poe-code 3.0.68 → 3.0.69-beta.2

package/dist/index.js

@@ -31,34 +31,469 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/auth/src/encrypted-file-auth-store.ts
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import path from "node:path";
+function defaultMachineIdentity() {
+  return {
+    hostname: hostname(),
+    username: userInfo().username
+  };
+}
+async function deriveEncryptionKey(getMachineIdentity) {
+  const machineIdentity = await getMachineIdentity();
+  const secret = `${machineIdentity.hostname}:${machineIdentity.username}`;
+  return await new Promise((resolve, reject) => {
+    scrypt(secret, ENCRYPTION_SALT, ENCRYPTION_KEY_BYTES, (error2, derivedKey) => {
+      if (error2) {
+        reject(error2);
+        return;
+      }
+      resolve(Buffer.from(derivedKey));
+    });
+  });
+}
+function parseEncryptedDocument(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed)) {
+      return null;
+    }
+    if (parsed.version !== ENCRYPTION_VERSION) {
+      return null;
+    }
+    if (typeof parsed.iv !== "string" || typeof parsed.authTag !== "string" || typeof parsed.ciphertext !== "string") {
+      return null;
+    }
+    return {
+      version: parsed.version,
+      iv: parsed.iv,
+      authTag: parsed.authTag,
+      ciphertext: parsed.ciphertext
+    };
+  } catch {
+    return null;
+  }
+}
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isNotFoundError(error2) {
+  return Boolean(
+    error2 && typeof error2 === "object" && "code" in error2 && error2.code === "ENOENT"
+  );
+}
+var ENCRYPTION_ALGORITHM, ENCRYPTION_VERSION, ENCRYPTION_KEY_BYTES, ENCRYPTION_IV_BYTES, ENCRYPTION_AUTH_TAG_BYTES, ENCRYPTION_SALT, ENCRYPTION_FILE_MODE, EncryptedFileAuthStore;
+var init_encrypted_file_auth_store = __esm({
+  "packages/auth/src/encrypted-file-auth-store.ts"() {
+    "use strict";
+    ENCRYPTION_ALGORITHM = "aes-256-gcm";
+    ENCRYPTION_VERSION = 1;
+    ENCRYPTION_KEY_BYTES = 32;
+    ENCRYPTION_IV_BYTES = 12;
+    ENCRYPTION_AUTH_TAG_BYTES = 16;
+    ENCRYPTION_SALT = "poe-code:encrypted-file-auth-store:v1";
+    ENCRYPTION_FILE_MODE = 384;
+    EncryptedFileAuthStore = class {
+      fs;
+      filePath;
+      getMachineIdentity;
+      getRandomBytes;
+      keyPromise = null;
+      constructor(input = {}) {
+        this.fs = input.fs ?? fs;
+        this.filePath = input.filePath ?? path.join(
+          (input.getHomeDirectory ?? homedir)(),
+          ".poe-code",
+          "credentials.enc"
+        );
+        this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
+        this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+      }
+      async getApiKey() {
+        let rawDocument;
+        try {
+          rawDocument = await this.fs.readFile(this.filePath, "utf8");
+        } catch (error2) {
+          if (isNotFoundError(error2)) {
+            return null;
+          }
+          throw error2;
+        }
+        const document = parseEncryptedDocument(rawDocument);
+        if (!document) {
+          return null;
+        }
+        const key = await this.getEncryptionKey();
+        try {
+          const iv = Buffer.from(document.iv, "base64");
+          const authTag = Buffer.from(document.authTag, "base64");
+          const ciphertext = Buffer.from(document.ciphertext, "base64");
+          if (iv.byteLength !== ENCRYPTION_IV_BYTES || authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+            return null;
+          }
+          const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
+          decipher.setAuthTag(authTag);
+          const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+          return plaintext.toString("utf8");
+        } catch {
+          return null;
+        }
+      }
+      async setApiKey(apiKey) {
+        const key = await this.getEncryptionKey();
+        const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
+        const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
+        const ciphertext = Buffer.concat([
+          cipher.update(apiKey, "utf8"),
+          cipher.final()
+        ]);
+        const authTag = cipher.getAuthTag();
+        const document = {
+          version: ENCRYPTION_VERSION,
+          iv: iv.toString("base64"),
+          authTag: authTag.toString("base64"),
+          ciphertext: ciphertext.toString("base64")
+        };
+        await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
+        await this.fs.writeFile(this.filePath, JSON.stringify(document), {
+          encoding: "utf8"
+        });
+        await this.fs.chmod(this.filePath, ENCRYPTION_FILE_MODE);
+      }
+      async deleteApiKey() {
+        try {
+          await this.fs.unlink(this.filePath);
+        } catch (error2) {
+          if (!isNotFoundError(error2)) {
+            throw error2;
+          }
+        }
+      }
+      getEncryptionKey() {
+        if (!this.keyPromise) {
+          this.keyPromise = deriveEncryptionKey(this.getMachineIdentity);
+        }
+        return this.keyPromise;
+      }
+    };
+  }
+});
+
+// packages/auth/src/keychain-auth-store.ts
+import { spawn } from "node:child_process";
+function runSecurityCommand(command, args) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error2) => {
+      const message = error2 instanceof Error ? error2.message : String(error2 ?? "Unknown error");
+      resolve({
+        stdout,
+        stderr: stderr ? `${stderr}${message}` : message,
+        exitCode: 127
+      });
+    });
+    child.on("close", (code) => {
+      resolve({
+        stdout,
+        stderr,
+        exitCode: code ?? 0
+      });
+    });
+  });
+}
+function stripTrailingLineBreak(value) {
+  if (value.endsWith("\r\n")) {
+    return value.slice(0, -2);
+  }
+  if (value.endsWith("\n") || value.endsWith("\r")) {
+    return value.slice(0, -1);
+  }
+  return value;
+}
+function isKeychainEntryNotFound(result) {
+  if (result.exitCode === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE) {
+    return true;
+  }
+  const output = `${result.stderr}
+${result.stdout}`.toLowerCase();
+  return output.includes("could not be found") || output.includes("item not found") || output.includes("errsecitemnotfound");
+}
+function createSecurityCliFailure(operation, result) {
+  const details = result.stderr.trim() || result.stdout.trim();
+  if (details) {
+    return new Error(
+      `Failed to ${operation}: security exited with code ${result.exitCode}: ${details}`
+    );
+  }
+  return new Error(`Failed to ${operation}: security exited with code ${result.exitCode}`);
+}
+var SECURITY_CLI, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE, KeychainAuthStore;
+var init_keychain_auth_store = __esm({
+  "packages/auth/src/keychain-auth-store.ts"() {
+    "use strict";
+    SECURITY_CLI = "security";
+    KEYCHAIN_SERVICE = "poe-code";
+    KEYCHAIN_ACCOUNT = "api-key";
+    KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE = 44;
+    KeychainAuthStore = class {
+      runCommand;
+      service;
+      account;
+      constructor(input = {}) {
+        this.runCommand = input.runCommand ?? runSecurityCommand;
+        this.service = input.service ?? KEYCHAIN_SERVICE;
+        this.account = input.account ?? KEYCHAIN_ACCOUNT;
+      }
+      async getApiKey() {
+        const result = await this.executeSecurityCommand(
+          ["find-generic-password", "-s", this.service, "-a", this.account, "-w"],
+          "read API key from macOS Keychain"
+        );
+        if (result.exitCode === 0) {
+          return stripTrailingLineBreak(result.stdout);
+        }
+        if (isKeychainEntryNotFound(result)) {
+          return null;
+        }
+        throw createSecurityCliFailure("read API key from macOS Keychain", result);
+      }
+      async setApiKey(apiKey) {
+        const result = await this.executeSecurityCommand(
+          [
+            "add-generic-password",
+            "-s",
+            this.service,
+            "-a",
+            this.account,
+            "-w",
+            apiKey,
+            "-U"
+          ],
+          "store API key in macOS Keychain"
+        );
+        if (result.exitCode !== 0) {
+          throw createSecurityCliFailure("store API key in macOS Keychain", result);
+        }
+      }
+      async deleteApiKey() {
+        const result = await this.executeSecurityCommand(
+          ["delete-generic-password", "-s", this.service, "-a", this.account],
+          "delete API key from macOS Keychain"
+        );
+        if (result.exitCode === 0 || isKeychainEntryNotFound(result)) {
+          return;
+        }
+        throw createSecurityCliFailure("delete API key from macOS Keychain", result);
+      }
+      async executeSecurityCommand(args, operation) {
+        try {
+          return await this.runCommand(SECURITY_CLI, args);
+        } catch (error2) {
+          const message = error2 instanceof Error ? error2.message : String(error2);
+          throw new Error(`Failed to ${operation}: ${message}`);
+        }
+      }
+    };
+  }
+});
+
+// packages/auth/src/create-auth-store.ts
+import { promises as nodeFs } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path2 from "node:path";
+function createAuthStore(input = {}) {
+  const backend = resolveBackend(input);
+  const platform = input.platform ?? process.platform;
+  if (backend === "keychain" && platform !== MACOS_PLATFORM) {
+    throw new Error(
+      `POE_AUTH_BACKEND=keychain is only supported on macOS. Current platform: ${platform}`
+    );
+  }
+  const store = authStoreFactories[backend](input);
+  return {
+    backend,
+    store: enableLegacyCredentialsMigration(store, input)
+  };
+}
+function resolveBackend(input) {
+  const configuredBackend = input.backend ?? input.env?.[AUTH_BACKEND_ENV_VAR] ?? process.env[AUTH_BACKEND_ENV_VAR];
+  if (configuredBackend === "keychain") {
+    return "keychain";
+  }
+  return "file";
+}
+function enableLegacyCredentialsMigration(store, input) {
+  const migrationContext = createLegacyMigrationContext(input);
+  const readApiKeyFromStore = store.getApiKey.bind(store);
+  let hasCheckedLegacyCredentials = false;
+  let legacyMigrationPromise = null;
+  store.getApiKey = async () => {
+    const storedApiKey = await readApiKeyFromStore();
+    if (isNonEmptyString(storedApiKey)) {
+      return storedApiKey;
+    }
+    if (hasCheckedLegacyCredentials) {
+      return null;
+    }
+    if (!legacyMigrationPromise) {
+      legacyMigrationPromise = migrateLegacyApiKey(store, migrationContext).finally(() => {
+        hasCheckedLegacyCredentials = true;
+        legacyMigrationPromise = null;
+      });
+    }
+    return legacyMigrationPromise;
+  };
+  return store;
+}
+async function migrateLegacyApiKey(store, migrationContext) {
+  const legacyCredentials = await loadLegacyCredentials(
+    migrationContext.fs,
+    migrationContext.filePath
+  );
+  if (!legacyCredentials || !isNonEmptyString(legacyCredentials.apiKey)) {
+    return null;
+  }
+  const plaintextApiKey = legacyCredentials.apiKey;
+  try {
+    await store.setApiKey(plaintextApiKey);
+    delete legacyCredentials.apiKey;
+    await saveLegacyCredentials(
+      migrationContext.fs,
+      migrationContext.filePath,
+      legacyCredentials
+    );
+  } catch (error2) {
+    migrationContext.logWarning(
+      `Failed to migrate plaintext API key from ${migrationContext.filePath}.`,
+      error2
+    );
+  }
+  return plaintextApiKey;
+}
+function createLegacyMigrationContext(input) {
+  const legacyCredentialsInput = input.legacyCredentials;
+  const getHomeDirectory = legacyCredentialsInput?.getHomeDirectory ?? homedir2;
+  return {
+    fs: legacyCredentialsInput?.fs ?? input.fileStore?.fs ?? nodeFs,
+    filePath: legacyCredentialsInput?.filePath ?? path2.join(
+      getHomeDirectory(),
+      LEGACY_CREDENTIALS_RELATIVE_PATH
+    ),
+    logWarning: legacyCredentialsInput?.logWarning ?? defaultMigrationWarning
+  };
+}
+async function loadLegacyCredentials(fs3, filePath) {
+  let raw;
+  try {
+    raw = await fs3.readFile(filePath, "utf8");
+  } catch (error2) {
+    if (isNotFoundError2(error2)) {
+      return null;
+    }
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord2(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function saveLegacyCredentials(fs3, filePath, document) {
+  await fs3.mkdir(path2.dirname(filePath), { recursive: true });
+  await fs3.writeFile(filePath, `${JSON.stringify(document, null, 2)}
+`, {
+    encoding: "utf8"
+  });
+}
+function defaultMigrationWarning(message, error2) {
+  const details = toErrorDetails(error2);
+  if (details.length > 0) {
+    console.warn(`${message} ${details}`);
+    return;
+  }
+  console.warn(message);
+}
+function toErrorDetails(error2) {
+  if (error2 instanceof Error) {
+    return error2.message;
+  }
+  return typeof error2 === "string" ? error2 : "";
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isRecord2(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isNotFoundError2(error2) {
+  return Boolean(
+    error2 && typeof error2 === "object" && "code" in error2 && error2.code === "ENOENT"
+  );
+}
+var AUTH_BACKEND_ENV_VAR, MACOS_PLATFORM, LEGACY_CREDENTIALS_RELATIVE_PATH, authStoreFactories;
+var init_create_auth_store = __esm({
+  "packages/auth/src/create-auth-store.ts"() {
+    "use strict";
+    init_encrypted_file_auth_store();
+    init_keychain_auth_store();
+    AUTH_BACKEND_ENV_VAR = "POE_AUTH_BACKEND";
+    MACOS_PLATFORM = "darwin";
+    LEGACY_CREDENTIALS_RELATIVE_PATH = ".poe-code/credentials.json";
+    authStoreFactories = {
+      file: (input) => new EncryptedFileAuthStore(input.fileStore),
+      keychain: (input) => new KeychainAuthStore(input.keychainStore)
+    };
+  }
+});
+
+// packages/auth/src/index.ts
+var init_src = __esm({
+  "packages/auth/src/index.ts"() {
+    "use strict";
+    init_create_auth_store();
+    init_encrypted_file_auth_store();
+    init_keychain_auth_store();
+  }
+});
+
 // src/sdk/credentials.ts
-import * as fs from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
 async function getPoeApiKey() {
   const envKey = process.env.POE_API_KEY;
   if (typeof envKey === "string" && envKey.trim().length > 0) {
     return envKey.trim();
   }
-  const homeDir = os.homedir();
-  const credentialsPath = path.join(homeDir, CREDENTIALS_RELATIVE_PATH);
-  try {
-    const content = await fs.readFile(credentialsPath, "utf8");
-    const parsed = JSON.parse(content);
-    if (typeof parsed === "object" && parsed !== null && typeof parsed.apiKey === "string" && parsed.apiKey.length > 0) {
-      return parsed.apiKey;
-    }
-  } catch {
+  const { store } = createAuthStore();
+  const storedKey = await store.getApiKey();
+  if (typeof storedKey === "string" && storedKey.trim().length > 0) {
+    return storedKey.trim();
   }
   throw new Error(
     "No API key found. Set POE_API_KEY or run 'poe-code login'."
   );
 }
-var CREDENTIALS_RELATIVE_PATH;
 var init_credentials = __esm({
   "src/sdk/credentials.ts"() {
     "use strict";
-    CREDENTIALS_RELATIVE_PATH = ".poe-code/credentials.json";
+    init_src();
   }
 });
 
