nimi-code 1.0.0 → 1.1.0

package/dist/main.js

@@ -797,6 +797,69 @@ var init_permissions = __esm({
   }
 });
 
+// src/config/auth.ts
+import { mkdirSync, readFileSync } from "fs";
+import { mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+function getAuthPath() {
+  return join5(homedir2(), ".nimi", "auth.json");
+}
+function parseAuthJson(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
+    const out = {};
+    for (const [id, cred] of Object.entries(parsed)) {
+      if (typeof cred === "object" && cred !== null && !Array.isArray(cred)) {
+        const key = cred.key;
+        if (key === void 0 || typeof key === "string") out[id] = { type: "api_key", key };
+      }
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function readAuthFileSync(authPath = getAuthPath()) {
+  try {
+    return parseAuthJson(readFileSync(authPath, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function getStoredKeySync(providerId, authPath) {
+  const key = readAuthFileSync(authPath)[providerId]?.key;
+  return key ? key : void 0;
+}
+function resolveKeySync(providerId, envVar) {
+  return getStoredKeySync(providerId) || process.env[envVar] || void 0;
+}
+function formatNoApiKeyFoundMessage(providerId, envVar) {
+  return `No API key found for ${providerId}. Run /login ${providerId} (or set ${envVar}). Credentials are saved to ${getAuthPath()}.`;
+}
+async function saveApiKey(providerId, key, authPath = getAuthPath()) {
+  const data = readAuthFileSync(authPath);
+  data[providerId] = { type: "api_key", key };
+  mkdirSync(dirname2(authPath), { recursive: true, mode: 448 });
+  await writeFile3(authPath, `${JSON.stringify(data, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+}
+async function deleteApiKey(providerId, authPath = getAuthPath()) {
+  const data = readAuthFileSync(authPath);
+  if (!(providerId in data)) return false;
+  delete data[providerId];
+  await mkdir2(dirname2(authPath), { recursive: true, mode: 448 });
+  await writeFile3(authPath, `${JSON.stringify(data, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+  return true;
+}
+var init_auth = __esm({
+  "src/config/auth.ts"() {
+    "use strict";
+  }
+});
+
 // src/providers/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";
 function toAnthropic(message) {
@@ -1018,50 +1081,72 @@ var init_openai_compat = __esm({
 });
 
 // src/providers/index.ts
-function requireKey(envVar, provider2) {
-  const key = process.env[envVar];
-  if (!key) throw new Error(`Missing ${envVar} for ${provider2}. Add it to .env or environment.`);
-  return key;
+function listProviders() {
+  return Object.values(PROVIDER_DEFS);
+}
+function getProviderMeta(name) {
+  const meta = PROVIDER_DEFS[name];
+  if (!meta) {
+    throw new Error(`Unknown provider: ${name}. Available: ${Object.keys(PROVIDER_DEFS).join(", ")}`);
+  }
+  return meta;
+}
+function getProviderDefaultModel(name) {
+  return getProviderMeta(name).defaultModel;
 }
 function getProvider(name) {
-  const create = providers[name];
-  if (!create) {
-    throw new Error(`Unknown provider: ${name}. Available: ${Object.keys(providers).join(", ")}`);
+  const meta = getProviderMeta(name);
+  const key = resolveKeySync(meta.id, meta.envVar);
+  if (!key) throw new MissingApiKeyError(meta.id, meta.envVar);
+  if (!process.env[meta.envVar]) process.env[meta.envVar] = key;
+  if (meta.kind === "anthropic") {
+    return createAnthropic();
   }
-  return create();
+  return createOpenAICompat(meta.id, meta.baseURL, key, meta.defaultModel);
 }
-var providers;
+var PROVIDER_DEFS, MissingApiKeyError;
 var init_providers = __esm({
   "src/providers/index.ts"() {
     "use strict";
+    init_auth();
     init_anthropic();
     init_openai_compat();
-    providers = {
-      anthropic: createAnthropic,
-      "anthropic-openai": () => createOpenAICompat("anthropic-openai", "https://api.anthropic.com/v1/", requireKey("ANTHROPIC_API_KEY", "anthropic-openai"), "claude-sonnet-5"),
-      "groq": () => createOpenAICompat("groq", "https://api.groq.com/openai/v1", requireKey("GROQ_API_KEY", "groq"), "qwen/qwen3.8-27b"),
-      "meta": () => createOpenAICompat("meta", "https://api.meta.ai/v1", requireKey("META_API_KEY", "meta"), "muse-spark-1.3-contributor"),
-      "deepseek": () => createOpenAICompat("deepseek", "https://api.deepseek.com", requireKey("DEEPSEEK_API_KEY", "deepseek"), "deepseek-flash"),
-      "openai": () => createOpenAICompat("openai", "https://api.openai.com/v1", requireKey("OPENAI_API_KEY", "openai"), "gpt-4o-mini")
+    PROVIDER_DEFS = {
+      anthropic: { id: "anthropic", label: "Anthropic", envVar: "ANTHROPIC_API_KEY", defaultModel: "claude-sonnet-5", kind: "anthropic" },
+      "anthropic-openai": { id: "anthropic-openai", label: "Anthropic (OpenAI-compatible)", envVar: "ANTHROPIC_API_KEY", defaultModel: "claude-sonnet-5", baseURL: "https://api.anthropic.com/v1/", kind: "openai-compat" },
+      groq: { id: "groq", label: "Groq", envVar: "GROQ_API_KEY", defaultModel: "qwen/qwen3.8-27b", baseURL: "https://api.groq.com/openai/v1", kind: "openai-compat" },
+      meta: { id: "meta", label: "Meta", envVar: "META_API_KEY", defaultModel: "muse-spark-1.3-contributor", baseURL: "https://api.meta.ai/v1", kind: "openai-compat" },
+      deepseek: { id: "deepseek", label: "DeepSeek", envVar: "DEEPSEEK_API_KEY", defaultModel: "deepseek-flash", baseURL: "https://api.deepseek.com", kind: "openai-compat" },
+      openai: { id: "openai", label: "OpenAI", envVar: "OPENAI_API_KEY", defaultModel: "gpt-4o-mini", baseURL: "https://api.openai.com/v1", kind: "openai-compat" }
+    };
+    MissingApiKeyError = class extends Error {
+      provider;
+      envVar;
+      constructor(provider2, envVar) {
+        super(formatNoApiKeyFoundMessage(provider2, envVar));
+        this.name = "MissingApiKeyError";
+        this.provider = provider2;
+        this.envVar = envVar;
+      }
     };
   }
 });
 
