poe-code 3.0.71-beta.1 → 3.0.71

package/dist/index.js

@@ -31,469 +31,34 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// packages/auth/src/encrypted-file-auth-store.ts
-import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
-import { promises as fs } from "node:fs";
-import { homedir, hostname, userInfo } from "node:os";
-import path from "node:path";
-function defaultMachineIdentity() {
-  return {
-    hostname: hostname(),
-    username: userInfo().username
-  };
-}
-async function deriveEncryptionKey(getMachineIdentity) {
-  const machineIdentity = await getMachineIdentity();
-  const secret = `${machineIdentity.hostname}:${machineIdentity.username}`;
-  return await new Promise((resolve, reject) => {
-    scrypt(secret, ENCRYPTION_SALT, ENCRYPTION_KEY_BYTES, (error2, derivedKey) => {
-      if (error2) {
-        reject(error2);
-        return;
-      }
-      resolve(Buffer.from(derivedKey));
-    });
-  });
-}
-function parseEncryptedDocument(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    if (!isRecord(parsed)) {
-      return null;
-    }
-    if (parsed.version !== ENCRYPTION_VERSION) {
-      return null;
-    }
-    if (typeof parsed.iv !== "string" || typeof parsed.authTag !== "string" || typeof parsed.ciphertext !== "string") {
-      return null;
-    }
-    return {
-      version: parsed.version,
-      iv: parsed.iv,
-      authTag: parsed.authTag,
-      ciphertext: parsed.ciphertext
-    };
-  } catch {
-    return null;
-  }
-}
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function isNotFoundError(error2) {
-  return Boolean(
-    error2 && typeof error2 === "object" && "code" in error2 && error2.code === "ENOENT"
-  );
-}
-var ENCRYPTION_ALGORITHM, ENCRYPTION_VERSION, ENCRYPTION_KEY_BYTES, ENCRYPTION_IV_BYTES, ENCRYPTION_AUTH_TAG_BYTES, ENCRYPTION_SALT, ENCRYPTION_FILE_MODE, EncryptedFileAuthStore;
-var init_encrypted_file_auth_store = __esm({
-  "packages/auth/src/encrypted-file-auth-store.ts"() {
-    "use strict";
-    ENCRYPTION_ALGORITHM = "aes-256-gcm";
-    ENCRYPTION_VERSION = 1;
-    ENCRYPTION_KEY_BYTES = 32;
-    ENCRYPTION_IV_BYTES = 12;
-    ENCRYPTION_AUTH_TAG_BYTES = 16;
-    ENCRYPTION_SALT = "poe-code:encrypted-file-auth-store:v1";
-    ENCRYPTION_FILE_MODE = 384;
-    EncryptedFileAuthStore = class {
-      fs;
-      filePath;
-      getMachineIdentity;
-      getRandomBytes;
-      keyPromise = null;
-      constructor(input = {}) {
-        this.fs = input.fs ?? fs;
-        this.filePath = input.filePath ?? path.join(
-          (input.getHomeDirectory ?? homedir)(),
-          ".poe-code",
-          "credentials.enc"
-        );
-        this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
-        this.getRandomBytes = input.getRandomBytes ?? randomBytes;
-      }
-      async getApiKey() {
-        let rawDocument;
-        try {
-          rawDocument = await this.fs.readFile(this.filePath, "utf8");
-        } catch (error2) {
-          if (isNotFoundError(error2)) {
-            return null;
-          }
-          throw error2;
-        }
-        const document = parseEncryptedDocument(rawDocument);
-        if (!document) {
-          return null;
-        }
-        const key = await this.getEncryptionKey();
-        try {
-          const iv = Buffer.from(document.iv, "base64");
-          const authTag = Buffer.from(document.authTag, "base64");
-          const ciphertext = Buffer.from(document.ciphertext, "base64");
-          if (iv.byteLength !== ENCRYPTION_IV_BYTES || authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
-            return null;
-          }
-          const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
-          decipher.setAuthTag(authTag);
-          const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-          return plaintext.toString("utf8");
-        } catch {
-          return null;
-        }
-      }
-      async setApiKey(apiKey) {
-        const key = await this.getEncryptionKey();
-        const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
-        const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
-        const ciphertext = Buffer.concat([
-          cipher.update(apiKey, "utf8"),
-          cipher.final()
-        ]);
-        const authTag = cipher.getAuthTag();
-        const document = {
-          version: ENCRYPTION_VERSION,
-          iv: iv.toString("base64"),
-          authTag: authTag.toString("base64"),
-          ciphertext: ciphertext.toString("base64")
-        };
-        await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
-        await this.fs.writeFile(this.filePath, JSON.stringify(document), {
-          encoding: "utf8"
-        });
-        await this.fs.chmod(this.filePath, ENCRYPTION_FILE_MODE);
-      }
-      async deleteApiKey() {
-        try {
-          await this.fs.unlink(this.filePath);
-        } catch (error2) {
-          if (!isNotFoundError(error2)) {
-            throw error2;
-          }
-        }
-      }
-      getEncryptionKey() {
-        if (!this.keyPromise) {
-          this.keyPromise = deriveEncryptionKey(this.getMachineIdentity);
-        }
-        return this.keyPromise;
-      }
-    };
-  }
-});
-
-// packages/auth/src/keychain-auth-store.ts
-import { spawn } from "node:child_process";
-function runSecurityCommand(command, args) {
-  return new Promise((resolve) => {
-    const child = spawn(command, args, {
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout?.setEncoding("utf8");
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr?.setEncoding("utf8");
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    child.on("error", (error2) => {
-      const message = error2 instanceof Error ? error2.message : String(error2 ?? "Unknown error");
-      resolve({
-        stdout,
-        stderr: stderr ? `${stderr}${message}` : message,
-        exitCode: 127
-      });
-    });
-    child.on("close", (code) => {
-      resolve({
-        stdout,
-        stderr,
-        exitCode: code ?? 0
-      });
-    });
-  });
-}
-function stripTrailingLineBreak(value) {
-  if (value.endsWith("\r\n")) {
-    return value.slice(0, -2);
-  }
-  if (value.endsWith("\n") || value.endsWith("\r")) {
-    return value.slice(0, -1);
-  }
-  return value;
-}
-function isKeychainEntryNotFound(result) {
-  if (result.exitCode === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE) {
-    return true;
-  }
-  const output = `${result.stderr}
-${result.stdout}`.toLowerCase();
-  return output.includes("could not be found") || output.includes("item not found") || output.includes("errsecitemnotfound");
-}
-function createSecurityCliFailure(operation, result) {
-  const details = result.stderr.trim() || result.stdout.trim();
-  if (details) {
-    return new Error(
-      `Failed to ${operation}: security exited with code ${result.exitCode}: ${details}`
-    );
-  }
-  return new Error(`Failed to ${operation}: security exited with code ${result.exitCode}`);
-}
-var SECURITY_CLI, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE, KeychainAuthStore;
-var init_keychain_auth_store = __esm({
-  "packages/auth/src/keychain-auth-store.ts"() {
-    "use strict";
-    SECURITY_CLI = "security";
-    KEYCHAIN_SERVICE = "poe-code";
-    KEYCHAIN_ACCOUNT = "api-key";
-    KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE = 44;
-    KeychainAuthStore = class {
-      runCommand;
-      service;
-      account;
-      constructor(input = {}) {
-        this.runCommand = input.runCommand ?? runSecurityCommand;
-        this.service = input.service ?? KEYCHAIN_SERVICE;
-        this.account = input.account ?? KEYCHAIN_ACCOUNT;
-      }
-      async getApiKey() {
-        const result = await this.executeSecurityCommand(
