH_TOKEN'] !== undefined) {
+        // User's explicitly-exported env wins — do not overwrite.
+        return baseEnv;
+    }
+    return { ...baseEnv, CLAUDE_CODE_OAUTH_TOKEN: token };
+}
 /**
  * Persist the Claude OAuth token atomically to
  * `~/.myshell-tools/credentials.json` with restrictive permissions (0o600).
@@ -74,12 +119,15 @@ export async function saveClaudeToken(token, homeDir) {
     const home = homeDir ?? homedir();
     const dir = getCredentialsDir(home);
     const path = getCredentialsPath(home);
-    await mkdir(dir, { recursive: true });
+    // Create the directory with restrictive permissions (0o700) so it is never
+    // world-readable.  recursive:true is a no-op when it already exists.
+    await mkdir(dir, { recursive: true, mode: 0o700 });
     // Load existing credentials so we only replace the token key, preserving others.
     const existing = await loadCredentials(homeDir);
     const updated = { ...existing, claudeOauthToken: token };
-    // atomicWrite uses rename — ensures no partial writes on crash.
-    await atomicWrite(path, JSON.stringify(updated, null, 2));
+    // atomicWrite with mode 0o600 guarantees the temp file is never more permissive
+    // than the final destination — no world-readable window before the rename.
+    await atomicWrite(path, JSON.stringify(updated, null, 2), 0o600);
     // Best-effort: restrict to owner-read-only. Silently ignored on Windows or
     // unusual filesystems where chmod is unavailable or unsupported.
     try {
@@ -200,6 +248,8 @@ export function stripPastedSecretWrapper(raw) {
  * - `'api-key'`     — starts with `sk-ant-api` (a raw Anthropic API key, NOT what we want).
  * - `'none'`        — neither; blank or unrecognised.
  *
+ * Uses `startsWith` semantics: mid-string occurrences of `sk-ant-oat` or
+ * `sk-ant-api` do NOT classify as oauth-token or api-key respectively.
  * Input is pre-normalised (trimmed, quotes stripped) by the caller.
  * Pure / never throws.
  *
@@ -207,12 +257,13 @@ export function stripPastedSecretWrapper(raw) {
  *   classifyPastedSecret('sk-ant-oat01-abc-XYZ') // → 'oauth-token'
  *   classifyPastedSecret('sk-ant-api03-abc-XYZ') // → 'api-key'
  *   classifyPastedSecret('not-a-token')           // → 'none'
+ *   classifyPastedSecret('prefix sk-ant-oat01-x') // → 'none'
  */
 export function classifyPastedSecret(s) {
     try {
-        if (s.includes('sk-ant-oat'))
+        if (s.startsWith('sk-ant-oat'))
             return 'oauth-token';
-        if (s.includes('sk-ant-api'))
+        if (s.startsWith('sk-ant-api'))
             return 'api-key';
         return 'none';
     }

package/dist/infra/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAU1C,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IACpD,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,OAAgB;IACnE,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAgB,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAEtE,gEAAgE;IAChE,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtC,qDAAqD;QACrD,IAAI,MAAM,GAA4B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,GAAG,MAAiC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;QAED,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAClC,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAsB,EACtB,OAAgB;IAEhB,IAAI,CAAC;QACH,+DAA+D;QAC/D,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/D,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACnB,IACE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACtC,CAAC;YACD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAS;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,aAAa,CAAC;QACnD,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/infra/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAU1C,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IACpD,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IACpD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS,CACvB,OAA0B,EAC1B,KAAoB;IAEpB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,yBAAyB,CAAC,KAAK,SAAS,EAAE,CAAC;QACrD,0DAA0D;QAC1D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,OAAgB;IACnE,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnD,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAgB,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAEtE,gFAAgF;IAChF,2EAA2E;IAC3E,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtC,qDAAqD;QACrD,IAAI,MAAM,GAA4B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,GAAG,MAAiC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;QAED,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAClC,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAsB,EACtB,OAAgB;IAEhB,IAAI,CAAC;QACH,+DAA+D;QAC/D,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/D,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACnB,IACE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACtC,CAAC;YACD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAS;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,aAAa,CAAC;QACrD,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/interface/menu.d.ts

@@ -110,6 +110,26 @@ export interface MenuContext {
  * @returns True for yes, false for no.