@@ -383,16 +818,16 @@ function getConfigFormat(pathOrFormat) {
   }
   return formatRegistry[formatName];
 }
-function detectFormat(path20) {
-  const ext = getExtension(path20);
+function detectFormat(path21) {
+  const ext = getExtension(path21);
   return extensionMap[ext];
 }
-function getExtension(path20) {
-  const lastDot = path20.lastIndexOf(".");
+function getExtension(path21) {
+  const lastDot = path21.lastIndexOf(".");
   if (lastDot === -1) {
     return "";
   }
-  return path20.slice(lastDot).toLowerCase();
+  return path21.slice(lastDot).toLowerCase();
 }
 var formatRegistry, extensionMap;
 var init_formats = __esm({
@@ -414,7 +849,7 @@ var init_formats = __esm({
 });
 
 // packages/config-mutations/src/execution/path-utils.ts
-import path2 from "node:path";
+import path3 from "node:path";
 function expandHome(targetPath, homeDir) {
   if (!targetPath?.startsWith("~")) {
     return targetPath;
@@ -431,7 +866,7 @@ function expandHome(targetPath, homeDir) {
       remainder = remainder.slice(1);
     }
   }
-  return remainder.length === 0 ? homeDir : path2.join(homeDir, remainder);
+  return remainder.length === 0 ? homeDir : path3.join(homeDir, remainder);
 }
 function validateHomePath(targetPath) {
   if (typeof targetPath !== "string" || targetPath.length === 0) {
@@ -449,12 +884,12 @@ function resolvePath(rawPath, homeDir, pathMapper) {
   if (!pathMapper) {
     return expanded;
   }
-  const rawDirectory = path2.dirname(expanded);
+  const rawDirectory = path3.dirname(expanded);
   const mappedDirectory = pathMapper.mapTargetDirectory({
     targetDirectory: rawDirectory
   });
-  const filename = path2.basename(expanded);
-  return filename.length === 0 ? mappedDirectory : path2.join(mappedDirectory, filename);
+  const filename = path3.basename(expanded);
+  return filename.length === 0 ? mappedDirectory : path3.join(mappedDirectory, filename);
 }
 var init_path_utils = __esm({
   "packages/config-mutations/src/execution/path-utils.ts"() {
@@ -1115,7 +1550,7 @@ var init_types = __esm({
 });
 
 // packages/config-mutations/src/index.ts
-var init_src = __esm({
+var init_src2 = __esm({
   "packages/config-mutations/src/index.ts"() {
     "use strict";
     init_config_mutation();
@@ -1135,38 +1570,38 @@ import { createTwoFilesPatch } from "diff";
 import chalk from "chalk";
 function createDryRunFileSystem(base, recorder) {
   const proxy = {
-    async readFile(path20, encoding) {
+    async readFile(path21, encoding) {
       if (encoding) {
-        return base.readFile(path20, encoding);
+        return base.readFile(path21, encoding);
       }
-      return base.readFile(path20);
+      return base.readFile(path21);
     },
-    async writeFile(path20, data, options) {
-      const previousContent = await tryReadText(base, path20);
+    async writeFile(path21, data, options) {
+      const previousContent = await tryReadText(base, path21);
       const nextContent = formatData(data, options?.encoding);
       recorder.record({
         type: "writeFile",
-        path: path20,
+        path: path21,
         nextContent,
         previousContent
       });
     },
-    async mkdir(path20, options) {
-      recorder.record({ type: "mkdir", path: path20, options });
+    async mkdir(path21, options) {
+      recorder.record({ type: "mkdir", path: path21, options });
     },
-    async stat(path20) {
-      return base.stat(path20);
+    async stat(path21) {
+      return base.stat(path21);
     },
-    async unlink(path20) {
-      recorder.record({ type: "unlink", path: path20 });
+    async unlink(path21) {
+      recorder.record({ type: "unlink", path: path21 });
     },
-    async readdir(path20) {
-      return base.readdir(path20);
+    async readdir(path21) {
+      return base.readdir(path21);
     }
   };
   if (typeof base.rm === "function") {
-    proxy.rm = async (path20, options) => {
-      recorder.record({ type: "rm", path: path20, options });
+    proxy.rm = async (path21, options) => {
+      recorder.record({ type: "rm", path: path21, options });
     };
   }
   if (typeof base.copyFile === "function") {
@@ -1256,8 +1691,8 @@ function describeWriteChange(previous, next) {
   }
   return "update";
 }
-function renderWriteCommand(path20, change) {
-  const command = `cat > ${path20}`;
+function renderWriteCommand(path21, change) {
+  const command = `cat > ${path21}`;
   if (change === "create") {
     return renderOperationCommand(command, chalk.green, "# create");
   }
@@ -1419,9 +1854,9 @@ function redactTomlLine(line) {
   }
   return line;
 }
-async function tryReadText(base, path20) {
+async function tryReadText(base, path21) {
   try {
-    return await base.readFile(path20, "utf8");
+    return await base.readFile(path21, "utf8");
   } catch (error2) {
     if (isNotFound(error2)) {
       return null;
@@ -1447,7 +1882,7 @@ var REDACTED_PLACEHOLDER, JSON_SENSITIVE_KEYS, AUTH_SENSITIVE_KEYS, TOML_SENSITI
 var init_dry_run = __esm({
   "src/utils/dry-run.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     REDACTED_PLACEHOLDER = "<redacted>";
     JSON_SENSITIVE_KEYS = ["apiKey", "api_key", "apiKeyHelper"];
     AUTH_SENSITIVE_KEYS = ["key"];
@@ -1597,170 +2032,9 @@ var init_context = __esm({
   }
 });
 