-          ["find-generic-password", "-s", this.service, "-a", this.account, "-w"],
-          "read API key from macOS Keychain"
-        );
-        if (result.exitCode === 0) {
-          return stripTrailingLineBreak(result.stdout);
-        }
-        if (isKeychainEntryNotFound(result)) {
-          return null;
-        }
-        throw createSecurityCliFailure("read API key from macOS Keychain", result);
-      }
-      async setApiKey(apiKey) {
-        const result = await this.executeSecurityCommand(
-          [
-            "add-generic-password",
-            "-s",
-            this.service,
-            "-a",
-            this.account,
-            "-w",
-            apiKey,
-            "-U"
-          ],
-          "store API key in macOS Keychain"
-        );
-        if (result.exitCode !== 0) {
-          throw createSecurityCliFailure("store API key in macOS Keychain", result);
-        }
-      }
-      async deleteApiKey() {
-        const result = await this.executeSecurityCommand(
-          ["delete-generic-password", "-s", this.service, "-a", this.account],
-          "delete API key from macOS Keychain"
-        );
-        if (result.exitCode === 0 || isKeychainEntryNotFound(result)) {
-          return;
-        }
-        throw createSecurityCliFailure("delete API key from macOS Keychain", result);
-      }
-      async executeSecurityCommand(args, operation) {
-        try {
-          return await this.runCommand(SECURITY_CLI, args);
-        } catch (error2) {
-          const message = error2 instanceof Error ? error2.message : String(error2);
-          throw new Error(`Failed to ${operation}: ${message}`);
-        }
-      }
-    };
-  }
-});
-
-// packages/auth/src/create-auth-store.ts
-import { promises as nodeFs } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path2 from "node:path";
-function createAuthStore(input = {}) {
-  const backend = resolveBackend(input);
-  const platform = input.platform ?? process.platform;
-  if (backend === "keychain" && platform !== MACOS_PLATFORM) {
-    throw new Error(
-      `POE_AUTH_BACKEND=keychain is only supported on macOS. Current platform: ${platform}`
-    );
-  }
-  const store = authStoreFactories[backend](input);
-  return {
-    backend,
-    store: enableLegacyCredentialsMigration(store, input)
-  };
-}
-function resolveBackend(input) {
-  const configuredBackend = input.backend ?? input.env?.[AUTH_BACKEND_ENV_VAR] ?? process.env[AUTH_BACKEND_ENV_VAR];
-  if (configuredBackend === "keychain") {
-    return "keychain";
-  }
-  return "file";
-}
-function enableLegacyCredentialsMigration(store, input) {
-  const migrationContext = createLegacyMigrationContext(input);
-  const readApiKeyFromStore = store.getApiKey.bind(store);
-  let hasCheckedLegacyCredentials = false;
-  let legacyMigrationPromise = null;
-  store.getApiKey = async () => {
-    const storedApiKey = await readApiKeyFromStore();
-    if (isNonEmptyString(storedApiKey)) {
-      return storedApiKey;
-    }
-    if (hasCheckedLegacyCredentials) {
-      return null;
-    }
-    if (!legacyMigrationPromise) {
-      legacyMigrationPromise = migrateLegacyApiKey(store, migrationContext).finally(() => {
-        hasCheckedLegacyCredentials = true;
-        legacyMigrationPromise = null;
-      });
-    }
-    return legacyMigrationPromise;
-  };
-  return store;
-}
-async function migrateLegacyApiKey(store, migrationContext) {
-  const legacyCredentials = await loadLegacyCredentials(
-    migrationContext.fs,
-    migrationContext.filePath
-  );
-  if (!legacyCredentials || !isNonEmptyString(legacyCredentials.apiKey)) {
-    return null;
-  }
-  const plaintextApiKey = legacyCredentials.apiKey;
-  try {
-    await store.setApiKey(plaintextApiKey);
-    delete legacyCredentials.apiKey;
-    await saveLegacyCredentials(
-      migrationContext.fs,
-      migrationContext.filePath,
-      legacyCredentials
-    );
-  } catch (error2) {
-    migrationContext.logWarning(
-      `Failed to migrate plaintext API key from ${migrationContext.filePath}.`,
-      error2
-    );
-  }
-  return plaintextApiKey;
-}
-function createLegacyMigrationContext(input) {
-  const legacyCredentialsInput = input.legacyCredentials;
-  const getHomeDirectory = legacyCredentialsInput?.getHomeDirectory ?? homedir2;
-  return {
-    fs: legacyCredentialsInput?.fs ?? input.fileStore?.fs ?? nodeFs,
-    filePath: legacyCredentialsInput?.filePath ?? path2.join(
-      getHomeDirectory(),
-      LEGACY_CREDENTIALS_RELATIVE_PATH
-    ),
-    logWarning: legacyCredentialsInput?.logWarning ?? defaultMigrationWarning
-  };
-}
-async function loadLegacyCredentials(fs3, filePath) {
-  let raw;
-  try {
-    raw = await fs3.readFile(filePath, "utf8");
-  } catch (error2) {
-    if (isNotFoundError2(error2)) {
-      return null;
-    }
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (!isRecord2(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-async function saveLegacyCredentials(fs3, filePath, document) {
-  await fs3.mkdir(path2.dirname(filePath), { recursive: true });
-  await fs3.writeFile(filePath, `${JSON.stringify(document, null, 2)}
-`, {
-    encoding: "utf8"
-  });
-}
-function defaultMigrationWarning(message, error2) {
-  const details = toErrorDetails(error2);
-  if (details.length > 0) {
-    console.warn(`${message} ${details}`);
-    return;
-  }
-  console.warn(message);
-}
-function toErrorDetails(error2) {
-  if (error2 instanceof Error) {
-    return error2.message;
-  }
-  return typeof error2 === "string" ? error2 : "";
-}
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.length > 0;
-}
-function isRecord2(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function isNotFoundError2(error2) {
-  return Boolean(
-    error2 && typeof error2 === "object" && "code" in error2 && error2.code === "ENOENT"
-  );
-}
-var AUTH_BACKEND_ENV_VAR, MACOS_PLATFORM, LEGACY_CREDENTIALS_RELATIVE_PATH, authStoreFactories;
-var init_create_auth_store = __esm({
-  "packages/auth/src/create-auth-store.ts"() {
-    "use strict";
-    init_encrypted_file_auth_store();
-    init_keychain_auth_store();
-    AUTH_BACKEND_ENV_VAR = "POE_AUTH_BACKEND";
-    MACOS_PLATFORM = "darwin";
-    LEGACY_CREDENTIALS_RELATIVE_PATH = ".poe-code/credentials.json";
-    authStoreFactories = {
-      file: (input) => new EncryptedFileAuthStore(input.fileStore),
-      keychain: (input) => new KeychainAuthStore(input.keychainStore)
-    };
-  }
-});
-
-// packages/auth/src/index.ts
-var init_src = __esm({
-  "packages/auth/src/index.ts"() {
-    "use strict";
-    init_create_auth_store();
-    init_encrypted_file_auth_store();
-    init_keychain_auth_store();
-  }
-});
-
 // src/sdk/credentials.ts
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
 async function getPoeApiKey() {
   const envKey = process.env.POE_API_KEY;
   if (typeof envKey === "string" && envKey.trim().length > 0) {
     return envKey.trim();
   }
-  const { store } = createAuthStore();
-  const storedKey = await store.getApiKey();
-  if (typeof storedKey === "string" && storedKey.trim().length > 0) {
-    return storedKey.trim();
+  const homeDir = os.homedir();
+  const credentialsPath = path.join(homeDir, CREDENTIALS_RELATIVE_PATH);
+  try {
+    const content = await fs.readFile(credentialsPath, "utf8");
+    const parsed = JSON.parse(content);
+    if (typeof parsed === "object" && parsed !== null && typeof parsed.apiKey === "string" && parsed.apiKey.length > 0) {
+      return parsed.apiKey;
+    }
+  } catch {
   }
   throw new Error(
     "No API key found. Set POE_API_KEY or run 'poe-code login'."
   );
 }
+var CREDENTIALS_RELATIVE_PATH;
 var init_credentials = __esm({
   "src/sdk/credentials.ts"() {
     "use strict";
-    init_src();
+    CREDENTIALS_RELATIVE_PATH = ".poe-code/credentials.json";
   }
 });
 