 // src/session/store.ts
 import { existsSync as existsSync3 } from "fs";
-import { appendFile, mkdir as mkdir2, readdir as readdir4, readFile as readFile6 } from "fs/promises";
-import { join as join5 } from "path";
+import { appendFile, mkdir as mkdir3, readdir as readdir4, readFile as readFile6 } from "fs/promises";
+import { join as join6 } from "path";
 function getSessionDir() {
-  return join5(process.cwd(), ".nimi", "sessions");
+  return join6(process.cwd(), ".nimi", "sessions");
 }
 function getSessionPath(id) {
-  return join5(getSessionDir(), id + ".jsonl");
+  return join6(getSessionDir(), id + ".jsonl");
 }
 function newSessionId() {
   return Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
 }
 async function appendEntry(id, entry) {
-  await mkdir2(getSessionDir(), { recursive: true });
+  await mkdir3(getSessionDir(), { recursive: true });
   await appendFile(getSessionPath(id), JSON.stringify(entry) + "\n", "utf-8");
 }
 async function appendMessages(id, messages) {
@@ -1089,7 +1174,7 @@ async function loadSession(id) {
   return { info, messages };
 }
 async function listSessions() {
-  await mkdir2(getSessionDir(), { recursive: true });
+  await mkdir3(getSessionDir(), { recursive: true });
   const files = await readdir4(getSessionDir());
   const ids = [];
   for (const f of files) {
@@ -1105,13 +1190,13 @@ var init_store = __esm({
 });
 
 // src/trace/recorder.ts
-import { appendFileSync, mkdirSync, writeFileSync } from "fs";
-import { dirname as dirname2 } from "path";
+import { appendFileSync, mkdirSync as mkdirSync2, writeFileSync } from "fs";
+import { dirname as dirname3 } from "path";
 function isSnapshotEvent(type) {
   return type === "turn_end" || type === "agent_end" || type === "compacted";
 }
 function createTraceRecorder(path, info) {
-  mkdirSync(dirname2(path), { recursive: true });
+  mkdirSync2(dirname3(path), { recursive: true });
   writeFileSync(
     path,
     JSON.stringify({
@@ -1235,6 +1320,8 @@ function nameToAction(name, arg = "") {
   if (name === "compact") return { type: "compact" };
   if (name === "context") return { type: "context" };
   if (name === "model") return { type: "model", arg: arg.trim() };
+  if (name === "login") return { type: "login", arg: arg.trim() };
+  if (name === "logout") return { type: "logout", arg: arg.trim() };
   if (name === "tools") return { type: "tools" };
   if (name === "sessions") return { type: "sessions" };
   if (name === "session") return { type: "session" };
@@ -1245,7 +1332,7 @@ var HELP_TEXT;
 var init_slash = __esm({
   "src/tui/slash.ts"() {
     "use strict";
-    HELP_TEXT = "Commands:\n  /help      Show this help\n  /clear     Clear the transcript\n  /compact   Summarize old history to free context\n  /context   Show token usage vs the window\n  /model [id]  List models, or switch (keeps history)\n  /tools     List the tools the model can call\n  /sessions  List saved sessions\n  /session   Show this session's resume command\n  /quit      Exit nimi";
+    HELP_TEXT = "Commands:\n  /help      Show this help\n  /clear     Clear the transcript\n  /compact   Summarize old history to free context\n  /context   Show token usage vs the window\n  /model [id]  List models, or switch (keeps history)\n  /login [provider]  Sign in with an API key (saved to ~/.nimi/auth.json)\n  /logout [provider] Remove a saved API key\n  /tools     List the tools the model can call\n  /sessions  List saved sessions\n  /session   Show this session's resume command\n  /quit      Exit nimi";
   }
 });
 