-// src/services/credentials.ts
-import path3 from "node:path";
-async function saveCredentials(options) {
-  const { fs: fs3, filePath, apiKey } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  document.apiKey = apiKey;
-  await writeCredentialsDocument(fs3, filePath, document);
-}
-async function loadCredentials(options) {
-  const { fs: fs3, filePath } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  return typeof document.apiKey === "string" && document.apiKey.length > 0 ? document.apiKey : null;
-}
-async function deleteCredentials(options) {
-  const { fs: fs3, filePath } = options;
-  try {
-    await fs3.unlink(filePath);
-    return true;
-  } catch (error2) {
-    if (isNotFound(error2)) {
-      return false;
-    }
-    throw error2;
-  }
-}
-async function loadConfiguredServices(options) {
-  const { fs: fs3, filePath } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  return { ...document.configured_services ?? {} };
-}
-async function saveConfiguredService(options) {
-  const { fs: fs3, filePath, service, metadata } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  const normalized = normalizeConfiguredServiceMetadata(metadata);
-  document.configured_services = {
-    ...document.configured_services ?? {},
-    [service]: normalized
-  };
-  await writeCredentialsDocument(fs3, filePath, document);
-}
-async function unconfigureService(options) {
-  const { fs: fs3, filePath, service } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  const services = document.configured_services;
-  if (!services || !(service in services)) {
-    return false;
-  }
-  delete services[service];
-  if (Object.keys(services).length === 0) {
-    delete document.configured_services;
-  }
-  await writeCredentialsDocument(fs3, filePath, document);
-  return true;
-}
-function normalizeConfiguredServiceMetadata(metadata) {
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const entry of metadata.files ?? []) {
-    if (typeof entry !== "string" || entry.length === 0) {
-      continue;
-    }
-    if (!seen.has(entry)) {
-      files.push(entry);
-      seen.add(entry);
-    }
-  }
-  return {
-    files
-  };
-}
-async function readCredentialsDocument(fs3, filePath) {
-  try {
-    const raw = await fs3.readFile(filePath, "utf8");
-    return await parseCredentialsDocument(fs3, filePath, raw);
-  } catch (error2) {
-    if (isNotFound(error2)) {
-      return {};
-    }
-    throw error2;
-  }
-}
-async function parseCredentialsDocument(fs3, filePath, raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    return normalizeCredentialsDocument(parsed);
-  } catch (error2) {
-    if (error2 instanceof SyntaxError) {
-      await recoverInvalidCredentials(fs3, filePath, raw);
-      return {};
-    }
-    throw error2;
-  }
-}
-function normalizeCredentialsDocument(value) {
-  if (!isRecord(value)) {
-    return {};
-  }
-  const document = {};
-  if (typeof value.apiKey === "string" && value.apiKey.length > 0) {
-    document.apiKey = value.apiKey;
-  }
-  const services = normalizeConfiguredServices(value.configured_services);
-  if (Object.keys(services).length > 0) {
-    document.configured_services = services;
-  }
-  return document;
-}
-function normalizeConfiguredServices(value) {
-  if (!isRecord(value)) {
-    return {};
-  }
-  const entries = {};
-  for (const [key, entry] of Object.entries(value)) {
-    if (!isRecord(entry)) {
-      continue;
-    }
-    const normalized = normalizeConfiguredServiceMetadata({
-      files: Array.isArray(entry.files) ? entry.files : []
-    });
-    entries[key] = normalized;
-  }
-  return entries;
-}
-async function writeCredentialsDocument(fs3, filePath, document) {
-  await fs3.mkdir(path3.dirname(filePath), { recursive: true });
-  const payload = {};
-  if (document.apiKey) {
-    payload.apiKey = document.apiKey;
-  }
-  if (document.configured_services) {
-    payload.configured_services = document.configured_services;
-  }
-  await fs3.writeFile(filePath, `${JSON.stringify(payload, null, 2)}
-`, {
-    encoding: "utf8"
-  });
-}
-async function recoverInvalidCredentials(fs3, filePath, content) {
-  const backupPath = createInvalidBackupPath(filePath);
-  await fs3.writeFile(backupPath, content, { encoding: "utf8" });
-  await fs3.writeFile(filePath, EMPTY_DOCUMENT, { encoding: "utf8" });
-}
-function createInvalidBackupPath(filePath) {
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dir = path3.dirname(filePath);
-  const base = path3.basename(filePath);
-  return path3.join(dir, `${base}.invalid-${timestamp}.json`);
-}
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-var EMPTY_DOCUMENT;
-var init_credentials2 = __esm({
-  "src/services/credentials.ts"() {
-    "use strict";
-    init_src();
-    EMPTY_DOCUMENT = `${JSON.stringify({}, null, 2)}
-`;
-  }
-});
-
 // src/cli/isolated-env.ts
 import path4 from "node:path";
-async function resolveIsolatedEnvDetails(env, isolated, providerName, fs3) {
+async function resolveIsolatedEnvDetails(env, isolated, providerName, readApiKey) {
   if (!providerName) {
     throw new Error("resolveIsolatedEnvDetails requires providerName.");
   }
@@ -1773,7 +2047,7 @@ async function resolveIsolatedEnvDetails(env, isolated, providerName, fs3) {
   }
   return {
     agentBinary: isolated.agentBinary,
-    env: await resolveIsolatedEnvVars(env, baseDir, isolated.env, fs3),
+    env: await resolveIsolatedEnvVars(env, baseDir, isolated.env, readApiKey),
     configProbePath: isolated.configProbe ? resolveIsolatedEnvPath(env, baseDir, isolated.configProbe) : void 0
   };
 }
@@ -1802,14 +2076,14 @@ function resolveIsolatedTargetDirectory(input) {
 function resolveIsolatedBaseDir(env, providerName) {
   return env.resolveHomePath(".poe-code", providerName);
 }
-async function resolveIsolatedEnvVars(env, baseDir, vars, fs3) {
+async function resolveIsolatedEnvVars(env, baseDir, vars, readApiKey) {
   const out = {};
   for (const [key, value] of Object.entries(vars)) {
-    out[key] = await resolveIsolatedEnvValue(env, baseDir, value, fs3);
+    out[key] = await resolveIsolatedEnvValue(env, baseDir, value, readApiKey);
   }
   return out;
 }
-async function resolveIsolatedEnvValue(env, baseDir, value, fs3) {
+async function resolveIsolatedEnvValue(env, baseDir, value, readApiKey) {
   if (typeof value === "string") {
     return expandHomeShortcut(env, value);
   }
@@ -1827,12 +2101,12 @@ async function resolveIsolatedEnvValue(env, baseDir, value, fs3) {
     if (typeof resolved === "string" && resolved.trim().length > 0) {
       return resolved;
     }
-    if (!fs3) {
+    if (!readApiKey) {
       throw new Error(
         'Missing Poe API key for isolated wrapper. Set "POE_API_KEY" or run "poe-code login".'
       );
     }
-    return await resolvePoeApiKeyFromCredentials({ fs: fs3, env });
+    return await resolvePoeApiKeyFromAuthStore(readApiKey);
   }
   if (isPoeBaseUrlReference(value)) {
     return env.poeBaseUrl;
@@ -1859,8 +2133,8 @@ function isPoeApiKeyReference(value) {
 function isPoeBaseUrlReference(value) {
   return typeof value === "object" && value.kind === "poeBaseUrl";
 }
-async function resolvePoeApiKeyFromCredentials(input) {
-  const stored = await loadCredentials({ fs: input.fs, filePath: input.env.credentialsPath }) ?? void 0;
+async function resolvePoeApiKeyFromAuthStore(readApiKey) {
+  const stored = await readApiKey();
   if (typeof stored !== "string" || stored.trim().length === 0) {
     throw new Error(
       'Missing Poe API key for isolated wrapper. Set "POE_API_KEY" or run "poe-code login".'
@@ -1903,11 +2177,11 @@ async function applyIsolatedEnvRepairs(input) {
     }
   }
 }
-async function resolveCliSettings(cliSettings, env, fs3) {
+async function resolveCliSettings(cliSettings, env, readApiKey) {
   const result = { ...cliSettings.values };
   if (cliSettings.resolved) {
     for (const [key, value] of Object.entries(cliSettings.resolved)) {
-      result[key] = await resolveCliSettingValue(value, env, fs3);
+      result[key] = await resolveCliSettingValue(value, env, readApiKey);
     }
   }
   if (cliSettings.env) {
@@ -1916,21 +2190,21 @@ async function resolveCliSettings(cliSettings, env, fs3) {
       if (typeof value === "string") {
         resolvedEnv[key] = value;
       } else {
-        resolvedEnv[key] = await resolveCliSettingValue(value, env, fs3);
+        resolvedEnv[key] = await resolveCliSettingValue(value, env, readApiKey);
       }
     }
     result.env = resolvedEnv;
   }
   return result;
 }
-async function resolveCliSettingValue(value, env, fs3) {
+async function resolveCliSettingValue(value, env, readApiKey) {
   if (isPoeApiKeyReference(value)) {
     const resolved = env.getVariable("POE_API_KEY");
     if (typeof resolved === "string" && resolved.trim().length > 0) {
       return resolved;
     }
-    if (fs3) {
-      return await resolvePoeApiKeyFromCredentials({ fs: fs3, env });
+    if (readApiKey) {
+      return await resolvePoeApiKeyFromAuthStore(readApiKey);
     }
     throw new Error(
       'Missing Poe API key for CLI settings. Set "POE_API_KEY" or run "poe-code login".'
@@ -1971,17 +2245,16 @@ function expandHomeShortcut(env, input) {
 var init_isolated_env = __esm({
   "src/cli/isolated-env.ts"() {
     "use strict";
-    init_src();
-    init_credentials2();
+    init_src2();
   }
 });
 
 // packages/agent-spawn/src/run-command.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 function runCommand(command, args, options) {
   return new Promise((resolve) => {
     const hasStdin = options?.stdin != null;
-    const child = spawn(command, args, {
+    const child = spawn2(command, args, {
       stdio: [hasStdin ? "pipe" : "ignore", "pipe", "pipe"],
       cwd: options?.cwd,
       env: options?.env ? {
@@ -2184,7 +2457,7 @@ var init_registry = __esm({
 });
 
 // packages/agent-defs/src/index.ts
-var init_src2 = __esm({
+var init_src3 = __esm({
   "packages/agent-defs/src/index.ts"() {
     "use strict";
     init_agents();
@@ -2337,7 +2610,7 @@ var allSpawnConfigs, lookup2;
 var init_configs = __esm({
   "packages/agent-spawn/src/configs/index.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_claude_code2();
     init_codex2();
     init_opencode2();
@@ -2372,7 +2645,7 @@ function resolveConfig(agentId) {
 var init_resolve_config = __esm({
   "packages/agent-spawn/src/configs/resolve-config.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_configs();
   }
 });
@@ -2425,7 +2698,7 @@ function buildCliArgs(config2, options, stdinMode) {
   }
   return args;
 }
-async function spawn2(agentId, options, context) {
+async function spawn3(agentId, options, context) {
   const { agentId: resolvedId, binaryName, spawnConfig } = resolveCliConfig(agentId);
   const stdinMode = options.useStdin && spawnConfig.stdinMode ? spawnConfig.stdinMode : void 0;
   const spawnArgs = buildCliArgs(spawnConfig, options, stdinMode);
@@ -3235,7 +3508,7 @@ var init_static = __esm({
 });
 
 // packages/design-system/src/index.ts
-var init_src3 = __esm({
+var init_src4 = __esm({
   "packages/design-system/src/index.ts"() {
     "use strict";
     init_tokens();
@@ -3328,7 +3601,7 @@ async function renderAcpStream(events) {
 var init_renderer = __esm({
   "packages/agent-spawn/src/acp/renderer.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
   }
 });
 