@@ -818,16 +383,16 @@ function getConfigFormat(pathOrFormat) {
   }
   return formatRegistry[formatName];
 }
-function detectFormat(path21) {
-  const ext = getExtension(path21);
+function detectFormat(path20) {
+  const ext = getExtension(path20);
   return extensionMap[ext];
 }
-function getExtension(path21) {
-  const lastDot = path21.lastIndexOf(".");
+function getExtension(path20) {
+  const lastDot = path20.lastIndexOf(".");
   if (lastDot === -1) {
     return "";
   }
-  return path21.slice(lastDot).toLowerCase();
+  return path20.slice(lastDot).toLowerCase();
 }
 var formatRegistry, extensionMap;
 var init_formats = __esm({
@@ -849,7 +414,7 @@ var init_formats = __esm({
 });
 
 // packages/config-mutations/src/execution/path-utils.ts
-import path3 from "node:path";
+import path2 from "node:path";
 function expandHome(targetPath, homeDir) {
   if (!targetPath?.startsWith("~")) {
     return targetPath;
@@ -866,7 +431,7 @@ function expandHome(targetPath, homeDir) {
       remainder = remainder.slice(1);
     }
   }
-  return remainder.length === 0 ? homeDir : path3.join(homeDir, remainder);
+  return remainder.length === 0 ? homeDir : path2.join(homeDir, remainder);
 }
 function validateHomePath(targetPath) {
   if (typeof targetPath !== "string" || targetPath.length === 0) {
@@ -884,12 +449,12 @@ function resolvePath(rawPath, homeDir, pathMapper) {
   if (!pathMapper) {
     return expanded;
   }
-  const rawDirectory = path3.dirname(expanded);
+  const rawDirectory = path2.dirname(expanded);
   const mappedDirectory = pathMapper.mapTargetDirectory({
     targetDirectory: rawDirectory
   });
-  const filename = path3.basename(expanded);
-  return filename.length === 0 ? mappedDirectory : path3.join(mappedDirectory, filename);
+  const filename = path2.basename(expanded);
+  return filename.length === 0 ? mappedDirectory : path2.join(mappedDirectory, filename);
 }
 var init_path_utils = __esm({
   "packages/config-mutations/src/execution/path-utils.ts"() {
@@ -1550,7 +1115,7 @@ var init_types = __esm({
 });
 
 // packages/config-mutations/src/index.ts
-var init_src2 = __esm({
+var init_src = __esm({
   "packages/config-mutations/src/index.ts"() {
     "use strict";
     init_config_mutation();
@@ -1570,38 +1135,38 @@ import { createTwoFilesPatch } from "diff";
 import chalk from "chalk";
 function createDryRunFileSystem(base, recorder) {
   const proxy = {
-    async readFile(path21, encoding) {
+    async readFile(path20, encoding) {
       if (encoding) {
-        return base.readFile(path21, encoding);
+        return base.readFile(path20, encoding);
       }
-      return base.readFile(path21);
+      return base.readFile(path20);
     },
-    async writeFile(path21, data, options) {
-      const previousContent = await tryReadText(base, path21);
+    async writeFile(path20, data, options) {
+      const previousContent = await tryReadText(base, path20);
       const nextContent = formatData(data, options?.encoding);
       recorder.record({
         type: "writeFile",
-        path: path21,
+        path: path20,
         nextContent,
         previousContent
       });
     },
-    async mkdir(path21, options) {
-      recorder.record({ type: "mkdir", path: path21, options });
+    async mkdir(path20, options) {
+      recorder.record({ type: "mkdir", path: path20, options });
     },
-    async stat(path21) {
-      return base.stat(path21);
+    async stat(path20) {
+      return base.stat(path20);
     },
-    async unlink(path21) {
-      recorder.record({ type: "unlink", path: path21 });
+    async unlink(path20) {
+      recorder.record({ type: "unlink", path: path20 });
     },
-    async readdir(path21) {
-      return base.readdir(path21);
+    async readdir(path20) {
+      return base.readdir(path20);
     }
   };
   if (typeof base.rm === "function") {
-    proxy.rm = async (path21, options) => {
-      recorder.record({ type: "rm", path: path21, options });
+    proxy.rm = async (path20, options) => {
+      recorder.record({ type: "rm", path: path20, options });
     };
   }
   if (typeof base.copyFile === "function") {
@@ -1691,8 +1256,8 @@ function describeWriteChange(previous, next) {
   }
   return "update";
 }
-function renderWriteCommand(path21, change) {
-  const command = `cat > ${path21}`;
+function renderWriteCommand(path20, change) {
+  const command = `cat > ${path20}`;
   if (change === "create") {
     return renderOperationCommand(command, chalk.green, "# create");
   }
@@ -1854,9 +1419,9 @@ function redactTomlLine(line) {
   }
   return line;
 }
-async function tryReadText(base, path21) {
+async function tryReadText(base, path20) {
   try {
-    return await base.readFile(path21, "utf8");
+    return await base.readFile(path20, "utf8");
   } catch (error2) {
     if (isNotFound(error2)) {
       return null;
@@ -1882,7 +1447,7 @@ var REDACTED_PLACEHOLDER, JSON_SENSITIVE_KEYS, AUTH_SENSITIVE_KEYS, TOML_SENSITI
 var init_dry_run = __esm({
   "src/utils/dry-run.ts"() {
     "use strict";
-    init_src2();
+    init_src();
     REDACTED_PLACEHOLDER = "<redacted>";
     JSON_SENSITIVE_KEYS = ["apiKey", "api_key", "apiKeyHelper"];
     AUTH_SENSITIVE_KEYS = ["key"];
@@ -1917,6 +1482,7 @@ var init_constants = __esm({
     };
     DEFAULT_CLAUDE_CODE_MODEL = CLAUDE_CODE_VARIANTS.sonnet;
     CODEX_MODELS = [
+      "openai/gpt-5.3-codex",
       "openai/gpt-5.2-codex",
       "openai/gpt-5.2",
       "openai/gpt-5.2-chat",
@@ -2032,9 +1598,170 @@ var init_context = __esm({
   }
 });
 