@@ -1314,7 +1401,7 @@ function ToolRow({ row }) {
     ] })
   ] });
 }
-function App({ provider: provider2, model: model2, system: system2, tools, initialPrompt, yolo, sessionId, initialMessages, contextLimit }) {
+function App({ provider: provider2, model: model2, system: system2, tools, initialPrompt, yolo, sessionId, initialMessages, contextLimit, initialSetup }) {
   const { exit } = useApp();
   const [rows, setRows] = useState([]);
   const [draft, setDraft] = useState("");
@@ -1322,6 +1409,9 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
   const [error, setError] = useState(null);
   const [session, setSession] = useState(0);
   const [pending, setPending] = useState(null);
+  const [authFlow, setAuthFlow] = useState(null);
+  const [keyDraft, setKeyDraft] = useState("");
+  const [authError, setAuthError] = useState(null);
   const idRef = useRef(1);
   const messagesRef = useRef([...initialMessages]);
   const savedCount = useRef(initialMessages.length);
@@ -1359,6 +1449,83 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
     },
     [yolo]
   );
+  const openKeyPrompt = useCallback(
+    (providerId) => {
+      try {
+        const meta = getProviderMeta(providerId);
+        setKeyDraft("");
+        setAuthError(null);
+        setAuthFlow({ step: "key", providerId: meta.id, envVar: meta.envVar });
+      } catch (e) {
+        const id = nextId();
+        setRows((prev) => [...prev, { kind: "text", id, text: e instanceof Error ? e.message : String(e) }]);
+      }
+    },
+    [nextId]
+  );
+  const openProviderPicker = useCallback((mode) => {
+    setAuthError(null);
+    setAuthFlow({ step: "provider", mode, selected: 0 });
+  }, []);
+  const submitKey = useCallback(
+    async (providerId, key) => {
+      const trimmed = key.trim();
+      if (!trimmed) {
+        setAuthError("Empty key \u2014 paste an API key, or press esc to go back.");
+        return;
+      }
+      try {
+        await saveApiKey(providerId, trimmed);
+        const created = getProvider(providerId);
+        setActiveProvider(created);
+        const current = getModelInfo(activeModel);
+        setActiveModel(current?.provider === providerId ? activeModel : created.defaultModel);
+        setAuthFlow(null);
+        setKeyDraft("");
+        setAuthError(null);
+        setError(null);
+        const id = nextId();
+        setRows((prev) => [...prev, { kind: "text", id, text: `Saved API key for ${providerId} to ${getAuthPath()}.` }]);
+      } catch (e) {
+        setAuthError(e instanceof Error ? e.message : String(e));
+      }
+    },
+    [activeModel, nextId]
+  );
+  const runLogout = useCallback(
+    async (providerId, echoCommand) => {
+      const id = nextId();
+      try {
+        getProviderMeta(providerId);
+      } catch (e) {
+        setRows((prev) => [...prev, { kind: "user", id, text: echoCommand }, { kind: "text", id: id + 1, text: e instanceof Error ? e.message : String(e) }]);
+        idRef.current++;
+        return;
+      }
+      const removed = await deleteApiKey(providerId);
+      if (removed) delete process.env[getProviderMeta(providerId).envVar];
+      setAuthFlow(null);
+      const stillConfigured = (() => {
+        try {
+          getProvider(providerId);
+          return true;
+        } catch {
+          return false;
+        }
+      })();
+      if (activeProvider?.name === providerId && !stillConfigured) {
+        setActiveProvider(null);
+        setAuthFlow({ step: "provider", mode: "login", selected: 0 });
+      }
+      setRows((prev) => [
+        ...prev,
+        { kind: "user", id, text: echoCommand },
+        { kind: "text", id: id + 1, text: removed ? `Removed stored API key for ${providerId}. Environment variables are unchanged.` : `No stored API key for ${providerId}.` }
+      ]);
+      idRef.current++;
+    },
+    [activeProvider, nextId]
+  );
   const submitPrompt = useCallback(
     async (prompt) => {
       const text = prompt.trim();
@@ -1377,6 +1544,24 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
           setSession((s) => s + 1);
           return;
         }
+        if (slash.type === "login") {
+          const id2 = nextId();
+          if (!slash.arg) {
+            setRows((prev) => [...prev, { kind: "user", id: id2, text }]);
+            idRef.current++;
+            openProviderPicker("login");
+          } else {
+            setRows((prev) => [...prev, { kind: "user", id: id2, text }]);
+            idRef.current++;
+            openKeyPrompt(slash.arg);
+          }
+          return;
+        }
+        if (slash.type === "logout") {
+          if (!slash.arg) openProviderPicker("logout");
+          else await runLogout(slash.arg, text);
+          return;
+        }
         if (slash.type === "model") {
           const id2 = nextId();
           if (!slash.arg) {
@@ -1393,6 +1578,7 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
                 setRows((prev) => [...prev, { kind: "user", id: id2, text }, { kind: "text", id: id2 + 1, text: `Switched to ${info.id} \u2014 history kept.` }]);
               } catch (e) {
                 setRows((prev) => [...prev, { kind: "user", id: id2, text }, { kind: "text", id: id2 + 1, text: e instanceof Error ? e.message : String(e) }]);
+                if (e instanceof MissingApiKeyError) openKeyPrompt(e.provider);
               }
             }
           }
@@ -1436,6 +1622,12 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
         if (slash.type === "compact") {
           if (workingRef.current) return;
           const id2 = nextId();
+          if (!activeProvider) {
+            setRows((prev) => [...prev, { kind: "user", id: id2, text }, { kind: "text", id: id2 + 1, text: "Not logged in. Run /login to add an API key first." }]);
+            idRef.current++;
+            openProviderPicker("login");
+            return;
+          }
           if (messagesRef.current.length === 0) {
             setRows((prev) => [...prev, { kind: "user", id: id2, text }, { kind: "text", id: id2 + 1, text: "Nothing to compact." }]);