  */
 export declare function parseYesNo(input: string | null, defaultYes: boolean): boolean;
+/**
+ * Decide whether auto-update is enabled for this launch.
+ *
+ * Auto-update is considered ENABLED when:
+ *   - `config.autoUpdate` is `true` or `undefined` (absent = default-on), AND
+ *   - `env['MYSHELL_NO_UPDATE']` is not set (any non-empty value disables it).
+ *
+ * A user who explicitly set `autoUpdate: false` in their config keeps it off.
+ * Setting `MYSHELL_NO_UPDATE=1` (or any non-empty value) in the environment
+ * overrides even an explicit `autoUpdate: true`.
+ *
+ * Pure — no I/O, no side effects, never throws.
+ *
+ * @param config - The loaded AppConfig (only `autoUpdate` field is read).
+ * @param env    - A `NodeJS.ProcessEnv`-shaped object to read `MYSHELL_NO_UPDATE` from.
+ * @returns True when auto-update should run at launch.
+ */
+export declare function autoUpdateEnabled(config: {
+    autoUpdate?: boolean;
+}, env: NodeJS.ProcessEnv): boolean;
 /**
  * Return the shell alias hint the user can add to their shell profile to make
  * `myshell-tools` the default command-line assistant.

package/dist/interface/menu.js

@@ -59,6 +59,29 @@ export function parseYesNo(input, defaultYes) {
         return false;
     return defaultYes;
 }
+/**
+ * Decide whether auto-update is enabled for this launch.
+ *
+ * Auto-update is considered ENABLED when:
+ *   - `config.autoUpdate` is `true` or `undefined` (absent = default-on), AND
+ *   - `env['MYSHELL_NO_UPDATE']` is not set (any non-empty value disables it).
+ *
+ * A user who explicitly set `autoUpdate: false` in their config keeps it off.
+ * Setting `MYSHELL_NO_UPDATE=1` (or any non-empty value) in the environment
+ * overrides even an explicit `autoUpdate: true`.
+ *
+ * Pure — no I/O, no side effects, never throws.
+ *
+ * @param config - The loaded AppConfig (only `autoUpdate` field is read).
+ * @param env    - A `NodeJS.ProcessEnv`-shaped object to read `MYSHELL_NO_UPDATE` from.
+ * @returns True when auto-update should run at launch.
+ */
+export function autoUpdateEnabled(config, env) {
+    if (env['MYSHELL_NO_UPDATE'] !== undefined && env['MYSHELL_NO_UPDATE'].length > 0) {
+        return false;
+    }
+    return config.autoUpdate !== false;
+}
 /**
  * Return the shell alias hint the user can add to their shell profile to make
  * `myshell-tools` the default command-line assistant.
@@ -137,7 +160,8 @@ export function renderHeaderLines(env, _version) {
         const ps = env.opencode;
         const planSuffix = ps.plan != null ? ` (${ps.plan})` : '';
         if (ps.authenticated) {
-            lines.push(`✅ ${ps.id}: ready${planSuffix}`);
+            // Be explicit that "ready" is based on free models, not a credential probe.
+            lines.push(`✅ ${ps.id}: ready (free models)${planSuffix}`);
         }
         else {
             lines.push(`⚠️  ${ps.id}: not signed in${planSuffix}`);
@@ -290,6 +314,8 @@ async function runWelcome(ctx, out, readLine, mutableConfig, installProviderFn,
     let env = ctx.env;
     const headerLines = renderHeaderLines(env, ctx.version);
     out.write('\n' + box(`🧠 myshell-tools v${ctx.version} — Setup`, headerLines) + '\n\n');
+    // ---- Orientation header --------------------------------------------------
+    out.write('Quick setup — a few questions, ~30 seconds. Press Enter to accept the [Capitalized] default.\n\n');
     // ---- Offer to install any missing provider (claude / codex) --------------
     // Consent is required: we ask once per missing provider.