+// src/services/credentials.ts
+import path3 from "node:path";
+async function saveCredentials(options) {
+  const { fs: fs3, filePath, apiKey } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  document.apiKey = apiKey;
+  await writeCredentialsDocument(fs3, filePath, document);
+}
+async function loadCredentials(options) {
+  const { fs: fs3, filePath } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  return typeof document.apiKey === "string" && document.apiKey.length > 0 ? document.apiKey : null;
+}
+async function deleteCredentials(options) {
+  const { fs: fs3, filePath } = options;
+  try {
+    await fs3.unlink(filePath);
+    return true;
+  } catch (error2) {
+    if (isNotFound(error2)) {
+      return false;
+    }
+    throw error2;
+  }
+}
+async function loadConfiguredServices(options) {
+  const { fs: fs3, filePath } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  return { ...document.configured_services ?? {} };
+}
+async function saveConfiguredService(options) {
+  const { fs: fs3, filePath, service, metadata } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  const normalized = normalizeConfiguredServiceMetadata(metadata);
+  document.configured_services = {
+    ...document.configured_services ?? {},
+    [service]: normalized
+  };
+  await writeCredentialsDocument(fs3, filePath, document);
+}
+async function unconfigureService(options) {
+  const { fs: fs3, filePath, service } = options;
+  const document = await readCredentialsDocument(fs3, filePath);
+  const services = document.configured_services;
+  if (!services || !(service in services)) {
+    return false;
+  }
+  delete services[service];
+  if (Object.keys(services).length === 0) {
+    delete document.configured_services;
+  }
+  await writeCredentialsDocument(fs3, filePath, document);
+  return true;
+}
+function normalizeConfiguredServiceMetadata(metadata) {
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const entry of metadata.files ?? []) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      continue;
+    }
+    if (!seen.has(entry)) {
+      files.push(entry);
+      seen.add(entry);
+    }
+  }
+  return {
+    files
+  };
+}
+async function readCredentialsDocument(fs3, filePath) {
+  try {
+    const raw = await fs3.readFile(filePath, "utf8");
+    return await parseCredentialsDocument(fs3, filePath, raw);
+  } catch (error2) {
+    if (isNotFound(error2)) {
+      return {};
+    }
+    throw error2;
+  }
+}
+async function parseCredentialsDocument(fs3, filePath, raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return normalizeCredentialsDocument(parsed);
+  } catch (error2) {
+    if (error2 instanceof SyntaxError) {
+      await recoverInvalidCredentials(fs3, filePath, raw);
+      return {};
+    }
+    throw error2;
+  }
+}
+function normalizeCredentialsDocument(value) {
+  if (!isRecord(value)) {
+    return {};
+  }
+  const document = {};
+  if (typeof value.apiKey === "string" && value.apiKey.length > 0) {
+    document.apiKey = value.apiKey;
+  }
+  const services = normalizeConfiguredServices(value.configured_services);
+  if (Object.keys(services).length > 0) {
+    document.configured_services = services;
+  }
+  return document;
+}
+function normalizeConfiguredServices(value) {
+  if (!isRecord(value)) {
+    return {};
+  }
+  const entries = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (!isRecord(entry)) {
+      continue;
+    }
+    const normalized = normalizeConfiguredServiceMetadata({
+      files: Array.isArray(entry.files) ? entry.files : []
+    });
+    entries[key] = normalized;
+  }
+  return entries;
+}
+async function writeCredentialsDocument(fs3, filePath, document) {
+  await fs3.mkdir(path3.dirname(filePath), { recursive: true });
+  const payload = {};
+  if (document.apiKey) {
+    payload.apiKey = document.apiKey;
+  }
+  if (document.configured_services) {
+    payload.configured_services = document.configured_services;
+  }
+  await fs3.writeFile(filePath, `${JSON.stringify(payload, null, 2)}
+`, {
+    encoding: "utf8"
+  });
+}
+async function recoverInvalidCredentials(fs3, filePath, content) {
+  const backupPath = createInvalidBackupPath(filePath);
+  await fs3.writeFile(backupPath, content, { encoding: "utf8" });
+  await fs3.writeFile(filePath, EMPTY_DOCUMENT, { encoding: "utf8" });
+}
+function createInvalidBackupPath(filePath) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const dir = path3.dirname(filePath);
+  const base = path3.basename(filePath);
+  return path3.join(dir, `${base}.invalid-${timestamp}.json`);
+}
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+var EMPTY_DOCUMENT;
+var init_credentials2 = __esm({
+  "src/services/credentials.ts"() {
+    "use strict";
+    init_src();
+    EMPTY_DOCUMENT = `${JSON.stringify({}, null, 2)}
+`;
+  }
+});
+
 // src/cli/isolated-env.ts
 import path4 from "node:path";
-async function resolveIsolatedEnvDetails(env, isolated, providerName, readApiKey) {
+async function resolveIsolatedEnvDetails(env, isolated, providerName, fs3) {
   if (!providerName) {
     throw new Error("resolveIsolatedEnvDetails requires providerName.");
   }
@@ -2047,7 +1774,7 @@ async function resolveIsolatedEnvDetails(env, isolated, providerName, readApiKey
   }
   return {
     agentBinary: isolated.agentBinary,
-    env: await resolveIsolatedEnvVars(env, baseDir, isolated.env, readApiKey),
+    env: await resolveIsolatedEnvVars(env, baseDir, isolated.env, fs3),
     configProbePath: isolated.configProbe ? resolveIsolatedEnvPath(env, baseDir, isolated.configProbe) : void 0
   };
 }
@@ -2076,14 +1803,14 @@ function resolveIsolatedTargetDirectory(input) {
 function resolveIsolatedBaseDir(env, providerName) {
   return env.resolveHomePath(".poe-code", providerName);
 }
-async function resolveIsolatedEnvVars(env, baseDir, vars, readApiKey) {
+async function resolveIsolatedEnvVars(env, baseDir, vars, fs3) {
   const out = {};
   for (const [key, value] of Object.entries(vars)) {
-    out[key] = await resolveIsolatedEnvValue(env, baseDir, value, readApiKey);
+    out[key] = await resolveIsolatedEnvValue(env, baseDir, value, fs3);
   }
   return out;
 }
-async function resolveIsolatedEnvValue(env, baseDir, value, readApiKey) {
+async function resolveIsolatedEnvValue(env, baseDir, value, fs3) {
   if (typeof value === "string") {
     return expandHomeShortcut(env, value);
   }
@@ -2101,12 +1828,12 @@ async function resolveIsolatedEnvValue(env, baseDir, value, readApiKey) {
     if (typeof resolved === "string" && resolved.trim().length > 0) {
       return resolved;
     }
-    if (!readApiKey) {
+    if (!fs3) {
       throw new Error(
         'Missing Poe API key for isolated wrapper. Set "POE_API_KEY" or run "poe-code login".'
       );
     }
-    return await resolvePoeApiKeyFromAuthStore(readApiKey);
+    return await resolvePoeApiKeyFromCredentials({ fs: fs3, env });
   }
   if (isPoeBaseUrlReference(value)) {
     return env.poeBaseUrl;
@@ -2133,8 +1860,8 @@ function isPoeApiKeyReference(value) {
 function isPoeBaseUrlReference(value) {
   return typeof value === "object" && value.kind === "poeBaseUrl";
 }
-async function resolvePoeApiKeyFromAuthStore(readApiKey) {
-  const stored = await readApiKey();
+async function resolvePoeApiKeyFromCredentials(input) {
+  const stored = await loadCredentials({ fs: input.fs, filePath: input.env.credentialsPath }) ?? void 0;
   if (typeof stored !== "string" || stored.trim().length === 0) {
     throw new Error(
       'Missing Poe API key for isolated wrapper. Set "POE_API_KEY" or run "poe-code login".'
@@ -2177,11 +1904,11 @@ async function applyIsolatedEnvRepairs(input) {
     }
   }
 }
-async function resolveCliSettings(cliSettings, env, readApiKey) {
+async function resolveCliSettings(cliSettings, env, fs3) {
   const result = { ...cliSettings.values };
   if (cliSettings.resolved) {
     for (const [key, value] of Object.entries(cliSettings.resolved)) {
-      result[key] = await resolveCliSettingValue(value, env, readApiKey);
+      result[key] = await resolveCliSettingValue(value, env, fs3);
     }
   }
   if (cliSettings.env) {
@@ -2190,21 +1917,21 @@ async function resolveCliSettings(cliSettings, env, readApiKey) {
       if (typeof value === "string") {
         resolvedEnv[key] = value;
       } else {
-        resolvedEnv[key] = await resolveCliSettingValue(value, env, readApiKey);
+        resolvedEnv[key] = await resolveCliSettingValue(value, env, fs3);
       }
     }
     result.env = resolvedEnv;
   }
   return result;
 }
-async function resolveCliSettingValue(value, env, readApiKey) {
+async function resolveCliSettingValue(value, env, fs3) {
   if (isPoeApiKeyReference(value)) {
     const resolved = env.getVariable("POE_API_KEY");
     if (typeof resolved === "string" && resolved.trim().length > 0) {
       return resolved;
     }
-    if (readApiKey) {
-      return await resolvePoeApiKeyFromAuthStore(readApiKey);
+    if (fs3) {
+      return await resolvePoeApiKeyFromCredentials({ fs: fs3, env });
     }
     throw new Error(
       'Missing Poe API key for CLI settings. Set "POE_API_KEY" or run "poe-code login".'
@@ -2245,16 +1972,17 @@ function expandHomeShortcut(env, input) {
 var init_isolated_env = __esm({
   "src/cli/isolated-env.ts"() {
     "use strict";
-    init_src2();
+    init_src();
+    init_credentials2();
   }
 });
 
 // packages/agent-spawn/src/run-command.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn } from "node:child_process";
 function runCommand(command, args, options) {
   return new Promise((resolve) => {
     const hasStdin = options?.stdin != null;
-    const child = spawn2(command, args, {
+    const child = spawn(command, args, {
       stdio: [hasStdin ? "pipe" : "ignore", "pipe", "pipe"],
       cwd: options?.cwd,
       env: options?.env ? {
@@ -2457,7 +2185,7 @@ var init_registry = __esm({
 });
 
 // packages/agent-defs/src/index.ts
-var init_src3 = __esm({
+var init_src2 = __esm({
   "packages/agent-defs/src/index.ts"() {
     "use strict";
     init_agents();
@@ -2682,7 +2410,7 @@ var allSpawnConfigs, lookup2;
 var init_configs = __esm({
   "packages/agent-spawn/src/configs/index.ts"() {
     "use strict";
-    init_src3();
+    init_src2();
     init_claude_code2();
     init_codex2();
     init_opencode2();
@@ -2717,7 +2445,7 @@ function resolveConfig(agentId) {
 var init_resolve_config = __esm({
   "packages/agent-spawn/src/configs/resolve-config.ts"() {
     "use strict";
-    init_src3();
+    init_src2();
     init_configs();
   }
 });
@@ -2800,7 +2528,7 @@ function buildCliArgs(config2, options, stdinMode) {
   }
   return args;
 }
-async function spawn3(agentId, options, context) {
+async function spawn2(agentId, options, context) {
   const { agentId: resolvedId, binaryName, spawnConfig } = resolveCliConfig(agentId);
   const stdinMode = options.useStdin && spawnConfig.stdinMode ? spawnConfig.stdinMode : void 0;
   const spawnArgs = buildCliArgs(spawnConfig, options, stdinMode);
@@ -3613,7 +3341,7 @@ var init_static = __esm({
 });
 
 // packages/design-system/src/index.ts
-var init_src4 = __esm({
+var init_src3 = __esm({
   "packages/design-system/src/index.ts"() {
     "use strict";
     init_tokens();
@@ -3706,7 +3434,7 @@ async function renderAcpStream(events) {
 var init_renderer = __esm({
   "packages/agent-spawn/src/acp/renderer.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
   }
 });
 