             idRef.current++;
@@ -1476,6 +1668,12 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
         return;
       }
       const userId = nextId();
+      if (!activeProvider) {
+        setRows((prev) => [...prev, { kind: "user", id: userId, text }, { kind: "text", id: userId + 1, text: "Not logged in. Pick a provider to add its API key." }]);
+        idRef.current++;
+        if (!authFlow) openProviderPicker("login");
+        return;
+      }
       setRows((prev) => [...prev, { kind: "user", id: userId, text }]);
       messagesRef.current.push({ role: "user", content: text });
       workingRef.current = true;
@@ -1543,9 +1741,44 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
         }
       }
     },
-    [appendText, canUseTool, contextLimit, exit, activeModel, activeProvider, nextId, sessionId, system2, tools]
+    [appendText, canUseTool, contextLimit, exit, activeModel, activeProvider, authFlow, nextId, openKeyPrompt, openProviderPicker, runLogout, sessionId, system2, tools]
   );
   useInput((input, key) => {
+    if (authFlow?.step === "provider") {
+      const options = listProviders();
+      if (key.upArrow) {
+        setAuthFlow((prev) => prev?.step === "provider" ? { ...prev, selected: (prev.selected + options.length - 1) % options.length } : prev);
+        return;
+      }
+      if (key.downArrow) {
+        setAuthFlow((prev) => prev?.step === "provider" ? { ...prev, selected: (prev.selected + 1) % options.length } : prev);
+        return;
+      }
+      if (key.return) {
+        const current = authFlow;
+        const picked = options[current.selected];
+        if (!picked) return;
+        if (current.mode === "login") {
+          setKeyDraft("");
+          setAuthError(null);
+          setAuthFlow({ step: "key", providerId: picked.id, envVar: picked.envVar });
+        } else {
+          void runLogout(picked.id, `/logout ${picked.id}`);
+        }
+        return;
+      }
+      if (key.escape && activeProvider) {
+        setAuthFlow(null);
+        setAuthError(null);
+      }
+      return;
+    }
+    if (authFlow?.step === "key" && key.escape) {
+      setAuthFlow({ step: "provider", mode: "login", selected: 0 });
+      setAuthError(null);
+      setKeyDraft("");
+      return;
+    }
     if (pending) {
       const ch = input.toLowerCase();
       if (ch === "y") pending.resolve("yes");
@@ -1558,11 +1791,16 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
     }
   });
   useEffect(() => {
-    if (!startedRef.current && initialPrompt) {
+    if (!activeProvider && initialSetup && !authFlow) {
+      setAuthFlow({ step: "key", providerId: initialSetup.providerName, envVar: initialSetup.envVar });
+    }
+  }, [activeProvider, initialSetup, authFlow]);
+  useEffect(() => {
+    if (!startedRef.current && initialPrompt && activeProvider) {
       startedRef.current = true;
       void submitPrompt(initialPrompt);
     }
-  }, [initialPrompt, submitPrompt]);
+  }, [initialPrompt, submitPrompt, activeProvider]);
   const settled = rows.length > 0 ? rows.slice(0, -1) : [];
   const live = rows.length > 0 ? rows[rows.length - 1] : null;
   return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
@@ -1570,6 +1808,60 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
     rows.length === 0 && /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { dimColor: true, children: initialMessages.length > 0 ? `Resumed session \u2014 ${initialMessages.length} messages restored. Type, or /help.` : "Type a message, or /help." }) }),
     /* @__PURE__ */ jsx(Static, { items: settled, children: (row) => renderRow(row) }, session),
     live && renderRow(live),
+    authFlow?.step === "provider" && /* @__PURE__ */ jsxs(Box, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { bold: true, children: authFlow.mode === "login" ? "Select a provider to log in:" : "Select a provider to log out:" }),
+      listProviders().map((p, i) => {
+        const selected = i === authFlow.selected;
+        const saved = getStoredKeySync(p.id) ? "  \u2713 saved" : "";
+        return /* @__PURE__ */ jsxs(Text, { color: selected ? "cyan" : void 0, dimColor: !selected, children: [
+          selected ? "\u2192 " : "  ",
+          p.label,
+          " ",
+          /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+            "(",
+            p.id,
+            ")",
+            saved
+          ] })
+        ] }, p.id);
+      }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "\u2191\u2193 navigate \xB7 enter select",
+        activeProvider ? " \xB7 esc cancel" : ""
+      ] })
+    ] }),
+    authFlow?.step === "key" && /* @__PURE__ */ jsxs(Box, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs(Text, { bold: true, children: [
+        "Login to ",
+        authFlow.providerId
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "Paste ",
+        authFlow.envVar,
+        " \u2014 saved to ",
+        getAuthPath()
+      ] }),
+      /* @__PURE__ */ jsxs(Box, { marginTop: 1, children: [
+        /* @__PURE__ */ jsx(Text, { dimColor: true, children: "\u203A " }),
+        /* @__PURE__ */ jsx(
+          TextInput,
+          {
+            value: keyDraft,
+            onChange: setKeyDraft,
+            onSubmit: (value) => {
+              void submitKey(authFlow.providerId, value);
+            },
+            placeholder: "sk-\u2026",
+            mask: "*"
+          }
+        )
+      ] }),
+      authError && /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { color: "red", children: [
+        "\u2715 ",
+        authError
+      ] }) }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: "enter save \xB7 esc back" })
+    ] }),
     pending && /* @__PURE__ */ jsxs(Box, { marginTop: 1, flexDirection: "column", children: [
       /* @__PURE__ */ jsxs(Text, { color: "yellow", children: [
         "Permission needed: ",
@@ -1581,7 +1873,7 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
       "\u2715 ",
       error
     ] }) }),