     // Display: (Y/n) — default YES, so Enter installs; explicit n skips.
@@ -346,14 +372,12 @@ async function runWelcome(ctx, out, readLine, mutableConfig, installProviderFn,
             await loginFn(out, id, { readLine });
         }
     }
-    // ---- Mode / default-shell options ----------------------------------------
-    out.write('\n');
-    out.write('  [c]     Customize mode\n');
-    out.write('  [Enter] Continue\n\n');
-    out.write('> ');
-    const key = await readLine();
+    // ---- Mode selection — single collapsed prompt ----------------------------
+    // Accepts 1/2/3 directly; Enter (or empty) keeps current default (balanced).
+    out.write('\nMode — [1] cost-saver  [2] balanced (default)  [3] quality-first  (Enter = balanced): ');
+    const modeKey = await readLine();
     // EOF during setup — save bare onboarded config and return
-    if (key === null) {
+    if (modeKey === null) {
         const saved = {
             onboarded: true,
             setAsDefault: false,
@@ -362,24 +386,32 @@ async function runWelcome(ctx, out, readLine, mutableConfig, installProviderFn,
         await saveConfig(saved);
         return saved;
     }
-    let updated = mutableConfig;
-    if (key === 'c') {
-        updated = await runModeSelect(updated, out, readLine);
-    }
-    // [Enter] or anything else → fall through to save & go
+    let newMode = mutableConfig.mode;
+    if (modeKey === '1')
+        newMode = 'cost-saver';
+    else if (modeKey === '2')
+        newMode = 'balanced';
+    else if (modeKey === '3')
+        newMode = 'quality-first';
+    // Enter/empty/anything else → keep current (balanced default)
+    const updated = {
+        onboarded: mutableConfig.onboarded,
+        setAsDefault: mutableConfig.setAsDefault,
+        ...(newMode !== undefined ? { mode: newMode } : {}),
+    };
     // Default is NO for set-as-default — require explicit 'y' to enable.
     out.write('Set myshell-tools as your default shell tool? (y/N) ');
     const defaultAns = await readLine();
     const setAsDefault = parseYesNo(defaultAns, false);
-    // Default is NO for auto-update — require explicit 'y' to enable.
-    out.write('Keep myshell-tools up to date automatically? (y/N) ');
+    // Default is YES for auto-update (recommended; user can opt out with n or via Settings).
+    out.write('Keep myshell-tools up to date automatically? (Y/n) ');
     const autoUpdateAns = await readLine();
-    const autoUpdate = parseYesNo(autoUpdateAns, false);
+    const autoUpdate = parseYesNo(autoUpdateAns, true);
     const saved = {
         onboarded: true,
         setAsDefault,
         ...(updated.mode !== undefined ? { mode: updated.mode } : {}),
-        ...(autoUpdate ? { autoUpdate: true } : {}),
+        ...(!autoUpdate ? { autoUpdate: false } : {}),
     };
     await saveConfig(saved);
     // When the user opts in, actually write the shell startup hook (real install,
@@ -447,7 +479,7 @@ async function runSettings(_ctx, mutableCtx, out, readLine) {
         '',
         `  [1] Mode: ${cfg.mode ?? 'balanced'}`,
         `  [2] Set as default shell: ${cfg.setAsDefault ? 'on' : 'off'}`,
-        `  [3] Auto-update: ${cfg.autoUpdate === true ? 'on' : 'off'}`,
+        `  [3] Auto-update: ${cfg.autoUpdate !== false ? 'on' : 'off'}`,
         '',
         '  [Enter] Back',
         '',
@@ -472,14 +504,20 @@ async function runSettings(_ctx, mutableCtx, out, readLine) {
 /**
  * Toggle the auto-update preference and persist the updated config.