@@ -3716,13 +3444,13 @@ function truncate2(text4, maxLength) {
   if (maxLength <= 3) return text4.slice(0, maxLength);
   return `${text4.slice(0, maxLength - 3)}...`;
 }
-function isNonEmptyString2(value) {
+function isNonEmptyString(value) {
   return typeof value === "string" && value.length > 0;
 }
 function extractThreadId(value) {
   if (!value || typeof value !== "object") return;
   const obj = value;
-  const maybeThreadId = isNonEmptyString2(obj.thread_id) && obj.thread_id || isNonEmptyString2(obj.threadId) && obj.threadId || isNonEmptyString2(obj.threadID) && obj.threadID || isNonEmptyString2(obj.session_id) && obj.session_id || isNonEmptyString2(obj.sessionId) && obj.sessionId || isNonEmptyString2(obj.sessionID) && obj.sessionID;
+  const maybeThreadId = isNonEmptyString(obj.thread_id) && obj.thread_id || isNonEmptyString(obj.threadId) && obj.threadId || isNonEmptyString(obj.threadID) && obj.threadID || isNonEmptyString(obj.session_id) && obj.session_id || isNonEmptyString(obj.sessionId) && obj.sessionId || isNonEmptyString(obj.sessionID) && obj.sessionID;
   return maybeThreadId || void 0;
 }
 var init_utils = __esm({
@@ -3768,7 +3496,7 @@ async function* adaptClaude(lines) {
       continue;
     }
     const eventType = event.type;
-    if (!isNonEmptyString2(eventType)) continue;
+    if (!isNonEmptyString(eventType)) continue;
     if (!emittedSessionStart) {
       const threadId = extractThreadId(event);
       emittedSessionStart = true;
@@ -3791,16 +3519,16 @@ async function* adaptClaude(lines) {
       const item = block;
       if (!item || typeof item !== "object") continue;
       const blockType = item.type;
-      if (!isNonEmptyString2(blockType)) continue;
+      if (!isNonEmptyString(blockType)) continue;
       if (eventType === "assistant") {
-        if (blockType === "text" && isNonEmptyString2(item.text)) {
+        if (blockType === "text" && isNonEmptyString(item.text)) {
           yield {
             event: "agent_message",
             text: item.text
           };
           continue;
         }
-        if (blockType === "tool_use" && isNonEmptyString2(item.id) && isNonEmptyString2(item.name)) {
+        if (blockType === "tool_use" && isNonEmptyString(item.id) && isNonEmptyString(item.name)) {
           const kind = TOOL_KIND_MAP[item.name] ?? "other";
           toolKindsById.set(item.id, kind);
           yield {
@@ -3814,25 +3542,25 @@ async function* adaptClaude(lines) {
         continue;
       }
       if (eventType === "user") {
-        if (!isNonEmptyString2(item.tool_use_id)) continue;
+        if (!isNonEmptyString(item.tool_use_id)) continue;
         if (blockType !== "tool_result") continue;
         const kind = toolKindsById.get(item.tool_use_id);
         toolKindsById.delete(item.tool_use_id);
-        let path21;
+        let path20;
         if (typeof item.content === "string") {
-          path21 = item.content;
+          path20 = item.content;
         } else {
           try {
-            path21 = JSON.stringify(item.content);
+            path20 = JSON.stringify(item.content);
           } catch {
-            path21 = String(item.content);
+            path20 = String(item.content);
           }
         }
         yield {
           event: "tool_complete",
           id: item.tool_use_id,
           kind,
-          path: path21
+          path: path20
         };
       }
     }
@@ -3886,7 +3614,7 @@ async function* adaptCodex(lines) {
       continue;
     }
     const eventType = event.type;
-    if (!isNonEmptyString2(eventType)) continue;
+    if (!isNonEmptyString(eventType)) continue;
     if (eventType === "thread.started") {
       const maybeThreadId = extractThreadId(event);
       yield { event: "session_start", threadId: maybeThreadId };
@@ -3910,23 +3638,23 @@ async function* adaptCodex(lines) {
     const item = event.item ?? null;
     if (!item || typeof item !== "object") continue;
     const itemType = item.type;
-    if (!isNonEmptyString2(itemType)) continue;
+    if (!isNonEmptyString(itemType)) continue;
     if (eventType === "item.started") {
-      if (!isNonEmptyString2(item.id)) continue;
+      if (!isNonEmptyString(item.id)) continue;
       let kind;
       let title;
       if (itemType === "command_execution") {
         kind = "exec";
-        title = truncate2(isNonEmptyString2(item.command) ? item.command : "", 80);
+        title = truncate2(isNonEmptyString(item.command) ? item.command : "", 80);
       } else if (itemType === "file_edit") {
         kind = "edit";
-        title = isNonEmptyString2(item.path) ? item.path : "";
+        title = isNonEmptyString(item.path) ? item.path : "";
       } else if (itemType === "thinking") {
         kind = "think";
         title = "thinking...";
       } else if (itemType === "mcp_tool_call") {
-        const server = isNonEmptyString2(item.server) ? item.server : "unknown";
-        const tool = isNonEmptyString2(item.tool) ? item.tool : "unknown";
+        const server = isNonEmptyString(item.server) ? item.server : "unknown";
+        const tool = isNonEmptyString(item.tool) ? item.tool : "unknown";
         kind = "other";
         title = `${server}.${tool}`;
       }
@@ -3939,25 +3667,25 @@ async function* adaptCodex(lines) {
     }
     if (eventType === "item.completed") {
       if (itemType === "agent_message") {
-        if (!isNonEmptyString2(item.text)) continue;
+        if (!isNonEmptyString(item.text)) continue;
         yield { event: "agent_message", text: item.text };
         continue;
       }
       if (itemType === "reasoning") {
-        const text4 = isNonEmptyString2(item.text) ? item.text : isNonEmptyString2(item.content) ? item.content : isNonEmptyString2(item.summary) ? item.summary : void 0;
+        const text4 = isNonEmptyString(item.text) ? item.text : isNonEmptyString(item.content) ? item.content : isNonEmptyString(item.summary) ? item.summary : void 0;
         if (!text4) continue;
         yield { event: "reasoning", text: text4 };
         continue;
       }
-      if (!isNonEmptyString2(item.id)) continue;
+      if (!isNonEmptyString(item.id)) continue;
       if (itemType === "command_execution" || itemType === "file_edit" || itemType === "mcp_tool_call") {
         const kindFromStart = toolKindById.get(item.id);
         const kind = kindFromStart ?? (itemType === "command_execution" ? "exec" : itemType === "file_edit" ? "edit" : "other");
-        const titleFromEvent = isNonEmptyString2(item.path) ? item.path : itemType === "mcp_tool_call" ? `${isNonEmptyString2(item.server) ? item.server : "unknown"}.${isNonEmptyString2(item.tool) ? item.tool : "unknown"}` : void 0;
-        const path21 = titleFromEvent ?? toolTitleById.get(item.id) ?? "";
+        const titleFromEvent = isNonEmptyString(item.path) ? item.path : itemType === "mcp_tool_call" ? `${isNonEmptyString(item.server) ? item.server : "unknown"}.${isNonEmptyString(item.tool) ? item.tool : "unknown"}` : void 0;
+        const path20 = titleFromEvent ?? toolTitleById.get(item.id) ?? "";
         toolTitleById.delete(item.id);
         toolKindById.delete(item.id);
-        yield { event: "tool_complete", id: item.id, kind, path: path21 };
+        yield { event: "tool_complete", id: item.id, kind, path: path20 };
       }
     }
   }
@@ -3996,9 +3724,9 @@ async function* adaptKimi(lines) {
       }
     }
     const role = event.role;
-    if (!isNonEmptyString2(role) || role !== "assistant") continue;
+    if (!isNonEmptyString(role) || role !== "assistant") continue;
     const content = event.content;
-    if (!isNonEmptyString2(content)) continue;
+    if (!isNonEmptyString(content)) continue;
     yield { event: "agent_message", text: content };
   }
 }
@@ -4027,7 +3755,7 @@ async function* adaptNative(lines) {
       continue;
     }
     const maybeEventType = event?.event;
-    if (!isNonEmptyString2(maybeEventType)) {
+    if (!isNonEmptyString(maybeEventType)) {
       yield {
         event: "error",
         message: `[adaptNative] Line missing string "event" field: ${truncate2(line, 200)}`
@@ -4086,23 +3814,23 @@ async function* adaptOpenCode(lines) {
     }
     if (!event || typeof event !== "object") continue;
     const sessionID = extractThreadId(event);
-    if (!emittedSessionStart && isNonEmptyString2(sessionID)) {
+    if (!emittedSessionStart && isNonEmptyString(sessionID)) {
       emittedSessionStart = true;
       yield { event: "session_start", threadId: sessionID };
     }
     const eventType = event.type;
-    if (!isNonEmptyString2(eventType)) continue;
+    if (!isNonEmptyString(eventType)) continue;
     if (eventType === "text") {
       const part = event.part ?? null;
       if (!part || typeof part !== "object") continue;
-      if (!isNonEmptyString2(part.text)) continue;
+      if (!isNonEmptyString(part.text)) continue;
       yield { event: "agent_message", text: part.text };
       continue;
     }
     if (eventType === "tool_use") {
       const part = event.part ?? null;
       if (!part || typeof part !== "object") continue;
-      if (!isNonEmptyString2(part.callID) || !isNonEmptyString2(part.tool)) continue;
+      if (!isNonEmptyString(part.callID) || !isNonEmptyString(part.tool)) continue;
       const state = part.state ?? null;
       if (!state || typeof state !== "object") continue;
       const kind = guessToolKind(part.tool);
@@ -4114,7 +3842,7 @@ async function* adaptOpenCode(lines) {
         const maybeInput = state.input;
         if (kind === "exec" && maybeInput && typeof maybeInput === "object") {
           const command = maybeInput.command;
-          if (isNonEmptyString2(command)) {
+          if (isNonEmptyString(command)) {
             title = truncate2(command, 80);
           }
         }
@@ -4318,7 +4046,7 @@ var init_spawn2 = __esm({
 });
 