-    /* @__PURE__ */ jsxs(Box, { marginTop: 1, children: [
+    !authFlow && /* @__PURE__ */ jsxs(Box, { marginTop: 1, children: [
       /* @__PURE__ */ jsx(Text, { dimColor: working, children: "\u203A " }),
       /* @__PURE__ */ jsx(
         TextInput,
@@ -1593,11 +1885,11 @@ function App({ provider: provider2, model: model2, system: system2, tools, initi
             setDraft("");
             void submitPrompt(value);
           },
-          placeholder: pending ? "answer y/a/n\u2026" : working ? "working\u2026" : "Ask nimi\u2026"
+          placeholder: pending ? "answer y/a/n\u2026" : working ? "working\u2026" : activeProvider ? "Ask nimi\u2026" : "Run /login\u2026"
         }
       )
     ] }),
-    /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsx(Text, { dimColor: true, children: working ? "working\u2026 esc to interrupt" : "enter send \xB7 /help /clear /quit \xB7 esc interrupt" }) })
+    /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsx(Text, { dimColor: true, children: authFlow ? "login flow \xB7 esc back" : working ? "working\u2026 esc to interrupt" : "enter send \xB7 /login /model /help \xB7 esc interrupt" }) })
   ] });
 }
 var DIVIDER_MAX;
@@ -1608,6 +1900,7 @@ var init_App = __esm({
     init_compaction();
     init_models();
     init_providers();
+    init_auth();
     init_store();
     init_format();
     init_slash();
@@ -1630,6 +1923,21 @@ async function runClassic(opts) {
   const canUseTool = opts.yolo ? allowAll() : createPromptPermission(rl);
   let trace = null;
   const ask = (q) => new Promise((resolve7) => rl.question(q, resolve7));
+  const ensureKey = async (providerId) => {
+    try {
+      const meta = getProviderMeta(providerId);
+      const answer = (await ask(`Enter ${meta.envVar} for ${providerId} (saved to ${getAuthPath()}): `)).trim();
+      if (!answer) {
+        console.log("Empty key \u2014 cancelled.");
+        return false;
+      }
+      await saveApiKey(providerId, answer);
+      return true;
+    } catch (e) {
+      console.log(e instanceof Error ? e.message : String(e));
+      return false;
+    }
+  };
   console.log(`nimi ${model2} \xB7 session ${opts.sessionId.slice(-6)} \xB7 /help for commands`);
   if (messages.length > 0) console.log(`Resumed \u2014 ${messages.length} messages restored.`);
   if (opts.yolo) console.log("Permission prompts off (--yolo).");
@@ -1654,6 +1962,10 @@ async function runClassic(opts) {
         continue;
       }
       if (slash.type === "compact") {
+        if (!provider2) {
+          console.log("Not logged in. Use /login <provider> first.");
+          continue;
+        }
         const result = await compactMessages(messages, provider2, model2);
         if (!result.compacted) console.log("History is already short.");
         else {
@@ -1676,11 +1988,66 @@ async function runClassic(opts) {
               console.log(`Switched to ${model2} \u2014 history kept.`);
             } catch (e) {
               console.log(e instanceof Error ? e.message : String(e));
+              if (e instanceof MissingApiKeyError && await ensureKey(e.provider)) {
+                try {
+                  provider2 = getProvider(info.provider);
+                  model2 = info.id;
+                  console.log(`Switched to ${model2} \u2014 history kept.`);
+                } catch (retry) {
+                  console.log(retry instanceof Error ? retry.message : String(retry));
+                }
+              }
             }
           }
         }
         continue;
       }
+      if (slash.type === "login") {
+        if (!slash.arg) {
+          console.log("Usage: /login <provider>");
+          continue;
+        }
+        try {
+          getProviderMeta(slash.arg);
+        } catch (e) {
+          console.log(e instanceof Error ? e.message : String(e));
+          continue;
+        }
+        if (await ensureKey(slash.arg)) {
+          try {
+            provider2 = getProvider(slash.arg);
+            const current = getModelInfo(model2);
+            model2 = current?.provider === slash.arg ? model2 : provider2.defaultModel;
+            console.log(`Logged in to ${slash.arg}. Credentials saved to ${getAuthPath()}.`);
+          } catch (e) {
+            console.log(e instanceof Error ? e.message : String(e));
+          }
+        }
+        continue;
+      }
+      if (slash.type === "logout") {
+        if (!slash.arg) {
+          console.log("Usage: /logout <provider>");
+          continue;
+        }
+        try {
+          getProviderMeta(slash.arg);
+        } catch (e) {
+          console.log(e instanceof Error ? e.message : String(e));
+          continue;
+        }
+        const removed = await deleteApiKey(slash.arg);
+        console.log(removed ? `Removed stored API key for ${slash.arg}. Environment variables are unchanged.` : `No stored API key for ${slash.arg}.`);
+        if (provider2?.name === slash.arg) {
+          try {
+            provider2 = getProvider(slash.arg);
+          } catch {
+            provider2 = null;
+            console.log(`Logged out of ${slash.arg} \u2014 add a key with /login or switch with /model.`);
+          }
+        }
+        continue;
+      }
       if (slash.type === "tools") {
         for (const t of ALL_TOOLS) console.log(`  ${t.name}${t.readOnly ? "  [read-only]" : "  [asks permission]"}`);
         continue;
@@ -1701,6 +2068,10 @@ async function runClassic(opts) {
       console.log(`Unknown command: ${slash.name}. Try /help.`);
       continue;
     }
+    if (!provider2) {
+      console.log("Not logged in. Use /login <provider> first.");
+      continue;
+    }
     messages.push({ role: "user", content: line });
     if (opts.tracePath && !trace) {
       trace = createTraceRecorder(opts.tracePath, {
@@ -1743,6 +2114,7 @@ var init_classic = __esm({
     init_agent();
     init_compaction();
     init_providers();
+    init_auth();
     init_models();
     init_permissions();
     init_store();
@@ -1865,7 +2237,11 @@ OPTIONS
   -h, --help             Show this help
 