@@ -3338,13 +3611,13 @@ function truncate2(text4, maxLength) {
   if (maxLength <= 3) return text4.slice(0, maxLength);
   return `${text4.slice(0, maxLength - 3)}...`;
 }
-function isNonEmptyString(value) {
+function isNonEmptyString2(value) {
   return typeof value === "string" && value.length > 0;
 }
 function extractThreadId(value) {
   if (!value || typeof value !== "object") return;
   const obj = value;
-  const maybeThreadId = isNonEmptyString(obj.thread_id) && obj.thread_id || isNonEmptyString(obj.threadId) && obj.threadId || isNonEmptyString(obj.threadID) && obj.threadID || isNonEmptyString(obj.session_id) && obj.session_id || isNonEmptyString(obj.sessionId) && obj.sessionId || isNonEmptyString(obj.sessionID) && obj.sessionID;
+  const maybeThreadId = isNonEmptyString2(obj.thread_id) && obj.thread_id || isNonEmptyString2(obj.threadId) && obj.threadId || isNonEmptyString2(obj.threadID) && obj.threadID || isNonEmptyString2(obj.session_id) && obj.session_id || isNonEmptyString2(obj.sessionId) && obj.sessionId || isNonEmptyString2(obj.sessionID) && obj.sessionID;
   return maybeThreadId || void 0;
 }
 var init_utils = __esm({
@@ -3390,7 +3663,7 @@ async function* adaptClaude(lines) {
       continue;
     }
     const eventType = event.type;
-    if (!isNonEmptyString(eventType)) continue;
+    if (!isNonEmptyString2(eventType)) continue;
     if (!emittedSessionStart) {
       const threadId = extractThreadId(event);
       emittedSessionStart = true;
@@ -3413,16 +3686,16 @@ async function* adaptClaude(lines) {
       const item = block;
       if (!item || typeof item !== "object") continue;
       const blockType = item.type;
-      if (!isNonEmptyString(blockType)) continue;
+      if (!isNonEmptyString2(blockType)) continue;
       if (eventType === "assistant") {
-        if (blockType === "text" && isNonEmptyString(item.text)) {
+        if (blockType === "text" && isNonEmptyString2(item.text)) {
           yield {
             event: "agent_message",
             text: item.text
           };
           continue;
         }
-        if (blockType === "tool_use" && isNonEmptyString(item.id) && isNonEmptyString(item.name)) {
+        if (blockType === "tool_use" && isNonEmptyString2(item.id) && isNonEmptyString2(item.name)) {
           const kind = TOOL_KIND_MAP[item.name] ?? "other";
           toolKindsById.set(item.id, kind);
           yield {
@@ -3436,25 +3709,25 @@ async function* adaptClaude(lines) {
         continue;
       }
       if (eventType === "user") {
-        if (!isNonEmptyString(item.tool_use_id)) continue;
+        if (!isNonEmptyString2(item.tool_use_id)) continue;
         if (blockType !== "tool_result") continue;
         const kind = toolKindsById.get(item.tool_use_id);
         toolKindsById.delete(item.tool_use_id);
-        let path20;
+        let path21;
         if (typeof item.content === "string") {
-          path20 = item.content;
+          path21 = item.content;
         } else {
           try {
-            path20 = JSON.stringify(item.content);
+            path21 = JSON.stringify(item.content);
           } catch {
-            path20 = String(item.content);
+            path21 = String(item.content);
           }
         }
         yield {
           event: "tool_complete",
           id: item.tool_use_id,
           kind,
-          path: path20
+          path: path21
         };
       }
     }
@@ -3508,7 +3781,7 @@ async function* adaptCodex(lines) {
       continue;
     }
     const eventType = event.type;
-    if (!isNonEmptyString(eventType)) continue;
+    if (!isNonEmptyString2(eventType)) continue;
     if (eventType === "thread.started") {
       const maybeThreadId = extractThreadId(event);
       yield { event: "session_start", threadId: maybeThreadId };
@@ -3532,23 +3805,23 @@ async function* adaptCodex(lines) {
     const item = event.item ?? null;
     if (!item || typeof item !== "object") continue;
     const itemType = item.type;
-    if (!isNonEmptyString(itemType)) continue;
+    if (!isNonEmptyString2(itemType)) continue;
     if (eventType === "item.started") {
-      if (!isNonEmptyString(item.id)) continue;
+      if (!isNonEmptyString2(item.id)) continue;
       let kind;
       let title;
       if (itemType === "command_execution") {
         kind = "exec";
-        title = truncate2(isNonEmptyString(item.command) ? item.command : "", 80);
+        title = truncate2(isNonEmptyString2(item.command) ? item.command : "", 80);
       } else if (itemType === "file_edit") {
         kind = "edit";
-        title = isNonEmptyString(item.path) ? item.path : "";
+        title = isNonEmptyString2(item.path) ? item.path : "";
       } else if (itemType === "thinking") {
         kind = "think";
         title = "thinking...";
       } else if (itemType === "mcp_tool_call") {
-        const server = isNonEmptyString(item.server) ? item.server : "unknown";
-        const tool = isNonEmptyString(item.tool) ? item.tool : "unknown";
+        const server = isNonEmptyString2(item.server) ? item.server : "unknown";
+        const tool = isNonEmptyString2(item.tool) ? item.tool : "unknown";
         kind = "other";
         title = `${server}.${tool}`;
       }
@@ -3561,25 +3834,25 @@ async function* adaptCodex(lines) {
     }
     if (eventType === "item.completed") {
       if (itemType === "agent_message") {
-        if (!isNonEmptyString(item.text)) continue;
+        if (!isNonEmptyString2(item.text)) continue;
         yield { event: "agent_message", text: item.text };
         continue;
       }
       if (itemType === "reasoning") {
-        const text4 = isNonEmptyString(item.text) ? item.text : isNonEmptyString(item.content) ? item.content : isNonEmptyString(item.summary) ? item.summary : void 0;
+        const text4 = isNonEmptyString2(item.text) ? item.text : isNonEmptyString2(item.content) ? item.content : isNonEmptyString2(item.summary) ? item.summary : void 0;
         if (!text4) continue;
         yield { event: "reasoning", text: text4 };
         continue;
       }
-      if (!isNonEmptyString(item.id)) continue;
+      if (!isNonEmptyString2(item.id)) continue;
       if (itemType === "command_execution" || itemType === "file_edit" || itemType === "mcp_tool_call") {
         const kindFromStart = toolKindById.get(item.id);
         const kind = kindFromStart ?? (itemType === "command_execution" ? "exec" : itemType === "file_edit" ? "edit" : "other");
-        const titleFromEvent = isNonEmptyString(item.path) ? item.path : itemType === "mcp_tool_call" ? `${isNonEmptyString(item.server) ? item.server : "unknown"}.${isNonEmptyString(item.tool) ? item.tool : "unknown"}` : void 0;
-        const path20 = titleFromEvent ?? toolTitleById.get(item.id) ?? "";
+        const titleFromEvent = isNonEmptyString2(item.path) ? item.path : itemType === "mcp_tool_call" ? `${isNonEmptyString2(item.server) ? item.server : "unknown"}.${isNonEmptyString2(item.tool) ? item.tool : "unknown"}` : void 0;
+        const path21 = titleFromEvent ?? toolTitleById.get(item.id) ?? "";
         toolTitleById.delete(item.id);
         toolKindById.delete(item.id);
-        yield { event: "tool_complete", id: item.id, kind, path: path20 };
+        yield { event: "tool_complete", id: item.id, kind, path: path21 };
       }
     }
   }
@@ -3618,9 +3891,9 @@ async function* adaptKimi(lines) {
       }
     }
     const role = event.role;
-    if (!isNonEmptyString(role) || role !== "assistant") continue;
+    if (!isNonEmptyString2(role) || role !== "assistant") continue;
     const content = event.content;
-    if (!isNonEmptyString(content)) continue;
+    if (!isNonEmptyString2(content)) continue;
     yield { event: "agent_message", text: content };
   }
 }
@@ -3649,7 +3922,7 @@ async function* adaptNative(lines) {
       continue;
     }
     const maybeEventType = event?.event;
-    if (!isNonEmptyString(maybeEventType)) {
+    if (!isNonEmptyString2(maybeEventType)) {
       yield {
         event: "error",
         message: `[adaptNative] Line missing string "event" field: ${truncate2(line, 200)}`
@@ -3708,23 +3981,23 @@ async function* adaptOpenCode(lines) {
     }
     if (!event || typeof event !== "object") continue;
     const sessionID = extractThreadId(event);
-    if (!emittedSessionStart && isNonEmptyString(sessionID)) {
+    if (!emittedSessionStart && isNonEmptyString2(sessionID)) {
       emittedSessionStart = true;
       yield { event: "session_start", threadId: sessionID };
     }
     const eventType = event.type;
-    if (!isNonEmptyString(eventType)) continue;
+    if (!isNonEmptyString2(eventType)) continue;
     if (eventType === "text") {
       const part = event.part ?? null;
       if (!part || typeof part !== "object") continue;
-      if (!isNonEmptyString(part.text)) continue;
+      if (!isNonEmptyString2(part.text)) continue;
       yield { event: "agent_message", text: part.text };
       continue;
     }
     if (eventType === "tool_use") {
       const part = event.part ?? null;
       if (!part || typeof part !== "object") continue;
-      if (!isNonEmptyString(part.callID) || !isNonEmptyString(part.tool)) continue;
+      if (!isNonEmptyString2(part.callID) || !isNonEmptyString2(part.tool)) continue;
       const state = part.state ?? null;
       if (!state || typeof state !== "object") continue;
       const kind = guessToolKind(part.tool);
@@ -3736,7 +4009,7 @@ async function* adaptOpenCode(lines) {
         const maybeInput = state.input;
         if (kind === "exec" && maybeInput && typeof maybeInput === "object") {
           const command = maybeInput.command;
-          if (isNonEmptyString(command)) {
+          if (isNonEmptyString2(command)) {
             title = truncate2(command, 80);
           }
         }
@@ -3938,7 +4211,7 @@ var init_spawn2 = __esm({
 });
 
 // packages/agent-spawn/src/index.ts
-var init_src4 = __esm({
+var init_src5 = __esm({
   "packages/agent-spawn/src/index.ts"() {
     "use strict";
     init_run_command();
@@ -4118,8 +4391,8 @@ var init_shared = __esm({
     "use strict";
     init_context();
     init_isolated_env();
-    init_src4();
-    init_src2();
+    init_src5();
+    init_src3();
   }
 });
 
@@ -4429,7 +4702,7 @@ function createServiceRegistry() {
 var init_service_registry = __esm({
   "src/cli/service-registry.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
   }
 });
 
@@ -4793,7 +5066,7 @@ function createLoggerFactory(emitter, theme) {
 var init_logger2 = __esm({
   "src/cli/logger.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
   }
 });
 
@@ -5178,7 +5451,7 @@ async function ensureIsolatedConfigForService(input) {
     container.env,
     isolated,
     adapter.name,
-    container.fs
+    container.readApiKey
   );
   const hasConfig = await isolatedConfigExists(
     container.fs,
@@ -5253,7 +5526,7 @@ function createPoeCodeCommandRunner(input) {
       container.env,
       adapter.isolatedEnv,
       adapter.name,
-      container.fs
+      container.readApiKey
     );
     if (adapter.isolatedEnv.requiresConfig !== false) {
       const hasConfig = await isolatedConfigExists(
@@ -5284,7 +5557,7 @@ function createPoeCodeCommandRunner(input) {
       const resolvedSettings = await resolveCliSettings(
         adapter.isolatedEnv.cliSettings,
         container.env,
-        container.fs
+        container.readApiKey
       );
       forwarded = buildArgsWithMergedSettings(forwarded, resolvedSettings);
     }
@@ -5313,11 +5586,11 @@ var init_poe_code_command_runner = __esm({
 
 // src/sdk/container.ts
 import * as fs2 from "node:fs/promises";
-import * as os2 from "node:os";
+import * as os from "node:os";
 import * as nodeFsSync from "node:fs";
 function createSdkContainer(options) {
   const cwd = options?.cwd ?? process.cwd();
-  const homeDir = options?.homeDir ?? os2.homedir();
+  const homeDir = options?.homeDir ?? os.homedir();
   const variables = options?.variables ?? process.env;
   const verbose = options?.verbose ?? false;
   const environment = createCliEnvironment({
@@ -5336,23 +5609,44 @@ function createSdkContainer(options) {
   });
   loggerFactory.setErrorLogger(errorLogger);
   const asyncFs = {
-    readFile: ((path20, encoding) => {
+    readFile: ((path21, encoding) => {
       if (encoding) {
-        return fs2.readFile(path20, encoding);
+        return fs2.readFile(path21, encoding);
       }
-      return fs2.readFile(path20);
+      return fs2.readFile(path21);
     }),
-    writeFile: (path20, data, opts) => fs2.writeFile(path20, data, opts),
-    mkdir: (path20, opts) => fs2.mkdir(path20, opts).then(() => {
+    writeFile: (path21, data, opts) => fs2.writeFile(path21, data, opts),
+    mkdir: (path21, opts) => fs2.mkdir(path21, opts).then(() => {
     }),
-    stat: (path20) => fs2.stat(path20),
-    rm: (path20, opts) => fs2.rm(path20, opts),
-    unlink: (path20) => fs2.unlink(path20),
-    readdir: (path20) => fs2.readdir(path20),
+    stat: (path21) => fs2.stat(path21),
+    rm: (path21, opts) => fs2.rm(path21, opts),
+    unlink: (path21) => fs2.unlink(path21),
+    readdir: (path21) => fs2.readdir(path21),
     copyFile: (src, dest) => fs2.copyFile(src, dest),
-    chmod: (path20, mode) => fs2.chmod(path20, mode)
+    chmod: (path21, mode) => fs2.chmod(path21, mode)
   };
   const contextFactory = createCommandContextFactory({ fs: asyncFs });
+  const authFs = {
+    readFile: (filePath, encoding) => fs2.readFile(filePath, encoding),
+    writeFile: (filePath, data, options2) => fs2.writeFile(filePath, data, options2),
+    mkdir: (directoryPath, options2) => fs2.mkdir(directoryPath, options2).then(() => void 0),
+    unlink: (filePath) => fs2.unlink(filePath),
+    chmod: (filePath, mode) => fs2.chmod(filePath, mode)
+  };
+  const { store: authStore } = createAuthStore({
+    env: variables,
+    platform: process.platform,
+    fileStore: {
+      fs: authFs,
+      getHomeDirectory: () => homeDir
+    },
+    legacyCredentials: {
+      fs: authFs,
+      getHomeDirectory: () => homeDir
+    }
+  });
+  const readApiKey = authStore.getApiKey.bind(authStore);
+  const writeApiKey = authStore.setApiKey.bind(authStore);
   const noopPrompts = async () => {
     throw new Error("SDK does not support interactive prompts");
   };
@@ -5361,15 +5655,8 @@ function createSdkContainer(options) {
     prompts: noopPrompts,
     promptLibrary,
     apiKeyStore: {
-      read: () => loadCredentials({
-        fs: asyncFs,
-        filePath: environment.credentialsPath
-      }),
-      write: (value) => saveCredentials({
-        fs: asyncFs,
-        filePath: environment.credentialsPath,
-        apiKey: value
-      })
+      read: readApiKey,
+      write: writeApiKey
     }
   });
   const registry2 = createServiceRegistry();
@@ -5415,7 +5702,9 @@ function createSdkContainer(options) {
         platform: process.platform,
         variables
       }
-    }
+    },
+    readApiKey,
+    writeApiKey
   };
   return container;
 }
@@ -5429,15 +5718,15 @@ var init_container = __esm({
     init_options();
     init_logger2();
     init_error_logger();
-    init_src4();
+    init_src5();
     await init_providers();
     init_poe_code_command_runner();
-    init_credentials2();
+    init_src();
   }
 });
 
 // src/sdk/spawn.ts
-function spawn3(service, promptOrOptions, maybeOptions) {
+function spawn4(service, promptOrOptions, maybeOptions) {
   const options = typeof promptOrOptions === "string" ? { ...maybeOptions, prompt: promptOrOptions } : promptOrOptions;
   const emptyEvents = (async function* () {
   })();
@@ -5498,7 +5787,7 @@ function spawn3(service, promptOrOptions, maybeOptions) {
       }
       if (spawnConfig && spawnConfig.kind === "cli") {
         resolveEventsOnce(emptyEvents);
-        return spawn2(service, {
+        return spawn3(service, {
           prompt: options.prompt,
           cwd: options.cwd,
           model: options.model,
@@ -5530,7 +5819,7 @@ var init_spawn3 = __esm({
     init_credentials();
     init_spawn_core();
     await init_container();
-    init_src4();
+    init_src5();
   }
 });
 
@@ -5588,6 +5877,161 @@ var init_errors = __esm({
   }
 });
 