 // packages/agent-spawn/src/index.ts
-var init_src5 = __esm({
+var init_src4 = __esm({
   "packages/agent-spawn/src/index.ts"() {
     "use strict";
     init_run_command();
@@ -4498,8 +4226,8 @@ var init_shared = __esm({
     "use strict";
     init_context();
     init_isolated_env();
-    init_src5();
-    init_src3();
+    init_src4();
+    init_src2();
   }
 });
 
@@ -4620,7 +4348,7 @@ import path7 from "node:path";
 function createCliEnvironment(init) {
   const platform = init.platform ?? process.platform;
   const variables = init.variables ?? process.env;
-  const configPath = resolveConfigPath(init.homeDir);
+  const credentialsPath = resolveCredentialsPath(init.homeDir);
   const logDir = resolveLogDir(init.homeDir);
   const { poeApiBaseUrl, poeBaseUrl } = resolvePoeBaseUrls(variables);
   const resolveHomePath = (...segments) => path7.join(init.homeDir, ...segments);
@@ -4629,7 +4357,7 @@ function createCliEnvironment(init) {
     cwd: init.cwd,
     homeDir: init.homeDir,
     platform,
-    configPath,
+    credentialsPath,
     logDir,
     poeApiBaseUrl,
     poeBaseUrl,
@@ -4638,8 +4366,8 @@ function createCliEnvironment(init) {
     getVariable
   };
 }
-function resolveConfigPath(homeDir) {
-  return path7.join(homeDir, ".poe-code", "config.json");
+function resolveCredentialsPath(homeDir) {
+  return path7.join(homeDir, ".poe-code", "credentials.json");
 }
 function resolveLogDir(homeDir) {
   return path7.join(homeDir, ".poe-code", "logs");
@@ -4810,7 +4538,7 @@ function createServiceRegistry() {
 var init_service_registry = __esm({
   "src/cli/service-registry.ts"() {
     "use strict";
-    init_src3();
+    init_src2();
   }
 });
 
@@ -5078,7 +4806,7 @@ function isSilentError(error2) {
   }
   return error2.name === "SilentError" || error2.name === "OperationCancelledError";
 }
-var CliError, SilentError, ApiError, ValidationError, OperationCancelledError;
+var CliError, SilentError, ApiError, ValidationError, AuthenticationError, OperationCancelledError;
 var init_errors = __esm({
   "src/cli/errors.ts"() {
     "use strict";
@@ -5118,6 +4846,11 @@ var init_errors = __esm({
         super(message, context, { isUserError: true });
       }
     };
+    AuthenticationError = class extends CliError {
+      constructor(message, context) {
+        super(message, context, { isUserError: true });
+      }
+    };
     OperationCancelledError = class extends SilentError {
       constructor(message = "Operation cancelled.") {
         super(message, { isUserError: true });
@@ -5326,7 +5059,7 @@ function createLoggerFactory(emitter, theme) {
 var init_logger2 = __esm({
   "src/cli/logger.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
     init_errors();
   }
 });
@@ -5714,7 +5447,7 @@ async function ensureIsolatedConfigForService(input) {
     container.env,
     isolated,
     adapter.name,
-    container.readApiKey
+    container.fs
   );
   const hasConfig = await isolatedConfigExists(
     container.fs,
@@ -5789,7 +5522,7 @@ function createPoeCodeCommandRunner(input) {
       container.env,
       adapter.isolatedEnv,
       adapter.name,
-      container.readApiKey
+      container.fs
     );
     if (adapter.isolatedEnv.requiresConfig !== false) {
       const hasConfig = await isolatedConfigExists(
@@ -5820,7 +5553,7 @@ function createPoeCodeCommandRunner(input) {
       const resolvedSettings = await resolveCliSettings(
         adapter.isolatedEnv.cliSettings,
         container.env,
-        container.readApiKey
+        container.fs
       );
       forwarded = buildArgsWithMergedSettings(forwarded, resolvedSettings);
     }
@@ -5849,11 +5582,11 @@ var init_poe_code_command_runner = __esm({
 
 // src/sdk/container.ts
 import * as fs2 from "node:fs/promises";
-import * as os from "node:os";
+import * as os2 from "node:os";
 import * as nodeFsSync from "node:fs";
 function createSdkContainer(options) {
   const cwd = options?.cwd ?? process.cwd();
-  const homeDir = options?.homeDir ?? os.homedir();
+  const homeDir = options?.homeDir ?? os2.homedir();
   const variables = options?.variables ?? process.env;
   const verbose = options?.verbose ?? false;
   const environment = createCliEnvironment({
@@ -5872,44 +5605,23 @@ function createSdkContainer(options) {
   });
   loggerFactory.setErrorLogger(errorLogger);
   const asyncFs = {
-    readFile: ((path21, encoding) => {
+    readFile: ((path20, encoding) => {
       if (encoding) {
-        return fs2.readFile(path21, encoding);
+        return fs2.readFile(path20, encoding);
       }
-      return fs2.readFile(path21);
+      return fs2.readFile(path20);
     }),
-    writeFile: (path21, data, opts) => fs2.writeFile(path21, data, opts),
-    mkdir: (path21, opts) => fs2.mkdir(path21, opts).then(() => {
+    writeFile: (path20, data, opts) => fs2.writeFile(path20, data, opts),
+    mkdir: (path20, opts) => fs2.mkdir(path20, opts).then(() => {
     }),
-    stat: (path21) => fs2.stat(path21),
-    rm: (path21, opts) => fs2.rm(path21, opts),
-    unlink: (path21) => fs2.unlink(path21),
-    readdir: (path21) => fs2.readdir(path21),
+    stat: (path20) => fs2.stat(path20),
+    rm: (path20, opts) => fs2.rm(path20, opts),
+    unlink: (path20) => fs2.unlink(path20),
+    readdir: (path20) => fs2.readdir(path20),
     copyFile: (src, dest) => fs2.copyFile(src, dest),
-    chmod: (path21, mode) => fs2.chmod(path21, mode)
+    chmod: (path20, mode) => fs2.chmod(path20, mode)
   };
   const contextFactory = createCommandContextFactory({ fs: asyncFs });
-  const authFs = {
-    readFile: (filePath, encoding) => fs2.readFile(filePath, encoding),
-    writeFile: (filePath, data, options2) => fs2.writeFile(filePath, data, options2),
-    mkdir: (directoryPath, options2) => fs2.mkdir(directoryPath, options2).then(() => void 0),
-    unlink: (filePath) => fs2.unlink(filePath),
-    chmod: (filePath, mode) => fs2.chmod(filePath, mode)
-  };
-  const { store: authStore } = createAuthStore({
-    env: variables,
-    platform: process.platform,
-    fileStore: {
-      fs: authFs,
-      getHomeDirectory: () => homeDir
-    },
-    legacyCredentials: {
-      fs: authFs,
-      getHomeDirectory: () => homeDir
-    }
-  });
-  const readApiKey = authStore.getApiKey.bind(authStore);
-  const writeApiKey = authStore.setApiKey.bind(authStore);
   const noopPrompts = async () => {
     throw new Error("SDK does not support interactive prompts");
   };
@@ -5918,8 +5630,15 @@ function createSdkContainer(options) {
     prompts: noopPrompts,
     promptLibrary,
     apiKeyStore: {
-      read: readApiKey,
-      write: writeApiKey
+      read: () => loadCredentials({
+        fs: asyncFs,
+        filePath: environment.credentialsPath
+      }),
+      write: (value) => saveCredentials({
+        fs: asyncFs,
+        filePath: environment.credentialsPath,
+        apiKey: value
+      })
     },
     confirm: async () => true
   });
@@ -5966,9 +5685,7 @@ function createSdkContainer(options) {
         platform: process.platform,
         variables
       }
-    },
-    readApiKey,
-    writeApiKey
+    }
   };
   return container;
 }
@@ -5982,15 +5699,15 @@ var init_container = __esm({
     init_options();
     init_logger2();
     init_error_logger();
-    init_src5();
+    init_src4();
     await init_providers();
     init_poe_code_command_runner();
-    init_src();
+    init_credentials2();
   }
 });
 