 PROVIDERS
-  anthropic, anthropic-openai, groq, meta, deepseek
+  anthropic, anthropic-openai, groq, meta, deepseek, openai
+
+AUTH
+  First run opens /login in the TUI (keys saved to ~/.nimi/auth.json).
+  Headless/CI: export the provider's key instead (e.g. META_API_KEY).
 
 EXAMPLES
   nimi -p "explain this codebase"
@@ -1874,7 +2250,7 @@ EXAMPLES
 `);
 }
 function printVersion() {
-  console.log(`nimi ${true ? "1.0.0" : "dev"}`);
+  console.log(`nimi ${true ? "1.1.0" : "dev"}`);
 }
 
 // src/config/system-prompt.ts
@@ -1945,6 +2321,7 @@ async function readJsonSafe(path) {
 // src/main.tsx
 init_permissions();
 init_providers();
+init_auth();
 init_store();
 init_recorder();
 init_tools();
@@ -1967,9 +2344,6 @@ if (args.version) {
   process.exit(0);
 }
 var settings = await loadSettings();
-var provider = getProvider(args.provider ?? settings.provider ?? "meta");
-var model = args.model ?? settings.model ?? provider.defaultModel;
-var system = await buildSystemPrompt(settings.systemPromptExtra);
 if (args.listSessions) {
   const ids = await listSessions();
   if (ids.length === 0) console.log("No saved sessions yet.");
@@ -1988,7 +2362,37 @@ if (args.listSessions) {
   }
   process.exit(0);
 }
+var providerName = args.provider ?? settings.provider ?? "meta";
+var provider = null;
+var missingAuth = null;
+var model;
+try {
+  provider = getProvider(providerName);
+  model = args.model ?? settings.model ?? provider.defaultModel;
+} catch (e) {
+  if (e instanceof MissingApiKeyError) {
+    missingAuth = { providerName: e.provider, envVar: e.envVar };
+    try {
+      model = args.model ?? settings.model ?? getProviderDefaultModel(providerName);
+    } catch (unknownProvider) {
+      console.error(unknownProvider instanceof Error ? unknownProvider.message : String(unknownProvider));
+      process.exit(1);
+    }
+  } else {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+}
+var system = await buildSystemPrompt(settings.systemPromptExtra);
 if (!args.classic && (args.print || !process.stdin.isTTY || !process.stdout.isTTY)) {
+  if (missingAuth) {
+    console.error(`No API key found for ${missingAuth.providerName}. Set ${missingAuth.envVar}, or run "nimi" interactively and use /login ${missingAuth.providerName}.`);
+    process.exit(1);
+  }
+  if (!provider) {
+    console.error("No provider configured.");
+    process.exit(1);
+  }
   if (!args.prompt) {
     console.error('No prompt given. Run "nimi --help" for usage.');
     process.exit(1);
@@ -2069,13 +2473,34 @@ if (args.session) {
 } else {
   tuiSessionId = newSessionId();
   tuiMessages = [];
-  await appendEntry(tuiSessionId, { type: "session_info", id: tuiSessionId, created_at: (/* @__PURE__ */ new Date()).toISOString(), model, provider: provider.name });
+  await appendEntry(tuiSessionId, { type: "session_info", id: tuiSessionId, created_at: (/* @__PURE__ */ new Date()).toISOString(), model, provider: provider?.name ?? providerName });
 }
 if (args.classic) {
+  if (!provider && missingAuth) {
+    const askRl = createInterface2({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve7) => askRl.question(`No API key for ${missingAuth.providerName}. Enter ${missingAuth.envVar} (saved to ~/.nimi/auth.json): `, resolve7));
+    askRl.close();
+    if (!answer.trim()) {
+      console.error(`No API key given. Set ${missingAuth.envVar} or run "nimi" and use /login.`);
+      process.exit(1);
+    }
+    await saveApiKey(missingAuth.providerName, answer.trim());
+    try {
+      provider = getProvider(missingAuth.providerName);
+      model = args.model ?? settings.model ?? provider.defaultModel;
+    } catch (e) {
+      console.error(e instanceof Error ? e.message : String(e));
+      process.exit(1);
+    }
+  }
+  if (!provider) {
+    console.error("No provider configured.");
+    process.exit(1);
+  }
   const { runClassic: runClassic2 } = await Promise.resolve().then(() => (init_classic(), classic_exports));
   await runClassic2({ provider, model, system, tools: ALL_TOOLS, sessionId: tuiSessionId, initialMessages: tuiMessages, yolo: args.yolo, contextLimit: args.contextLimit, tracePath: args.trace });
   process.exit(0);
 }
 render(
-  /* @__PURE__ */ jsx2(App2, { provider, model, system, tools: ALL_TOOLS, initialPrompt: args.prompt, yolo: args.yolo, sessionId: tuiSessionId, initialMessages: tuiMessages, contextLimit: args.contextLimit })
+  /* @__PURE__ */ jsx2(App2, { provider, model, system, tools: ALL_TOOLS, initialPrompt: args.prompt, yolo: args.yolo, sessionId: tuiSessionId, initialMessages: tuiMessages, contextLimit: args.contextLimit, initialSetup: missingAuth })
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nimi-code",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Minimal coding agent: a language model with controlled access to your files, shell, and git.",
   "license": "ISC",
   "author": "",

package/readme.md

@@ -1,77 +1,187 @@
-# nimi — minimal coding agent
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/nimi-logo-dark.png">
+    <img alt="Nimi" src="docs/assets/nimi-logo-light.png" width="480">
+  </picture>
+</p>
 