+// src/services/credentials.ts
+import path10 from "node:path";
+async function loadCredentials(options) {
+  const { fs: fs3, filePath } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  return typeof document.apiKey === "string" && document.apiKey.length > 0 ? document.apiKey : null;
+}
+async function deleteCredentials(options) {
+  const { fs: fs3, filePath } = options;
+  try {
+    await fs3.unlink(filePath);
+    return true;
+  } catch (error2) {
+    if (isNotFound(error2)) {
+      return false;
+    }
+    throw error2;
+  }
+}
+async function loadConfiguredServices(options) {
+  const { fs: fs3, filePath } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  return { ...document.configured_services ?? {} };
+}
+async function saveConfiguredService(options) {
+  const { fs: fs3, filePath, service, metadata } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  const normalized = normalizeConfiguredServiceMetadata(metadata);
+  document.configured_services = {
+    ...document.configured_services ?? {},
+    [service]: normalized
+  };
+  await writeCredentialsDocument(fs3, filePath, document);
+}
+async function unconfigureService(options) {
+  const { fs: fs3, filePath, service } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  const services = document.configured_services;
+  if (!services || !(service in services)) {
+    return false;
+  }
+  delete services[service];
+  if (Object.keys(services).length === 0) {
+    delete document.configured_services;
+  }
+  await writeCredentialsDocument(fs3, filePath, document);
+  return true;
+}
+function normalizeConfiguredServiceMetadata(metadata) {
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const entry of metadata.files ?? []) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      continue;
+    }
+    if (!seen.has(entry)) {
+      files.push(entry);
+      seen.add(entry);
+    }
+  }
+  return {
+    files
+  };
+}
+async function readCredentialsDocument(fs3, filePath) {
+  try {
+    const raw = await fs3.readFile(filePath, "utf8");
+    return await parseCredentialsDocument(fs3, filePath, raw);
+  } catch (error2) {
+    if (isNotFound(error2)) {
+      return {};
+    }
+    throw error2;
+  }
+}
+async function parseCredentialsDocument(fs3, filePath, raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return normalizeCredentialsDocument(parsed);
+  } catch (error2) {
+    if (error2 instanceof SyntaxError) {
+      await recoverInvalidCredentials(fs3, filePath, raw);
+      return {};
+    }
+    throw error2;
+  }
+}
+function normalizeCredentialsDocument(value) {
+  if (!isRecord3(value)) {
+    return {};
+  }
+  const document = {};
+  if (typeof value.apiKey === "string" && value.apiKey.length > 0) {
+    document.apiKey = value.apiKey;
+  }
+  const services = normalizeConfiguredServices(value.configured_services);
+  if (Object.keys(services).length > 0) {
+    document.configured_services = services;
+  }
+  return document;
+}
+function normalizeConfiguredServices(value) {
+  if (!isRecord3(value)) {
+    return {};
+  }
+  const entries = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (!isRecord3(entry)) {
+      continue;
+    }
+    const normalized = normalizeConfiguredServiceMetadata({
+      files: Array.isArray(entry.files) ? entry.files : []
+    });
+    entries[key] = normalized;
+  }
+  return entries;
+}
+async function writeCredentialsDocument(fs3, filePath, document) {
+  await fs3.mkdir(path10.dirname(filePath), { recursive: true });
+  const payload = {};
+  if (document.apiKey) {
+    payload.apiKey = document.apiKey;
+  }
+  if (document.configured_services) {
+    payload.configured_services = document.configured_services;
+  }
+  await fs3.writeFile(filePath, `${JSON.stringify(payload, null, 2)}
+`, {
+    encoding: "utf8"
+  });
+}
+async function recoverInvalidCredentials(fs3, filePath, content) {
+  const backupPath = createInvalidBackupPath(filePath);
+  await fs3.writeFile(backupPath, content, { encoding: "utf8" });
+  await fs3.writeFile(filePath, EMPTY_DOCUMENT, { encoding: "utf8" });
+}
+function createInvalidBackupPath(filePath) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const dir = path10.dirname(filePath);
+  const base = path10.basename(filePath);
+  return path10.join(dir, `${base}.invalid-${timestamp}.json`);
+}
+function isRecord3(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+var EMPTY_DOCUMENT;
+var init_credentials2 = __esm({
+  "src/services/credentials.ts"() {
+    "use strict";
+    init_src2();
+    EMPTY_DOCUMENT = `${JSON.stringify({}, null, 2)}
+`;
+  }
+});
+
 // src/services/llm-client.ts
 function createPoeClient(options) {
   const httpClient = options.httpClient ?? createDefaultHttpClient();
@@ -5652,13 +6096,13 @@ async function readErrorBody(response) {
   }
 }
 function extractTextContent(data) {
-  if (!isRecord2(data)) return void 0;
+  if (!isRecord4(data)) return void 0;
   const choices = data.choices;
   if (!Array.isArray(choices) || choices.length === 0) return void 0;
   const first = choices[0];
-  if (!isRecord2(first)) return void 0;
+  if (!isRecord4(first)) return void 0;
   const message = first.message;
-  if (!isRecord2(message)) return void 0;
+  if (!isRecord4(message)) return void 0;
   return typeof message.content === "string" ? message.content : void 0;
 }
 function extractMediaFromCompletion(data) {
@@ -5666,14 +6110,14 @@ function extractMediaFromCompletion(data) {
   if (!content) return {};
   try {
     const parsed = JSON.parse(content);
-    if (isRecord2(parsed) && typeof parsed.url === "string") {
+    if (isRecord4(parsed) && typeof parsed.url === "string") {
       return {
         url: parsed.url,
         mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0,
         data: typeof parsed.data === "string" ? parsed.data : void 0
       };
     }
-    if (isRecord2(parsed) && typeof parsed.data === "string") {
+    if (isRecord4(parsed) && typeof parsed.data === "string") {
       return {
         data: parsed.data,
         mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0
@@ -5707,7 +6151,7 @@ function isValidUrl(value) {
     return false;
   }
 }
-function isRecord2(value) {
+function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 var init_llm_client = __esm({
@@ -5793,19 +6237,33 @@ function createCliContainer(dependencies) {
   });
   const commandRunner = dependencies.commandRunner ?? runCommand;
   const promptLibrary = createPromptLibrary();
+  const authFs = {
+    readFile: (filePath, encoding) => dependencies.fs.readFile(filePath, encoding),
+    writeFile: (filePath, data, opts) => dependencies.fs.writeFile(filePath, data, opts),
+    mkdir: (directoryPath, opts) => dependencies.fs.mkdir(directoryPath, opts).then(() => void 0),
+    unlink: (filePath) => dependencies.fs.unlink(filePath),
+    chmod: (filePath, mode) => dependencies.fs.chmod ? dependencies.fs.chmod(filePath, mode) : Promise.resolve()
+  };
+  const { store: authStore } = createAuthStore({
+    env: dependencies.env.variables,
+    platform: dependencies.env.platform,
+    fileStore: {
+      fs: authFs,
+      getHomeDirectory: () => dependencies.env.homeDir
+    },
+    legacyCredentials: {
+      fs: authFs,
+      getHomeDirectory: () => dependencies.env.homeDir
+    }
+  });
+  const readApiKey = authStore.getApiKey.bind(authStore);
+  const writeApiKey = authStore.setApiKey.bind(authStore);
   const options = createOptionResolvers({
     prompts: dependencies.prompts,
     promptLibrary,
     apiKeyStore: {
-      read: () => loadCredentials({
-        fs: dependencies.fs,
-        filePath: environment.credentialsPath
-      }),
-      write: (value) => saveCredentials({
-        fs: dependencies.fs,
-        filePath: environment.credentialsPath,
-        apiKey: value
-      })
+      read: readApiKey,
+      write: writeApiKey
     }
   });
   const registry2 = createServiceRegistry();
@@ -5833,14 +6291,16 @@ function createCliContainer(dependencies) {
     httpClient,
     commandRunner: wrappedRunner,
     providers,
-    dependencies
+    dependencies,
+    readApiKey,
+    writeApiKey
   };
   return container;
 }
 var init_container2 = __esm({
   async "src/cli/container.ts"() {
     "use strict";
-    init_credentials2();
+    init_src();
     init_environment();
     init_service_registry();
     init_context();
@@ -5848,8 +6308,8 @@ var init_container2 = __esm({
     init_options();
     init_logger2();
     init_error_logger();
+    init_src5();
     init_src4();
-    init_src3();
     await init_providers();
     init_poe_code_command_runner();
   }
@@ -6027,7 +6487,7 @@ var init_configure = __esm({
 });
 
 // src/cli/commands/spawn.ts
-import path10 from "node:path";
+import path11 from "node:path";
 function registerSpawnCommand(program, container, options = {}) {
   const spawnServices = container.registry.list().filter((service) => typeof service.spawn === "function" || getSpawnConfig(service.name)).map((service) => service.name);
   const extraServices = options.extraServices ?? [];
@@ -6152,7 +6612,7 @@ function registerSpawnCommand(program, container, options = {}) {
       if (!proceed) {
         return;
       }
-      const { events, result } = spawn3(canonicalService, {
+      const { events, result } = spawn4(canonicalService, {
         prompt: spawnOptions.prompt,
         args: spawnOptions.args,
         model: spawnOptions.model,
@@ -6215,16 +6675,16 @@ function resolveSpawnWorkingDirectory2(baseDir, candidate) {
   if (!candidate || candidate.trim().length === 0) {
     return void 0;
   }
-  if (path10.isAbsolute(candidate)) {
+  if (path11.isAbsolute(candidate)) {
     return candidate;
   }
-  return path10.resolve(baseDir, candidate);
+  return path11.resolve(baseDir, candidate);
 }
 var init_spawn4 = __esm({
   async "src/cli/commands/spawn.ts"() {
     "use strict";
+    init_src5();
     init_src4();
-    init_src3();
     init_credentials2();
     init_shared();
     init_spawn_core();
@@ -6233,7 +6693,7 @@ var init_spawn4 = __esm({
 });
 
 // src/sdk/research.ts
-import path11 from "node:path";
+import path12 from "node:path";
 async function research(container, options) {
   const logger2 = options.logger;
   const source = await resolveSource({
@@ -6243,7 +6703,7 @@ async function research(container, options) {
   });
   const researchPrompt = buildResearchPrompt(options.prompt);
   const mode = options.mode ?? "read";
-  const { events, result } = spawn3(options.agent, {
+  const { events, result } = spawn4(options.agent, {
     prompt: researchPrompt,
     args: options.args ?? [],
     model: options.model,
@@ -6268,7 +6728,7 @@ async function research(container, options) {
         markdown: markdownOutput
       });
       outputPath = buildOutputPath(container.env.homeDir, options.prompt);
-      await ensureDirectory2(container.fs, path11.dirname(outputPath));
+      await ensureDirectory2(container.fs, path12.dirname(outputPath));
       await container.fs.writeFile(outputPath, document, {
         encoding: "utf8"
       });
@@ -6343,7 +6803,7 @@ function buildResearchDocument(input) {
 }
 function buildClonePath(homeDir, github) {
   const slug = extractRepoSlug(github);
-  return path11.join(homeDir, ".poe-code", "repos", slug);
+  return path12.join(homeDir, ".poe-code", "repos", slug);
 }
 function extractRepoSlug(value) {
   const trimmed = value.trim();
@@ -6381,7 +6841,7 @@ function extractRepoSlug(value) {
 function buildOutputPath(homeDir, prompt, now = /* @__PURE__ */ new Date()) {
   const timestamp = formatTimestamp(now);
   const slug = buildSlug(prompt);
-  return path11.join(
+  return path12.join(
     homeDir,
     ".poe-code",
     "research",
@@ -6402,7 +6862,7 @@ async function resolveSource(input) {
   if (options.github) {
     const cloneUrl = resolveGithubCloneUrl(options.github);
     const clonePath = buildClonePath(container.env.homeDir, options.github);
-    await ensureDirectory2(container.fs, path11.dirname(clonePath));
+    await ensureDirectory2(container.fs, path12.dirname(clonePath));
     const exists = await pathExists2(container.fs, clonePath);
     if (!exists) {
       const cloneResult = await container.commandRunner(
@@ -6500,10 +6960,10 @@ function formatYamlString(value) {
   return JSON.stringify(value);
 }
 function resolvePath2(baseDir, candidate) {
-  if (path11.isAbsolute(candidate)) {
+  if (path12.isAbsolute(candidate)) {
     return candidate;
   }
-  return path11.resolve(baseDir, candidate);
+  return path12.resolve(baseDir, candidate);
 }
 function teeAcpStream(events) {
   const chunks = [];
@@ -6563,7 +7023,7 @@ async function removePathFallback(fs3, target) {
   if (stats && typeof stats.isDirectory === "function" && stats.isDirectory()) {
     const entries = await fs3.readdir(target);
     for (const entry of entries) {
-      await removePathFallback(fs3, path11.join(target, entry));
+      await removePathFallback(fs3, path12.join(target, entry));
     }
   }
   try {
@@ -6729,7 +7189,7 @@ async function resolveResearchModel(input) {
 var init_research2 = __esm({
   async "src/cli/commands/research.ts"() {
     "use strict";
-    init_src4();
+    init_src5();
     init_credentials2();
     await init_research();
     init_errors();
@@ -6738,13 +7198,13 @@ var init_research2 = __esm({
 });
 