 // src/sdk/spawn.ts
-function spawn4(service, promptOrOptions, maybeOptions) {
+function spawn3(service, promptOrOptions, maybeOptions) {
   const options = typeof promptOrOptions === "string" ? { ...maybeOptions, prompt: promptOrOptions } : promptOrOptions;
   const emptyEvents = (async function* () {
   })();
@@ -6053,7 +5770,7 @@ function spawn4(service, promptOrOptions, maybeOptions) {
       }
       if (spawnConfig && spawnConfig.kind === "cli") {
         resolveEventsOnce(emptyEvents);
-        return spawn3(service, {
+        return spawn2(service, {
           prompt: options.prompt,
           cwd: options.cwd,
           model: options.model,
@@ -6087,9 +5804,9 @@ var init_spawn3 = __esm({
     init_credentials();
     init_spawn_core();
     await init_container();
-    init_src5();
-    spawn4.pretty = async function pretty(service, promptOrOptions, maybeOptions) {
-      const { events, result } = spawn4(service, promptOrOptions, maybeOptions);
+    init_src4();
+    spawn3.pretty = async function pretty(service, promptOrOptions, maybeOptions) {
+      const { events, result } = spawn3(service, promptOrOptions, maybeOptions);
       await renderAcpStream(events);
       return result;
     };
@@ -6160,13 +5877,13 @@ async function readErrorBody(response) {
   }
 }
 function extractTextContent(data) {
-  if (!isRecord3(data)) return void 0;
+  if (!isRecord2(data)) return void 0;
   const choices = data.choices;
   if (!Array.isArray(choices) || choices.length === 0) return void 0;
   const first = choices[0];
-  if (!isRecord3(first)) return void 0;
+  if (!isRecord2(first)) return void 0;
   const message = first.message;
-  if (!isRecord3(message)) return void 0;
+  if (!isRecord2(message)) return void 0;
   return typeof message.content === "string" ? message.content : void 0;
 }
 function extractMediaFromCompletion(data) {
@@ -6174,14 +5891,14 @@ function extractMediaFromCompletion(data) {
   if (!content) return {};
   try {
     const parsed = JSON.parse(content);
-    if (isRecord3(parsed) && typeof parsed.url === "string") {
+    if (isRecord2(parsed) && typeof parsed.url === "string") {
       return {
         url: parsed.url,
         mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0,
         data: typeof parsed.data === "string" ? parsed.data : void 0
       };
     }
-    if (isRecord3(parsed) && typeof parsed.data === "string") {
+    if (isRecord2(parsed) && typeof parsed.data === "string") {
       return {
         data: parsed.data,
         mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0
@@ -6215,7 +5932,7 @@ function isValidUrl(value) {
     return false;
   }
 }
-function isRecord3(value) {
+function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 var init_llm_client = __esm({
@@ -6239,8 +5956,17 @@ async function initializeClient(options) {
   if (globalClient !== null) {
     return;
   }
+  const apiKey = await loadCredentials({
+    fs: options.fs,
+    filePath: options.credentialsPath
+  });
+  if (!apiKey) {
+    throw new AuthenticationError(
+      "Poe API key not found. Run 'poe-code login' first."
+    );
+  }
   const client = createPoeClient({
-    apiKey: options.apiKey,
+    apiKey,
     baseUrl: options.baseUrl,
     httpClient: options.httpClient
   });
@@ -6250,6 +5976,8 @@ var globalClient;
 var init_client_instance = __esm({
   "src/services/client-instance.ts"() {
     "use strict";
+    init_errors();
+    init_credentials2();
     init_llm_client();
     globalClient = null;
   }
@@ -6290,33 +6018,19 @@ function createCliContainer(dependencies) {
   });
   const commandRunner = dependencies.commandRunner ?? runCommand;
   const promptLibrary = createPromptLibrary();
-  const authFs = {
-    readFile: (filePath, encoding) => dependencies.fs.readFile(filePath, encoding),
-    writeFile: (filePath, data, opts) => dependencies.fs.writeFile(filePath, data, opts),
-    mkdir: (directoryPath, opts) => dependencies.fs.mkdir(directoryPath, opts).then(() => void 0),
-    unlink: (filePath) => dependencies.fs.unlink(filePath),
-    chmod: (filePath, mode) => dependencies.fs.chmod ? dependencies.fs.chmod(filePath, mode) : Promise.resolve()
-  };
-  const { store: authStore } = createAuthStore({
-    env: dependencies.env.variables,
-    platform: dependencies.env.platform,
-    fileStore: {
-      fs: authFs,
-      getHomeDirectory: () => dependencies.env.homeDir
-    },
-    legacyCredentials: {
-      fs: authFs,
-      getHomeDirectory: () => dependencies.env.homeDir
-    }
-  });
-  const readApiKey = authStore.getApiKey.bind(authStore);
-  const writeApiKey = authStore.setApiKey.bind(authStore);
   const options = createOptionResolvers({
     prompts: dependencies.prompts,
     promptLibrary,
     apiKeyStore: {
-      read: readApiKey,
-      write: writeApiKey
+      read: () => loadCredentials({
+        fs: dependencies.fs,
+        filePath: environment.credentialsPath
+      }),
+      write: (value) => saveCredentials({
+        fs: dependencies.fs,
+        filePath: environment.credentialsPath,
+        apiKey: value
+      })
     },
     confirm: async (message) => {
       const result = await confirm2({ message });
@@ -6352,16 +6066,14 @@ function createCliContainer(dependencies) {
     httpClient,
     commandRunner: wrappedRunner,
     providers,
-    dependencies,
-    readApiKey,
-    writeApiKey
+    dependencies
   };
   return container;
 }
 var init_container2 = __esm({
   async "src/cli/container.ts"() {
     "use strict";
-    init_src();
+    init_credentials2();
     init_environment();
     init_service_registry();
     init_context();
@@ -6369,176 +6081,14 @@ var init_container2 = __esm({
     init_options();
     init_logger2();
     init_error_logger();
-    init_src5();
     init_src4();
+    init_src3();
     await init_providers();
     init_poe_code_command_runner();
     init_errors();
   }
 });
 