-A lightweight terminal agent: a language model with controlled access to your
-files, shell, and git, running a read-act loop until the task is done.
+<p align="center">
+  <strong>A lightweight, open-source terminal coding-agent harness. Every step, inspectable.</strong>
+</p>
 
-```
+<p align="center">
+  <a href="https://www.npmjs.com/package/nimi-code"><img alt="npm version" src="https://img.shields.io/npm/v/nimi-code?style=flat-square"></a>
+  <a href="LICENSE"><img alt="license" src="https://img.shields.io/npm/l/nimi-code?style=flat-square"></a>
+</p>
+
+# nimi
+
+Nimi points a language model at your codebase and gives it controlled access to your files, shell, and git — read, search, write, edit, run commands — until the job is done. Read-only tools run freely; anything that mutates pauses at an explicit permission gate. Every run is recorded as a JSONL trace you can replay, and a browser playground visualizes a sample run step by step.
+
+What Nimi is **not**: not a model, not a subscription, not a hosted platform. You bring your own provider key, run everything on your own machine, and can fork the whole thing (ISC licensed).
+
+## Quickstart
+
+Requires **Node 22+** and one provider key.
+
+```bash
+npm install -g nimi-code
+export META_API_KEY=...   # or ANTHROPIC_API_KEY, GROQ_API_KEY, DEEPSEEK_API_KEY, OPENAI_API_KEY
+cd /path/to/your/project
 nimi "list the typescript files under src"
-echo "explain the agent loop" | nimi -p
-nimi --classic "refactor src/tools/grep.ts"
 ```
 
-## Quickstart
+That's it — Nimi opens an interactive session in your terminal. Give it a task in plain language.
+
+## Usage
 
-Requires Node 22+ and one provider key.
+| Mode | Command | Behavior |
+|---|---|---|
+| Interactive (default) | `nimi "task"` | Full terminal UI with streaming output |
+| Classic REPL | `nimi --classic "task"` | Plain readline loop, compact result previews |
+| One-shot | `nimi --print "task"` | Runs once, streams to stdout, exits (scriptable) |
+| Pipe | `echo ... \| nimi -p` | Prompt from stdin, no TTY needed |
+
+### Flags
 
 ```
-npm install -g nimi
-export META_API_KEY=...   # or ANTHROPIC_API_KEY, OPENAI_API_KEY, ...
-nimi "hello"
+nimi [message]            interactive (default)
+nimi --classic [message]  plain REPL
+nimi --print [message]    one-shot, streams to stdout
+echo ... | nimi -p        prompt from pipe
+
+-p, --prompt <text>       prompt to send
+-z, --provider <id>       anthropic, anthropic-openai, groq, meta (default), deepseek, openai
+    --model <id>          override the provider's default model
+    --session <id>        resume a session (--list-sessions to list)
+    --context-limit <n>   override context window
+    --trace <path>        write a JSONL showcase trace (print mode)
+    --classic --print --yolo
+-v, --version  -h, --help
 ```
 
-From source:
+### Slash commands (interactive mode)
+
+`/model` `/tools` `/sessions` `/session` `/compact` `/context` `/clear` `/help` `/quit` — bare `clear`, `quit`, `exit`, and `q` work too.
+
+Examples:
 
+```bash
+nimi -p "explain this codebase" --provider deepseek
+nimi "find all TODOs and write them to NOTES.md"
+nimi --session abc123 "continue where we left off"
+nimi --list-sessions
 ```
-npm install
-cp .env.example .env   # add your key(s)
-npm run build
-node bin/nimi.js "hello"
+
+## Tools & permissions
+
+Read-only tools run without asking. Mutating tools pause at a gate: `[y]es` / `[a]lways` / `[n]o` — `always` is remembered per tool for the session. Piped/non-TTY runs auto-allow (pass `--yolo` explicitly to skip prompts in a terminal).
+
+| Runs freely (read-only) | Asks first (mutating) |
+|---|---|
+| `read`, `ls`, `find`, `grep` | `write`, `edit`, `bash` |
+| `git_status`, `git_log`, `git_diff` | `git_add`, `git_commit`, `git_branch`, `git_checkout`, `git_reset` |
+
+Denying a tool doesn't crash the run — the model gets an error result (`User denied <name>…`) and decides what to do next.
+
+## Providers
+
+Nimi is provider-agnostic over OpenAI-compatible APIs. The default provider is `meta`.
+
+| Provider (`-z`) | Key | Default model |
+|---|---|---|
+| `anthropic` | `ANTHROPIC_API_KEY` | `claude-sonnet-5` |
+| `anthropic-openai` | `ANTHROPIC_API_KEY` | `claude-sonnet-5` (OpenAI-compatible endpoint) |
+| `groq` | `GROQ_API_KEY` | `qwen/qwen3.8-27b` |
+| `meta` (default) | `META_API_KEY` | `muse-spark-1.3-contributor` |
+| `deepseek` | `DEEPSEEK_API_KEY` | `deepseek-flash` |
+| `openai` | `OPENAI_API_KEY` | `gpt-4o-mini` |
+
+Override the model per run with `--model <id>`, per environment with `NIMI_MODEL`, or switch mid-session with `/model`.
+
+## Config, sessions, context
+
+Settings cascade (each level wins over the previous):
+
+`~/.nimi/settings.json` → `.nimi/settings.json` (project) → `NIMI_PROVIDER` / `NIMI_MODEL` → CLI flags
+
+Sessions persist per project in `.nimi/sessions/` — resume with `--session <id>`, list with `--list-sessions`. On startup Nimi also loads project context from `AGENTS.md`, `CLAUDE.md`, `.context`, and `.nimi/context.md` when present.
+
+## Traces
+
+Every run can be recorded as JSONL — one line per event and message snapshot — and resumed or inspected later:
+
+```bash
+nimi --print -p "find all TODOs" --trace demo/samples/showcase.jsonl
 ```
 
-```env
-ANTHROPIC_API_KEY=...
-GROQ_API_KEY=...
-META_API_KEY=...
-DEEPSEEK_API_KEY=...
-OPENAI_API_KEY=...
+The trace is the same artifact the web playground replays below: events fold into turns, tool calls, permission decisions, and terminal output.
+
+## Web playground (local)
+
+`demo/` is a static Vite + React app that replays the bundled sample trace — a trace viewer and explainer, not a live agent. No API key needed.
+
+```bash
+cd demo
+npm install
+npm run dev     # → http://localhost:5173
 ```
 