  * Reports the new state so the user knows what changed.
+ *
+ * Since auto-update now defaults to ON (undefined → enabled), toggling when
+ * currently enabled (true or undefined) sets it explicitly to false; toggling
+ * when currently disabled (false) removes the explicit flag (restores default-on).
  */
 async function toggleAutoUpdate(config, out) {
-    const enable = config.autoUpdate !== true;
+    // Currently enabled when autoUpdate !== false (undefined counts as on)
+    const currentlyEnabled = config.autoUpdate !== false;
+    const enable = !currentlyEnabled;
     const updated = {
         onboarded: config.onboarded,
         setAsDefault: config.setAsDefault,
         ...(config.mode !== undefined ? { mode: config.mode } : {}),
-        ...(enable ? { autoUpdate: true } : {}),
+        ...(!enable ? { autoUpdate: false } : {}),
     };
     await saveConfig(updated);
     out.write(`Auto-update: ${enable ? 'on' : 'off'}\n`);
@@ -777,9 +815,10 @@ async function runChatLoop(ctx, mutableCtx, convId, out, readLine, loginFn, dete
     // can drive time with a fake clock.
     const interruptTimes = [];
     const INTERRUPT_WINDOW_MS = 1_500;
-    // The 'exit' signal is communicated from the SIGINT handler to the main
-    // loop via this flag (the handler can't break the outer while directly).
+    // The 'exit' and 'menu' signals are communicated from the SIGINT handler to
+    // the main loop via these flags (the handler can't break the outer while directly).
     let shouldExit = false;
+    let shouldMenu = false;
     // Handle Ctrl+C with the press-counting model.
     const sigintHandler = () => {
         const now = ctx.clock.now();
@@ -800,13 +839,10 @@ async function runChatLoop(ctx, mutableCtx, convId, out, readLine, loginFn, dete
                 currentAc.abort();
                 currentAc = null;
             }
-            // Signal the main loop; the loop checks this flag after each await.
-            shouldExit = false;
-            // We can't directly break the loop from an event handler, so we set a
-            // flag and resolve any pending readLine by closing (the loop checks the
-            // flag). In practice the loop is either awaiting readLine() or runTask().
-            // For the readLine case the user typed nothing yet — we need to interrupt
-            // that await. We use a shared resolver pattern: see loopBreaker below.
+            // Set shouldMenu so the loop returns 'menu' after any running task settles.
+            shouldMenu = true;
+            // For the readLine case (idle prompt) we can interrupt the await immediately
+            // via the loopBreaker resolver.
             loopBreaker?.('menu');
         }
         else {
@@ -826,7 +862,7 @@ async function runChatLoop(ctx, mutableCtx, convId, out, readLine, loginFn, dete
     let loopResult = 'menu';
     try {
         while (true) {
-            out.write('myshell-tools> ');
+            out.write('> ');
             // Race readLine() against a loopBreak signal from the SIGINT handler.
             // When Ctrl+C fires (to-menu or exit-app), loopBreaker is called with the
             // desired result, which wins the race and breaks the loop.
@@ -861,58 +897,79 @@ async function runChatLoop(ctx, mutableCtx, convId, out, readLine, loginFn, dete
             const policy = mutableCtx.config.mode !== undefined
                 ? POLICY_PRESETS[mutableCtx.config.mode]
                 : DEFAULT_POLICY;
+            // ---- Bug 4 fix: no-provider gate ----------------------------------------
+            // Check whether any provider is actually authenticated before dispatching a
+            // task that is doomed to fail.  opencode counts as authenticated-when-installed.