 // src/cli/isolated-env-runner.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 async function isolatedEnvRunner(input) {
   const details = await resolveIsolatedEnvDetails(
     input.env,
     input.isolated,
     input.providerName,
-    input.fs
+    input.readApiKey
   );
   let args = input.argv.slice(2);
   if (input.isolated.requiresConfig !== false) {
@@ -6759,11 +7219,11 @@ async function isolatedEnvRunner(input) {
     const resolvedSettings = await resolveCliSettings(
       input.isolated.cliSettings,
       input.env,
-      input.fs
+      input.readApiKey
     );
     args = buildArgsWithMergedSettings(args, resolvedSettings);
   }
-  const child = spawn4(details.agentBinary, args, {
+  const child = spawn5(details.agentBinary, args, {
     stdio: "inherit",
     env: {
       ...process.env,
@@ -6796,7 +7256,7 @@ async function configExists(fs3, filePath) {
 var init_isolated_env_runner = __esm({
   "src/cli/isolated-env-runner.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     init_isolated_env();
     init_cli_settings_merge();
   }
@@ -6846,6 +7306,7 @@ function registerWrapCommand(program, container) {
     await isolatedEnvRunner({
       env: container.env,
       fs: container.fs,
+      readApiKey: container.readApiKey,
       providerName: adapter.name,
       isolated,
       argv: ["node", "poe-code", ...forwarded]
@@ -6879,11 +7340,9 @@ function registerLoginCommand(program, container) {
         fs: container.fs,
         filePath: container.env.credentialsPath
       });
-      await saveCredentials({
-        fs: resources.context.fs,
-        filePath: container.env.credentialsPath,
-        apiKey: normalized
-      });
+      if (!flags.dryRun) {
+        await container.writeApiKey(normalized);
+      }
       await reconfigureServices({
         program,
         container,
@@ -7253,7 +7712,7 @@ async function executeTest(program, container, service, options = {}) {
     container.env,
     adapter.isolatedEnv,
     adapter.name,
-    container.fs
+    container.readApiKey
   ) : null;
   if (options.isolated && adapter.isolatedEnv) {
     const { ensureIsolatedConfigForService: ensureIsolatedConfigForService2 } = await Promise.resolve().then(() => (init_ensure_isolated_config(), ensure_isolated_config_exports));
@@ -7302,7 +7761,7 @@ var init_test = __esm({
     init_shared();
     init_configure();
     init_isolated_env();
-    init_src3();
+    init_src4();
   }
 });
 
@@ -7355,7 +7814,7 @@ var init_media_download = __esm({
 });
 
 // src/cli/commands/generate.ts
-import path12 from "node:path";
+import path13 from "node:path";
 function registerGenerateCommand(program, container) {
   const generate2 = program.command("generate").description("Generate content via Poe API").option("--model <model>", `Model identifier (default: ${DEFAULT_TEXT_MODEL})`).option(
     "--param <key=value>",
@@ -7618,11 +8077,11 @@ function getDefaultMimeType(type) {
   return defaults[type];
 }
 function resolveOutputPath(filename, cwd) {
-  if (path12.isAbsolute(filename)) {
+  if (path13.isAbsolute(filename)) {
     return { path: filename, label: filename };
   }
   return {
-    path: path12.join(cwd, filename),
+    path: path13.join(cwd, filename),
     label: `./${filename}`
   };
 }
@@ -7630,7 +8089,7 @@ var MODEL_ENV_KEYS2, DEFAULT_MODELS2;
 var init_generate = __esm({
   "src/cli/commands/generate.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_constants();
     init_shared();
     init_client_instance();
@@ -8726,8 +9185,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path20, errorMaps, issueData } = params;
-      const fullPath = [...path20, ...issueData.path || []];
+      const { data, path: path21, errorMaps, issueData } = params;
+      const fullPath = [...path21, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -9007,11 +9466,11 @@ var init_types3 = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path20, key) {
+      constructor(parent, value, path21, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path20;
+        this._path = path21;
         this._key = key;
       }
       get path() {
@@ -12515,10 +12974,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path20) {
-  if (!path20)
+function getElementAtPath(obj, path21) {
+  if (!path21)
     return obj;
-  return path20.reduce((acc, key) => acc?.[key], obj);
+  return path21.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -12830,11 +13289,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path20, issues) {
+function prefixIssues(path21, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path20);
+    iss.path.unshift(path21);
     return iss;
   });
 }
@@ -13210,7 +13669,7 @@ __export(regexes_exports, {
   extendedDuration: () => extendedDuration,
   guid: () => guid,
   hex: () => hex,
-  hostname: () => hostname,
+  hostname: () => hostname2,
   html5Email: () => html5Email,
   idnEmail: () => idnEmail,
   integer: () => integer,
@@ -13277,7 +13736,7 @@ function fixedBase64(bodyLength, padding) {
 function fixedBase64url(length) {
   return new RegExp(`^[A-Za-z0-9_-]{${length}}$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname2, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
 var init_regexes = __esm({
   "node_modules/zod/v4/core/regexes.js"() {
     init_util2();
@@ -13315,7 +13774,7 @@ var init_regexes = __esm({
     cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
     base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
     base64url = /^[A-Za-z0-9_-]*$/;
-    hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+    hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
     domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
     e164 = /^\+[1-9]\d{6,14}$/;
     dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
@@ -18521,7 +18980,7 @@ __export(schemas_exports3, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   instanceof: () => _instanceof,
   int: () => int,
@@ -18668,7 +19127,7 @@ function jwt(params) {
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname2(_params) {
+function hostname3(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
 }
 function hex2(_params) {
@@ -24792,8 +25251,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path20) {
-      let input = path20;
+    function removeDotSegments(path21) {
+      let input = path21;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -24992,8 +25451,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path20, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path20 && path20 !== "/" ? path20 : void 0;
+        const [path21, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path21 && path21 !== "/" ? path21 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -34107,7 +34566,7 @@ var init_content = __esm({
 });
 
 // packages/tiny-stdio-mcp-server/src/index.ts
-var init_src5 = __esm({
+var init_src6 = __esm({
   "packages/tiny-stdio-mcp-server/src/index.ts"() {
     "use strict";
     init_server();
@@ -34411,7 +34870,7 @@ var generateTextSchema, generateImageSchema, generateVideoSchema, generateAudioS
 var init_mcp_server = __esm({
   "src/cli/mcp-server.ts"() {
     "use strict";
-    init_src5();
+    init_src6();
     init_client_instance();
     init_constants();
     generateTextSchema = defineSchema({
@@ -34669,7 +35128,7 @@ ${panel.footer}`);
 var init_command_not_found = __esm({
   "src/cli/command-not-found.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_execution_context();
     init_errors();
   }
@@ -34704,7 +35163,7 @@ var agentMcpConfigs, supportedAgents;
 var init_configs2 = __esm({
   "packages/agent-mcp-config/src/configs.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     agentMcpConfigs = {
       "claude-code": {
         configFile: "~/.claude.json",
@@ -34817,9 +35276,9 @@ var init_shapes = __esm({
 });
 
 // packages/agent-mcp-config/src/apply.ts
-import path13 from "node:path";
+import path14 from "node:path";
 function getConfigDirectory(configPath) {
-  return path13.dirname(configPath);
+  return path14.dirname(configPath);
 }
 function isConfigObject5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -34908,7 +35367,7 @@ var UnsupportedAgentError;
 var init_apply = __esm({
   "packages/agent-mcp-config/src/apply.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     init_configs2();
     init_shapes();
     UnsupportedAgentError = class extends Error {
@@ -34921,7 +35380,7 @@ var init_apply = __esm({
 });
 
 // packages/agent-mcp-config/src/index.ts
-var init_src6 = __esm({
+var init_src7 = __esm({
   "packages/agent-mcp-config/src/index.ts"() {
     "use strict";
     init_configs2();
@@ -34979,10 +35438,7 @@ function registerMcpCommand(program, container) {
   mcp.command("configure [agent]").description("Configure MCP client to use poe-code").option("-y, --yes", "Skip prompt, use claude-code").action(async (agentArg, options) => {
     const flags = resolveCommandFlags(program);
     const resources = createExecutionResources(container, flags, "mcp");
-    const existingKey = await loadCredentials({
-      fs: container.fs,
-      filePath: container.env.credentialsPath
-    });
+    const existingKey = await container.readApiKey();
     if (!existingKey) {
       resources.logger.intro("login");
       await container.options.resolveApiKey({ dryRun: flags.dryRun });
@@ -35082,10 +35538,7 @@ async function runMcpServer(container, options) {
   const outputFormatPreferences = parseMcpOutputFormatPreferences(
     options.outputFormat
   );
-  const apiKey = await loadCredentials({
-    fs: container.fs,
-    filePath: container.env.credentialsPath
-  });
+  const apiKey = await container.readApiKey();
   if (!apiKey) {
     process.stderr.write("No credentials found. Run 'poe-code login' first.\n");
     process.exit(1);
@@ -35102,22 +35555,21 @@ var DEFAULT_MCP_AGENT;
 var init_mcp = __esm({
   "src/cli/commands/mcp.ts"() {
     "use strict";
-    init_src3();
-    init_credentials2();
+    init_src4();
     init_client_instance();
     init_mcp_server();
     init_shared();
     init_mcp_output_format();
     init_command_not_found();
-    init_src6();
+    init_src7();
     init_execution_context();
     DEFAULT_MCP_AGENT = "claude-code";
   }
 });
 
 // packages/agent-skill-config/src/configs.ts
-import os3 from "node:os";
-import path14 from "node:path";
+import os2 from "node:os";
+import path15 from "node:path";
 function resolveAgentSupport2(input, registry2 = agentSkillConfigs) {
   const resolvedId = resolveAgentId(input);
   if (!resolvedId) {
@@ -35133,7 +35585,7 @@ var agentSkillConfigs, supportedAgents2;
 var init_configs3 = __esm({
   "packages/agent-skill-config/src/configs.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     agentSkillConfigs = {
       "claude-code": {
         globalSkillDir: "~/.claude/skills",
@@ -35153,7 +35605,7 @@ var init_configs3 = __esm({
 });
 
 // packages/agent-skill-config/src/templates.ts
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile2 } from "node:fs/promises";
 async function getTemplates() {
   if (templatesCache) {
     return templatesCache;
@@ -35162,7 +35614,7 @@ async function getTemplates() {
     "./templates/poe-generate.md",
     import.meta.url
   );
-  const poeGenerateTemplate = await readFile3(poeGenerateTemplateUrl, "utf8");
+  const poeGenerateTemplate = await readFile2(poeGenerateTemplateUrl, "utf8");
   templatesCache = {
     "poe-generate.md": poeGenerateTemplate
   };
@@ -35294,7 +35746,7 @@ var UnsupportedAgentError2, bundledSkillTemplateIds, SKILL_TEMPLATE_ID;
 var init_apply2 = __esm({
   "packages/agent-skill-config/src/apply.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     init_configs3();
     init_templates();
     UnsupportedAgentError2 = class extends Error {
@@ -35309,7 +35761,7 @@ var init_apply2 = __esm({
 });
 