-## Usage
+- **Home** explains the harness; **Playground** (`#/playground`) is the workbench: Dataflow/Streaming graph, step inspector (Overview, Events, Context, Source, plus raw payload/stdout), timeline scrubber, keyboard shortcuts (`space` play, `←/→` step), and URL-addressable playback state.
+- The **sample selector** replays four lenses over the same trace (full run, denied-permission branch, Classic view, TUI view). **Allow/Deny only switches the replay branch** — it controls no live machine.
+- Production build: `npm run build` → `demo/dist/` (gitignored), deployable to any static host.
+
+## Architecture
 
 ```
-nimi [message]            Interactive TUI (default)
-nimi --classic [message]  Plain readline REPL (no Ink needed)
-nimi --print [message]    One-shot: stream the answer to stdout
-echo ... | nimi -p         Read the prompt from a pipe
-
-Options
-  -p, --prompt <text>  Prompt to send
-  -z, --provider <id>  anthropic, groq, meta, deepseek, openai, anthropic-openai
-      --model <id>     Model id (registry in src/providers/models.ts)
-      --session <id>   Resume a saved session (--list-sessions to list)
-      --context-limit <n>  Override the model's context window
-      --classic --print --yolo  REPL / one-shot / skip permission prompts
-  -v, --version  -h, --help
+prompt → parseArgs → settings → system prompt + tool catalog → runAgent()
+  → provider.stream() → assistant reply → permission gate → tool.execute()
+  → tool result → … → session file (.nimi/sessions/<id>.jsonl) + optional --trace JSONL
 ```
 
-TUI slash: `/model /tools /sessions /session /compact /context /clear /help /quit`.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/architecture-dark.svg">
+  <img alt="Nimi architecture map: shell and entry, config, session, agent loop, provider, tools, permissions, renderer" src="docs/assets/architecture-light.svg">
+</picture>
+
+Generated from the same graph data as the playground (`demo/src/data/architecture.js`). Regenerate with `node scripts/export-architecture-svg.mjs`.
+
+### Repo layout
+
+| Path | Contents |
+|---|---|
+| `bin/` | `nimi` executable entry |
+| `src/main.tsx` | CLI entry, mode router, trace wiring |
+| `src/agent.ts` | Agent loop (`runAgent`) |
+| `src/cli/` | Flag parser |
+| `src/config/` | Settings cascade, system prompt |
+| `src/providers/` | Anthropic + OpenAI-compatible providers, default models |
+| `src/tools/` | Read/write/shell/git tool implementations |
+| `src/permissions.ts` | `y/a/n` permission gate |
+| `src/session/` | JSONL session store |
+| `src/trace/` | JSONL trace recorder |
+| `src/modes/` `src/tui/` | Classic REPL and Ink terminal UI |
+| `demo/` | Static web playground (sample trace replay) |
+| `test/` | Offline tool tests |
+| `docs/assets/` | README logo and architecture diagram |
 
-## Tools (15)
+## Development
 
-Read-only (never prompt): `read ls find grep git_status git_log git_diff`.
-Ask `y/a/always/n` (or `--yolo`): `write edit bash` + `git_add git_commit
-git_branch git_checkout git_reset`. Output capped at 20000 chars, 30s timeouts.
+```bash
+npm install
+cp .env.example .env   # add one provider key
+npm run build          # build with tsup
+node bin/nimi.js "hello"
 
-## Config
+npm run check     # biome lint + tsc typecheck
+npm test          # offline tool tests (vitest)
+npm run test:tools
+```
 
-`~/.nimi/settings.json` < `.nimi/settings.json` < `NIMI_PROVIDER`/`NIMI_MODEL`
-< CLI flags. Sessions live in `.nimi/sessions/<id>.jsonl` (gitignored).
+## Contributing
 
-## Development
+Issues and pull requests are welcome. Run `npm run check` and `npm test` before submitting. See `AGENTS.md` for repo conventions (Astryx workflow for `demo/`, tokens, required checks).
 
-```
-npm run check       # biome lint + tsc --noEmit (0 errors)
-npm run test:tools  # offline tool suite, no keys (7 tests)
-```
+## License
 
-Context auto-compacts at 75% of the window (`/compact` for manual).
+[ISC](LICENSE) — do what you want, keep the copyright notice.