+            const hasAuthenticatedProvider = mutableCtx.env.claude.authenticated ||
+                mutableCtx.env.codex.authenticated ||
+                mutableCtx.env.opencode.authenticated ||
+                mutableCtx.env.opencode.installed;
+            if (!hasAuthenticatedProvider) {
+                out.write('\n[info] No signed-in provider yet — press Ctrl+C to go back, then [j] Claude / [k] Codex / [o] opencode to sign in.\n');
+                continue;
+            }
             // Load prior history before each turn so the provider receives conversation
             // context. load() returns only the entries persisted so far — the current
             // user turn is appended by orchestrate() after this point, so there is no
             // double-inclusion risk.
             const priorHistory = await ctx.store.load(convId);
-            // Build per-provider advertised model sets from the live env so route()
-            // can prefer a model the CLI actually advertises. Only include installed
-            // providers (exactOptionalPropertyTypes is ON).
-            // Use mutableCtx.env (not ctx.env) so post-login re-detect is reflected.
-            const menuAvailableModels = {};
-            if (mutableCtx.env.claude.installed && mutableCtx.env.claude.availableModels.length > 0) {
-                menuAvailableModels['claude'] = mutableCtx.env.claude.availableModels;
-            }
-            if (mutableCtx.env.codex.installed && mutableCtx.env.codex.availableModels.length > 0) {
-                menuAvailableModels['codex'] = mutableCtx.env.codex.availableModels;
-            }
-            if (mutableCtx.env.opencode.installed && mutableCtx.env.opencode.availableModels.length > 0) {
-                menuAvailableModels['opencode'] = mutableCtx.env.opencode.availableModels;
-            }
-            // Collect authenticated providers from the live env so route() prefers
-            // signed-in providers over signed-out ones. Uses mutableCtx.env so
-            // post-login re-detection is reflected without restart.
-            const menuAuthenticatedProviders = [];
-            if (mutableCtx.env.claude.authenticated)
-                menuAuthenticatedProviders.push('claude');
-            if (mutableCtx.env.codex.authenticated)
-                menuAuthenticatedProviders.push('codex');
-            if (mutableCtx.env.opencode.authenticated)
-                menuAuthenticatedProviders.push('opencode');
-            const deps = {
-                clock: ctx.clock,
-                session: ctx.store.writer(convId),
-                ledger: ctx.ledger,
-                policy,
-                providers: ctx.providers,
-                cwd: ctx.cwd,
-                sandbox: ctx.sandbox,
-                timeoutMs: ctx.timeoutMs,
-                ...(priorHistory.length > 0 ? { history: priorHistory } : {}),
-                ...(Object.keys(menuAvailableModels).length > 0 ? { availableModels: menuAvailableModels } : {}),
-                ...(menuAuthenticatedProviders.length > 0 ? { authenticatedProviders: menuAuthenticatedProviders } : {}),
+            // ---- Build deps from the live mutableCtx.env ----------------------------
+            // This helper is inlined as a function so it can be called again after
+            // inline re-login with the refreshed env (bug 5 fix: no stale auth state).
+            const buildDeps = () => {
+                // Build per-provider advertised model sets from the live env so route()
+                // can prefer a model the CLI actually advertises. Only include installed
+                // providers (exactOptionalPropertyTypes is ON).
+                // Use mutableCtx.env (not ctx.env) so post-login re-detect is reflected.
+                const availableModels = {};
+                if (mutableCtx.env.claude.installed && mutableCtx.env.claude.availableModels.length > 0) {
+                    availableModels['claude'] = mutableCtx.env.claude.availableModels;
+                }
+                if (mutableCtx.env.codex.installed && mutableCtx.env.codex.availableModels.length > 0) {
+                    availableModels['codex'] = mutableCtx.env.codex.availableModels;
+                }
+                if (mutableCtx.env.opencode.installed && mutableCtx.env.opencode.availableModels.length > 0) {
+                    availableModels['opencode'] = mutableCtx.env.opencode.availableModels;
+                }
+                // Collect authenticated providers from the live env so route() prefers
+                // signed-in providers over signed-out ones. Uses mutableCtx.env so
+                // post-login re-detection is reflected without restart.