 // packages/agent-skill-config/src/index.ts
-var init_src7 = __esm({
+var init_src8 = __esm({
   "packages/agent-skill-config/src/index.ts"() {
     "use strict";
     init_configs3();
@@ -35533,8 +35985,8 @@ var DEFAULT_SKILL_AGENT;
 var init_skill = __esm({
   "src/cli/commands/skill.ts"() {
     "use strict";
-    init_src3();
-    init_src7();
+    init_src4();
+    init_src8();
     init_shared();
     init_command_not_found();
     DEFAULT_SKILL_AGENT = "claude-code";
@@ -35624,7 +36076,7 @@ async function displayVersion(container, currentVersion) {
 var init_version2 = __esm({
   "src/cli/commands/version.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_version();
     init_exit_signals();
   }
@@ -35749,10 +36201,10 @@ var init_registry2 = __esm({
 });
 
 // packages/worktree/src/create.ts
-import { join as join2 } from "node:path";
+import { join } from "node:path";
 async function createWorktree(opts) {
   const branch = `poe-code/${opts.name}`;
-  const worktreePath = join2(opts.worktreeDir, opts.name);
+  const worktreePath = join(opts.worktreeDir, opts.name);
   try {
     await opts.deps.exec(`git worktree remove ${worktreePath} --force`, { cwd: opts.cwd });
   } catch {
@@ -35827,7 +36279,7 @@ var init_list = __esm({
 });
 
 // packages/worktree/src/index.ts
-var init_src8 = __esm({
+var init_src9 = __esm({
   "packages/worktree/src/index.ts"() {
     "use strict";
     init_create();
@@ -35916,13 +36368,13 @@ function getDirtyFiles(cwd) {
   for (const line of lines) {
     if (!line) continue;
     if (line.length < 4) continue;
-    let path20 = line.slice(3).trim();
+    let path21 = line.slice(3).trim();
     const renameArrow = " -> ";
-    const arrowIndex = path20.lastIndexOf(renameArrow);
+    const arrowIndex = path21.lastIndexOf(renameArrow);
     if (arrowIndex >= 0) {
-      path20 = path20.slice(arrowIndex + renameArrow.length).trim();
+      path21 = path21.slice(arrowIndex + renameArrow.length).trim();
     }
-    if (path20) files.push(path20);
+    if (path21) files.push(path21);
   }
   return files;
 }
@@ -35934,7 +36386,7 @@ var init_utils2 = __esm({
 
 // packages/ralph/src/plan/parser.ts
 import { parse as parse7 } from "yaml";
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asOptionalString(value, field) {
@@ -35985,7 +36437,7 @@ function normalizeStatus(value) {
   );
 }
 function parseStory(value, index) {
-  if (!isRecord3(value)) throw new Error(`Invalid stories[${index}]: expected object`);
+  if (!isRecord5(value)) throw new Error(`Invalid stories[${index}]: expected object`);
   return {
     id: asRequiredString(value.id, `stories[${index}].id`),
     title: asRequiredString(value.title, `stories[${index}].title`),
@@ -36009,7 +36461,7 @@ function parsePlan(yamlContent) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     throw new Error(`Invalid plan YAML: ${message}`, { cause: error2 });
   }
-  if (!isRecord3(doc)) {
+  if (!isRecord5(doc)) {
     throw new Error("Invalid plan YAML: expected top-level object");
   }
   const storiesValue = doc.stories;
@@ -36075,17 +36527,17 @@ function serializePlan(prd) {
   return yaml.endsWith("\n") ? yaml : `${yaml}
 `;
 }
-function lockPlanFile(path20) {
-  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile(path21) {
+  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
-async function writePlan(path20, prd, options = {}) {
+async function writePlan(path21, prd, options = {}) {
   const fs3 = options.fs ?? fsPromises2;
   const lock = options.lock ?? lockPlanFile;
-  await fs3.mkdir(dirname3(path20), { recursive: true });
-  const release = await lock(path20);
+  await fs3.mkdir(dirname3(path21), { recursive: true });
+  const release = await lock(path21);
   try {
     const yaml = serializePlan(prd);
-    await fs3.writeFile(path20, yaml, { encoding: "utf8" });
+    await fs3.writeFile(path21, yaml, { encoding: "utf8" });
   } finally {
     await release();
   }
@@ -36104,7 +36556,7 @@ function renderPrompt(template, variables) {
 var init_renderer2 = __esm({
   "packages/ralph/src/prompt/renderer.ts"() {
     "use strict";
-    init_src();
+    init_src2();
   }
 });
 
@@ -36173,8 +36625,8 @@ var init_selector = __esm({
 // packages/ralph/src/story/updater.ts
 import { dirname as dirname4 } from "node:path";
 import * as fsPromises3 from "node:fs/promises";
-function lockPlanFile2(path20) {
-  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile2(path21) {
+  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
 function assertStoryStatus(value) {
   if (value === "open") return;
@@ -36255,9 +36707,9 @@ function appendSection(lines, title, items, options) {
   }
   lines.push("");
 }
-async function writeRunMeta(path20, metadata, options = {}) {
+async function writeRunMeta(path21, metadata, options = {}) {
   const fs3 = options.fs ?? fsPromises4;
-  await fs3.mkdir(dirname5(path20), { recursive: true });
+  await fs3.mkdir(dirname5(path21), { recursive: true });
   const lines = [];
   lines.push("# Ralph Run Summary", "");
   lines.push(`- Run ID: ${metadata.runId}`);
@@ -36286,7 +36738,7 @@ async function writeRunMeta(path20, metadata, options = {}) {
   const git = metadata.git ?? null;
   if (!git) {
     lines.push("");
-    await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
+    await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
     return;
   }
   lines.push("", "## Git");
@@ -36301,7 +36753,7 @@ async function writeRunMeta(path20, metadata, options = {}) {
     lines.push("");
   } else {
     lines.push("");
-    await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
+    await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
     return;
   }
   if (git.commits !== void 0 && git.commits !== null) {
@@ -36321,7 +36773,7 @@ async function writeRunMeta(path20, metadata, options = {}) {
   appendSection(lines, "### Uncommitted Changes", git.dirtyFiles, {
     emptyLabel: "(none)"
   });
-  await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
+  await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
 }
 var init_metadata = __esm({
   "packages/ralph/src/run/metadata.ts"() {
@@ -36409,9 +36861,9 @@ async function defaultStreamingSpawn(agentId, options) {
     exitCode: result.exitCode
   };
 }
-function absPath(cwd, path20) {
-  if (!path20) return resolvePath3(cwd);
-  return path20.startsWith("/") ? path20 : resolvePath3(cwd, path20);
+function absPath(cwd, path21) {
+  if (!path21) return resolvePath3(cwd);
+  return path21.startsWith("/") ? path21 : resolvePath3(cwd, path21);
 }
 function pad2(value) {
   return value < 10 ? `0${value}` : String(value);
@@ -36461,8 +36913,8 @@ async function appendToErrorsLog(fs3, errorsLogPath, message) {
   await fs3.mkdir(dirname6(errorsLogPath), { recursive: true });
   await fs3.writeFile(errorsLogPath, `${previous}${next}`, { encoding: "utf8" });
 }
-function lockPlanFile3(path20) {
-  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile3(path21) {
+  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
 function getCurrentBranch(cwd) {
   try {
@@ -36564,7 +37016,7 @@ async function defaultPromptOverbake(args) {
 async function buildLoop(options) {
   const fs3 = options.deps?.fs ?? fsPromises5;
   const lock = options.deps?.lock ?? lockPlanFile3;
-  const spawn5 = options.deps?.spawn ?? defaultStreamingSpawn;
+  const spawn6 = options.deps?.spawn ?? defaultStreamingSpawn;
   const git = options.deps?.git ?? {
     getHead,
     getCommitList,
@@ -36618,7 +37070,7 @@ async function buildLoop(options) {
       });
       worktreeBranch = entry.branch;
       const worktreePath = entry.path;
-      const symlinkFn = fs3.symlink ?? ((target, path20) => fsPromises5.symlink(target, path20));
+      const symlinkFn = fs3.symlink ?? ((target, path21) => fsPromises5.symlink(target, path21));
       const exec = worktreeDeps.exec;
       const dirsToLink = [".poe-code-ralph", ".agents/poe-code-ralph"];
       for (const dir of dirsToLink) {
@@ -36733,7 +37185,7 @@ async function buildLoop(options) {
     let stderrForErrorsLog;
     let overbakeAction = null;
     try {
-      const result = await spawn5(options.agent, {
+      const result = await spawn6(options.agent, {
         prompt,
         cwd,
         model: options.model,
@@ -36906,10 +37358,10 @@ var init_loop = __esm({
   "packages/ralph/src/build/loop.ts"() {
     "use strict";
     init_lock();
+    init_src5();
     init_src4();
-    init_src3();
-    init_src();
-    init_src8();
+    init_src2();
+    init_src9();
     init_detector();
     init_utils2();
     init_parser();
@@ -36923,18 +37375,18 @@ var init_loop = __esm({
 });
 
 // packages/ralph/src/plan/resolver.ts
-import path15 from "node:path";
+import path16 from "node:path";
 import * as fsPromises6 from "node:fs/promises";
 function isPlanCandidateFile(fileName) {
   const lower = fileName.toLowerCase();
   if (!lower.startsWith("plan")) {
     return false;
   }
-  const ext = path15.extname(lower);
+  const ext = path16.extname(lower);
   return ext === ".yml" || ext === ".yaml";
 }
 async function listPlanCandidates(fs3, cwd) {
-  const plansDir = path15.join(cwd, ".agents", "poe-code-ralph", "plans");
+  const plansDir = path16.join(cwd, ".agents", "poe-code-ralph", "plans");
   let entries;
   try {
     entries = await fs3.readdir(plansDir);
@@ -36949,12 +37401,12 @@ async function listPlanCandidates(fs3, cwd) {
     if (!isPlanCandidateFile(entry)) {
       continue;
     }
-    const absPath2 = path15.join(plansDir, entry);
+    const absPath2 = path16.join(plansDir, entry);
     const stats = await fs3.stat(absPath2);
     if (!stats.isFile()) {
       continue;
     }
-    const relativePath = path15.relative(cwd, absPath2);
+    const relativePath = path16.relative(cwd, absPath2);
     const content = await fs3.readFile(absPath2, "utf8");
     const plan = parsePlan(content);
     const done = plan.stories.filter((s) => s.status === "done").length;
@@ -36973,7 +37425,7 @@ async function resolvePlanPath(options) {
   const cwd = options.cwd;
   const provided = options.plan?.trim();
   if (provided) {
-    const absPath2 = path15.isAbsolute(provided) ? provided : path15.resolve(cwd, provided);
+    const absPath2 = path16.isAbsolute(provided) ? provided : path16.resolve(cwd, provided);
     try {
       const stats = await fs3.stat(absPath2);
       if (!stats.isFile()) {
@@ -37022,21 +37474,21 @@ async function resolvePlanPath(options) {
 var init_resolver = __esm({
   "packages/ralph/src/plan/resolver.ts"() {
     "use strict";
-    init_src3();
-    init_src();
+    init_src4();
+    init_src2();
     init_parser();
   }
 });
 
 // packages/ralph/src/plan/generator.ts
-import path16 from "node:path";
+import path17 from "node:path";
 import * as fsPromises7 from "node:fs/promises";
 var PLAN_PROMPT_TEMPLATE;
 var init_generator = __esm({
   "packages/ralph/src/plan/generator.ts"() {
     "use strict";
-    init_src4();
-    init_src();
+    init_src5();
+    init_src2();
     init_renderer2();
     PLAN_PROMPT_TEMPLATE = [
       "# Plan",
@@ -37098,27 +37550,27 @@ function formatTimestamp3(date4) {
   const seconds = pad22(date4.getSeconds());
   return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
 }
-function validateLogPath(path20) {
-  if (typeof path20 !== "string" || path20.trim().length === 0) {
+function validateLogPath(path21) {
+  if (typeof path21 !== "string" || path21.trim().length === 0) {
     throw new Error(
-      `Invalid activity log path: expected a non-empty string, got ${String(path20)}`
+      `Invalid activity log path: expected a non-empty string, got ${String(path21)}`
     );
   }
-  if (path20.includes("\0")) {
+  if (path21.includes("\0")) {
     throw new Error("Invalid activity log path: contains null byte");
   }
 }
-async function logActivity(path20, message, options = {}) {
-  validateLogPath(path20);
+async function logActivity(path21, message, options = {}) {
+  validateLogPath(path21);
   const fs3 = options.fs ?? fsPromises8;
-  const parent = dirname7(path20);
+  const parent = dirname7(path21);
   if (parent && parent !== ".") {
     await fs3.mkdir(parent, { recursive: true });
   }
   const entry = `[${formatTimestamp3(/* @__PURE__ */ new Date())}] ${message}
 `;
   try {
-    await fs3.appendFile(path20, entry, { encoding: "utf8" });
+    await fs3.appendFile(path21, entry, { encoding: "utf8" });
   } catch (error2) {
     const detail = error2 instanceof Error ? error2.message : `Unknown error: ${String(error2)}`;
     throw new Error(`Failed to append activity log entry: ${detail}`, { cause: error2 });
@@ -37131,7 +37583,7 @@ var init_activity = __esm({
 });
 