+                const authenticatedProviders = [];
+                if (mutableCtx.env.claude.authenticated)
+                    authenticatedProviders.push('claude');
+                if (mutableCtx.env.codex.authenticated)
+                    authenticatedProviders.push('codex');
+                if (mutableCtx.env.opencode.authenticated)
+                    authenticatedProviders.push('opencode');
+                return {
+                    clock: ctx.clock,
+                    session: ctx.store.writer(convId),
+                    ledger: ctx.ledger,
+                    policy,
+                    providers: ctx.providers,
+                    cwd: ctx.cwd,
+                    sandbox: ctx.sandbox,
+                    timeoutMs: ctx.timeoutMs,
+                    ...(priorHistory.length > 0 ? { history: priorHistory } : {}),
+                    ...(Object.keys(availableModels).length > 0 ? { availableModels } : {}),
+                    ...(authenticatedProviders.length > 0 ? { authenticatedProviders } : {}),
+                };
             };
+            const deps = buildDeps();
             const ac = new AbortController();
             currentAc = ac;
             const result = await runTask(line, deps, out, ac.signal);
             currentAc = null;
-            // Check for a loopBreaker signal that fired during the task (e.g. 3×Ctrl+C
-            // while runTask was awaited — the abort fires and the flag is set).
+            // Check for SIGINT-driven signals that fired while runTask was awaited.
             if (shouldExit) {
                 loopResult = 'exit';
                 break;
             }
+            // Bug 3 fix: shouldMenu may have been set by a 2×Ctrl+C during the task.
+            if (shouldMenu) {
+                loopResult = 'menu';
+                break;
+            }
             // Inline re-login on auth failure: offer to sign in and retry once.
             if (result.final !== undefined &&
                 !result.final.success &&
@@ -924,16 +981,23 @@ async function runChatLoop(ctx, mutableCtx, convId, out, readLine, loginFn, dete
                 const ans = await readLine();
                 if (parseYesNo(ans, true)) {
                     await loginFn(out, failingProvider, { readLine });
+                    // Bug 5 fix: re-detect with the freshly-authenticated env so the retry
+                    // deps reflect the now-signed-in provider (not the stale pre-login state).
                     mutableCtx.env = await detectEnvironmentFn();
+                    const retryDeps = buildDeps();
                     // Retry the same task once.
                     const retryAc = new AbortController();
                     currentAc = retryAc;
-                    const retryResult = await runTask(line, deps, out, retryAc.signal);
+                    const retryResult = await runTask(line, retryDeps, out, retryAc.signal);
                     currentAc = null;
                     if (shouldExit) {
                         loopResult = 'exit';
                         break;
                     }
+                    if (shouldMenu) {
+                        loopResult = 'menu';
+                        break;
+                    }
                     // If still auth failure after retry, inform and continue to prompt.
                     if (retryResult.final !== undefined &&
                         !retryResult.final.success &&
@@ -1082,13 +1146,15 @@ export async function startMenu(ctx, out) {
         if (checkForUpdateFn !== undefined) {
             updateInfo = await checkForUpdateFn().catch(() => undefined);
         }
-        // ---- Opt-in auto-update at launch ----------------------------------------
+        // ---- Auto-update at launch (default ON) ----------------------------------
         // Guard: only runs once; requires both the update and relaunch seams to be wired.
-        if (mutableCtx.config.autoUpdate === true &&
+        // Disabled when MYSHELL_NO_UPDATE is set in the environment or autoUpdate===false.
+        if (autoUpdateEnabled(mutableCtx.config, process.env) &&
             updateInfo?.updateAvailable === true &&
             updateInfo.latest !== null &&
             updateSelfFn !== undefined) {
-            out.write(`▲ Auto-updating ${updateInfo.current} → ${updateInfo.latest}…\n`);
+            out.write(`▲ Auto-updating ${updateInfo.current} → ${updateInfo.latest}…` +
+                `  (disable: Settings → Auto-update, or MYSHELL_NO_UPDATE=1)\n`);
             const ok = await updateSelfFn(out).catch(() => false);
             if (ok) {
                 if (relaunchFn !== undefined) {