 // packages/ralph/src/config/loader.ts
-import path17 from "node:path";
+import path18 from "node:path";
 import * as fsPromises9 from "node:fs/promises";
 import YAML from "yaml";
 function isPlainObject2(value) {
@@ -37166,8 +37618,8 @@ function pickOptionalPositiveInt(config2, key, options) {
   return value;
 }
 async function loadSingleConfig(configDir, fs3) {
-  const yamlPath = path17.join(configDir, "config.yaml");
-  const jsonPath = path17.join(configDir, "config.json");
+  const yamlPath = path18.join(configDir, "config.yaml");
+  const jsonPath = path18.join(configDir, "config.json");
   let raw = null;
   let format = null;
   let sourcePath = null;
@@ -37240,14 +37692,14 @@ async function loadConfig(cwd, deps) {
   const sources = [];
   let merged = {};
   if (deps?.homeDir) {
-    const globalDir = path17.join(deps.homeDir, ".poe-code", "ralph");
+    const globalDir = path18.join(deps.homeDir, ".poe-code", "ralph");
     const globalResult = await loadSingleConfig(globalDir, fs3);
     if (globalResult) {
       merged = globalResult.config;
       sources.push({ path: globalResult.sourcePath, scope: "global" });
     }
   }
-  const localDir = path17.join(cwd, ".agents", "poe-code-ralph");
+  const localDir = path18.join(cwd, ".agents", "poe-code-ralph");
   const localResult = await loadSingleConfig(localDir, fs3);
   if (localResult) {
     merged = mergeConfigs(merged, localResult.config);
@@ -37258,7 +37710,7 @@ async function loadConfig(cwd, deps) {
 var init_loader = __esm({
   "packages/ralph/src/config/loader.ts"() {
     "use strict";
-    init_src();
+    init_src2();
   }
 });
 
@@ -37269,7 +37721,7 @@ async function ralphBuild(options) {
     cwd: options.cwd ?? process.cwd()
   });
 }
-var init_src9 = __esm({
+var init_src10 = __esm({
   "packages/ralph/src/index.ts"() {
     "use strict";
     init_loop();
@@ -37289,12 +37741,12 @@ var require_PROMPT_worktree_merge = __commonJS({
 });
 
 // src/cli/commands/ralph-worktree.ts
-import path18 from "node:path";
+import path19 from "node:path";
 import { execSync as execSync3 } from "node:child_process";
 function registerRalphWorktreeCommand(ralph, container) {
   ralph.command("worktree").description("Merge a completed worktree back into the main branch.").argument("<name>", "Name of the worktree to merge").option("--agent <name>", "Agent to use for the merge").action(async function(name) {
     const cwd = container.env.cwd;
-    const registryFile = path18.join(cwd, ".poe-code-ralph", "worktrees.yaml");
+    const registryFile = path19.join(cwd, ".poe-code-ralph", "worktrees.yaml");
     const worktrees = await listWorktrees(cwd, registryFile, {
       fs: {
         readFile: (p, enc) => container.fs.readFile(p, enc),
@@ -37357,10 +37809,10 @@ function registerRalphWorktreeCommand(ralph, container) {
 var init_ralph_worktree = __esm({
   "src/cli/commands/ralph-worktree.ts"() {
     "use strict";
-    init_src3();
-    init_src8();
     init_src4();
-    init_src();
+    init_src9();
+    init_src5();
+    init_src2();
     init_errors();
   }
 });
@@ -37436,7 +37888,7 @@ var require_activity = __commonJS({
 });
 
 // src/cli/commands/ralph.ts
-import path19 from "node:path";
+import path20 from "node:path";
 async function loadRalphTemplates() {
   const [
     promptPartialPlan,
@@ -37521,7 +37973,7 @@ async function writeFileOrSkip(args) {
     args.logger.info(`Skip: ${args.displayPath} (already exists)`);
     return "skipped";
   }
-  await args.fs.mkdir(path19.dirname(args.filePath), { recursive: true });
+  await args.fs.mkdir(path20.dirname(args.filePath), { recursive: true });
   await args.fs.writeFile(args.filePath, args.contents, { encoding: "utf8" });
   args.logger.info(`${exists ? "Overwrite" : "Create"}: ${args.displayPath}`);
   return "written";
@@ -37557,22 +38009,22 @@ async function installRalphTemplates(args) {
     const promptPlanContents = templates.promptPlan.replace("{{{PROMPT_PARTIAL_PLAN}}}", templates.promptPartialPlan);
     const templateWrites = [
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "PROMPT_plan.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "PROMPT_plan.md"),
         displayPath: ".agents/poe-code-ralph/PROMPT_plan.md",
         contents: promptPlanContents
       },
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "PROMPT_build.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "PROMPT_build.md"),
         displayPath: ".agents/poe-code-ralph/PROMPT_build.md",
         contents: templates.promptBuild
       },
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "references", "GUARDRAILS.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "references", "GUARDRAILS.md"),
         displayPath: ".agents/poe-code-ralph/references/GUARDRAILS.md",
         contents: templates.refGuardrails
       },
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "references", "CONTEXT_ENGINEERING.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "references", "CONTEXT_ENGINEERING.md"),
         displayPath: ".agents/poe-code-ralph/references/CONTEXT_ENGINEERING.md",
         contents: templates.refContextEngineering
       }
@@ -37590,22 +38042,22 @@ async function installRalphTemplates(args) {
     const stateFiles = [
       {
         contents: templates.stateProgress,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "progress.md"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "progress.md"),
         displayPath: ".poe-code-ralph/progress.md"
       },
       {
         contents: templates.stateGuardrails,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "guardrails.md"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "guardrails.md"),
         displayPath: ".poe-code-ralph/guardrails.md"
       },
       {
         contents: templates.stateErrors,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "errors.log"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "errors.log"),
         displayPath: ".poe-code-ralph/errors.log"
       },
       {
         contents: templates.stateActivity,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "activity.log"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "activity.log"),
         displayPath: ".poe-code-ralph/activity.log"
       }
     ];
@@ -37652,7 +38104,7 @@ function registerRalphCommand(program, container) {
       throw new ValidationError(message2);
     }
     const rawPath = options.activityLog?.trim() || configActivityLogPath || ".poe-code-ralph/activity.log";
-    const resolvedPath = path19.isAbsolute(rawPath) ? rawPath : path19.resolve(container.env.cwd, rawPath);
+    const resolvedPath = path20.isAbsolute(rawPath) ? rawPath : path20.resolve(container.env.cwd, rawPath);
     await logActivity(resolvedPath, trimmedMessage, {
       fs: container.fs
     });
@@ -37664,7 +38116,7 @@ function registerRalphCommand(program, container) {
     if (!planPath) {
       throw new ValidationError("--plan <path> is required.");
     }
-    const resolvedPath = path19.isAbsolute(planPath) ? planPath : path19.resolve(cwd, planPath);
+    const resolvedPath = path20.isAbsolute(planPath) ? planPath : path20.resolve(cwd, planPath);
     let content;
     try {
       content = await container.fs.readFile(resolvedPath, "utf8");
@@ -37838,7 +38290,7 @@ function registerRalphCommand(program, container) {
       } else {
         try {
           const planContent = await container.fs.readFile(
-            path19.resolve(cwd, planPath),
+            path20.resolve(cwd, planPath),
             "utf8"
           );
           const plan = parsePlan(planContent);
@@ -37872,7 +38324,7 @@ function registerRalphCommand(program, container) {
       } else {
         try {
           const planContent = await container.fs.readFile(
-            path19.resolve(cwd, planPath),
+            path20.resolve(cwd, planPath),
             "utf8"
           );
           const plan = parsePlan(planContent);
@@ -37928,10 +38380,10 @@ var templateImports, DEFAULT_RALPH_AGENT;
 var init_ralph = __esm({
   "src/cli/commands/ralph.ts"() {
     "use strict";
-    init_src3();
-    init_src9();
-    init_src7();
-    init_src();
+    init_src4();
+    init_src10();
+    init_src8();
+    init_src2();
     init_errors();
     init_shared();
     init_ralph_worktree();
@@ -38149,7 +38601,7 @@ var init_usage = __esm({
     "use strict";
     init_shared();
     init_errors();
-    init_src3();
+    init_src4();
   }
 });
 
@@ -38242,10 +38694,7 @@ function registerModelsCommand(program, container) {
     const commandOptions = this.opts();
     resources.logger.intro("models");
     try {
-      const apiKey = await loadCredentials({
-        fs: container.fs,
-        filePath: container.env.credentialsPath
-      });
+      const apiKey = await container.readApiKey();
       if (flags.dryRun) {
         resources.logger.dryRun(
           "Dry run: would fetch models from Poe API."
@@ -38433,9 +38882,8 @@ var init_models = __esm({
   "src/cli/commands/models.ts"() {
     "use strict";
     init_shared();
-    init_credentials2();
     init_errors();
-    init_src3();
+    init_src4();
     MAX_VALUES_LENGTH = 105;
     MAX_DEFAULT_LENGTH = 36;
   }
@@ -38447,7 +38895,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "poe-code",
-      version: "3.0.68",
+      version: "3.0.69-beta.2",
       description: "CLI tool to configure Poe API for developer workflows.",
       type: "module",
       main: "./dist/index.js",
@@ -38528,6 +38976,7 @@ var init_package = __esm({
       devDependencies: {
         "@eslint/js": "^9.0.0",
         "@modelcontextprotocol/sdk": "^1.26.0",
+        "@poe-code/auth": "*",
         "@poe-code/agent-spawn": "*",
         "@poe-code/config-mutations": "*",
         "@poe-code/design-system": "*",
@@ -38830,7 +39279,7 @@ var init_program = __esm({
   async "src/cli/program.ts"() {
     "use strict";
     await init_container2();
-    init_src3();
+    init_src4();
     init_configure();
     await init_spawn4();
     await init_research2();
@@ -38927,7 +39376,7 @@ function createPromptRunner(adapter = {
 var init_prompt_runner = __esm({
   "src/cli/prompt-runner.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_errors();
   }
 });
@@ -38938,17 +39387,17 @@ __export(bootstrap_exports, {
   createCliMain: () => createCliMain,
   isCliInvocation: () => isCliInvocation
 });
-import * as nodeFs from "node:fs/promises";
+import * as nodeFs2 from "node:fs/promises";
 import * as nodeFsSync3 from "node:fs";
 import { realpathSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
-import { join as join3 } from "node:path";
+import { join as join2 } from "node:path";
 import chalk13 from "chalk";
 function createCliMain(programFactory) {
   return async function runCli() {
-    const homeDir = homedir3();
-    const logDir = join3(homeDir, ".poe-code", "logs");
+    const homeDir = homedir4();
+    const logDir = join2(homeDir, ".poe-code", "logs");
     const promptRunner = createPromptRunner();
     const shouldLogToStderr = process.env.POE_CODE_STDERR_LOGS === "1" || process.env.POE_CODE_STDERR_LOGS === "true";
     const errorLogger = new ErrorLogger({
@@ -38983,7 +39432,7 @@ function createCliMain(programFactory) {
         } else {
           log2.error(`Error: ${error2.message}`);
           log2.message(
-            `See logs at ${join3(logDir, "errors.log")} for more details.`,
+            `See logs at ${join2(logDir, "errors.log")} for more details.`,
             { symbol: chalk13.magenta("\u25CF") }
           );
         }
@@ -39009,11 +39458,11 @@ var fsAdapter;
 var init_bootstrap = __esm({
   "src/cli/bootstrap.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_error_logger();
     init_errors();
     init_prompt_runner();
-    fsAdapter = nodeFs;
+    fsAdapter = nodeFs2;
   }
 });
 
@@ -39152,6 +39601,6 @@ export {
   getPoeApiKey,
   isCliInvocation2 as isCliInvocation,
   main,
-  spawn3 as spawn
+  spawn4 as spawn
 };
 //# sourceMappingURL=index.js.map