-// src/services/config.ts
-import path10 from "node:path";
-async function deleteConfig(options) {
-  const { fs: fs3, filePath } = options;
-  try {
-    await fs3.unlink(filePath);
-    return true;
-  } catch (error2) {
-    if (isNotFound(error2)) {
-      return false;
-    }
-    throw error2;
-  }
-}
-async function loadConfiguredServices(options) {
-  const { fs: fs3, filePath } = options;
-  const document = await readConfigDocument(fs3, filePath);
-  return { ...document.configured_services ?? {} };
-}
-async function saveConfiguredService(options) {
-  const { fs: fs3, filePath, service, metadata } = options;
-  const document = await readConfigDocument(fs3, filePath);
-  const normalized = normalizeConfiguredServiceMetadata(metadata);
-  document.configured_services = {
-    ...document.configured_services ?? {},
-    [service]: normalized
-  };
-  await writeConfigDocument(fs3, filePath, document);
-}
-async function unconfigureService(options) {
-  const { fs: fs3, filePath, service } = options;
-  const document = await readConfigDocument(fs3, filePath);
-  const services = document.configured_services;
-  if (!services || !(service in services)) {
-    return false;
-  }
-  delete services[service];
-  if (Object.keys(services).length === 0) {
-    delete document.configured_services;
-  }
-  await writeConfigDocument(fs3, filePath, document);
-  return true;
-}
-function normalizeConfiguredServiceMetadata(metadata) {
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const entry of metadata.files ?? []) {
-    if (typeof entry !== "string" || entry.length === 0) {
-      continue;
-    }
-    if (!seen.has(entry)) {
-      files.push(entry);
-      seen.add(entry);
-    }
-  }
-  return {
-    files
-  };
-}
-async function readConfigDocument(fs3, filePath) {
-  try {
-    const raw = await fs3.readFile(filePath, "utf8");
-    return await parseConfigDocument(fs3, filePath, raw);
-  } catch (error2) {
-    if (isNotFound(error2)) {
-      return migrateLegacyCredentialsFile(fs3, filePath);
-    }
-    throw error2;
-  }
-}
-async function migrateLegacyCredentialsFile(fs3, configPath) {
-  const legacyPath = path10.join(path10.dirname(configPath), "credentials.json");
-  try {
-    const raw = await fs3.readFile(legacyPath, "utf8");
-    const document = await parseConfigDocument(fs3, legacyPath, raw);
-    await writeConfigDocument(fs3, configPath, document);
-    await fs3.unlink(legacyPath);
-    return document;
-  } catch {
-    return {};
-  }
-}
-async function parseConfigDocument(fs3, filePath, raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    return normalizeConfigDocument(parsed);
-  } catch (error2) {
-    if (error2 instanceof SyntaxError) {
-      await recoverInvalidConfig(fs3, filePath, raw);
-      return {};
-    }
-    throw error2;
-  }
-}
-function normalizeConfigDocument(value) {
-  if (!isRecord4(value)) {
-    return {};
-  }
-  const document = {};
-  if (typeof value.apiKey === "string" && value.apiKey.length > 0) {
-    document.apiKey = value.apiKey;
-  }
-  const services = normalizeConfiguredServices(value.configured_services);
-  if (Object.keys(services).length > 0) {
-    document.configured_services = services;
-  }
-  return document;
-}
-function normalizeConfiguredServices(value) {
-  if (!isRecord4(value)) {
-    return {};
-  }
-  const entries = {};
-  for (const [key, entry] of Object.entries(value)) {
-    if (!isRecord4(entry)) {
-      continue;
-    }
-    const normalized = normalizeConfiguredServiceMetadata({
-      files: Array.isArray(entry.files) ? entry.files : []
-    });
-    entries[key] = normalized;
-  }
-  return entries;
-}
-async function writeConfigDocument(fs3, filePath, document) {
-  await fs3.mkdir(path10.dirname(filePath), { recursive: true });
-  const payload = {};
-  if (document.apiKey) {
-    payload.apiKey = document.apiKey;
-  }
-  if (document.configured_services) {
-    payload.configured_services = document.configured_services;
-  }
-  await fs3.writeFile(filePath, `${JSON.stringify(payload, null, 2)}
-`, {
-    encoding: "utf8"
-  });
-}
-async function recoverInvalidConfig(fs3, filePath, content) {
-  const backupPath = createInvalidBackupPath(filePath);
-  await fs3.writeFile(backupPath, content, { encoding: "utf8" });
-  await fs3.writeFile(filePath, EMPTY_DOCUMENT, { encoding: "utf8" });
-}
-function createInvalidBackupPath(filePath) {
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dir = path10.dirname(filePath);
-  const base = path10.basename(filePath);
-  return path10.join(dir, `${base}.invalid-${timestamp}.json`);
-}
-function isRecord4(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-var EMPTY_DOCUMENT;
-var init_config = __esm({
-  "src/services/config.ts"() {
-    "use strict";
-    init_src2();
-    EMPTY_DOCUMENT = `${JSON.stringify({}, null, 2)}
-`;
-  }
-});
-
 // src/cli/commands/configure.ts
 function registerConfigureCommand(program, container) {
   const serviceNames = container.registry.list().map((service) => service.name);
@@ -6603,7 +6153,7 @@ async function executeConfigure(program, container, service, options) {
     if (!flags.dryRun) {
       await saveConfiguredService({
         fs: container.fs,
-        filePath: providerContext.env.configPath,
+        filePath: providerContext.env.credentialsPath,
         service: canonicalService,
         metadata: {
           files: tracker.files()
@@ -6703,7 +6253,7 @@ var init_configure = __esm({
     "use strict";
     init_shared();
     init_errors();
-    init_config();
+    init_credentials2();
     init_mutation_events();
     init_configure_payload();
     serviceSelectionPrompt = (action) => `Pick an agent to ${action}:`;
@@ -6711,7 +6261,7 @@ var init_configure = __esm({
 });
 
 // src/cli/commands/spawn.ts
-import path11 from "node:path";
+import path10 from "node:path";
 function registerSpawnCommand(program, container, options = {}) {
   const spawnServices = container.registry.list().filter((service) => typeof service.spawn === "function" || getSpawnConfig(service.name)).map((service) => service.name);
   const extraServices = options.extraServices ?? [];
@@ -6843,7 +6393,7 @@ function registerSpawnCommand(program, container, options = {}) {
       if (!proceed) {
         return;
       }
-      const { events, result } = spawn4(canonicalService, {
+      const { events, result } = spawn3(canonicalService, {
         prompt: spawnOptions.prompt,
         args: spawnOptions.args,
         model: spawnOptions.model,
@@ -6890,7 +6440,7 @@ Resume: ${resumeCommand}`));
 async function confirmUnconfiguredService(container, service, label, flags) {
   const configuredServices = await loadConfiguredServices({
     fs: container.fs,
-    filePath: container.env.configPath
+    filePath: container.env.credentialsPath
   });
   if (service in configuredServices) {
     return true;
@@ -6910,10 +6460,10 @@ function resolveSpawnWorkingDirectory2(baseDir, candidate) {
   if (!candidate || candidate.trim().length === 0) {
     return void 0;
   }
-  if (path11.isAbsolute(candidate)) {
+  if (path10.isAbsolute(candidate)) {
     return candidate;
   }
-  return path11.resolve(baseDir, candidate);
+  return path10.resolve(baseDir, candidate);
 }
 function parseMcpSpawnConfig(input) {
   if (!input) {
@@ -7006,9 +6556,9 @@ function isObjectRecord(value) {
 var init_spawn4 = __esm({
   async "src/cli/commands/spawn.ts"() {
     "use strict";
-    init_src5();
     init_src4();
-    init_config();
+    init_src3();
+    init_credentials2();
     init_shared();
     init_spawn_core();
     await init_spawn3();
@@ -7017,7 +6567,7 @@ var init_spawn4 = __esm({
 });
 
 // src/sdk/research.ts
-import path12 from "node:path";
+import path11 from "node:path";
 async function research(container, options) {
   const logger2 = options.logger;
   const source = await resolveSource({
@@ -7027,7 +6577,7 @@ async function research(container, options) {
   });
   const researchPrompt = buildResearchPrompt(options.prompt);
   const mode = options.mode ?? "read";
-  const { events, result } = spawn4(options.agent, {
+  const { events, result } = spawn3(options.agent, {
     prompt: researchPrompt,
     args: options.args ?? [],
     model: options.model,
@@ -7052,7 +6602,7 @@ async function research(container, options) {
         markdown: markdownOutput
       });
       outputPath = buildOutputPath(container.env.homeDir, options.prompt);
-      await ensureDirectory2(container.fs, path12.dirname(outputPath));
+      await ensureDirectory2(container.fs, path11.dirname(outputPath));
       await container.fs.writeFile(outputPath, document, {
         encoding: "utf8"
       });
@@ -7127,7 +6677,7 @@ function buildResearchDocument(input) {
 }
 function buildClonePath(homeDir, github) {
   const slug = extractRepoSlug(github);
-  return path12.join(homeDir, ".poe-code", "repos", slug);
+  return path11.join(homeDir, ".poe-code", "repos", slug);
 }
 function extractRepoSlug(value) {
   const trimmed = value.trim();
@@ -7165,7 +6715,7 @@ function extractRepoSlug(value) {
 function buildOutputPath(homeDir, prompt, now = /* @__PURE__ */ new Date()) {
   const timestamp = formatTimestamp(now);
   const slug = buildSlug(prompt);
-  return path12.join(
+  return path11.join(
     homeDir,
     ".poe-code",
     "research",
@@ -7186,7 +6736,7 @@ async function resolveSource(input) {
   if (options.github) {
     const cloneUrl = resolveGithubCloneUrl(options.github);
     const clonePath = buildClonePath(container.env.homeDir, options.github);
-    await ensureDirectory2(container.fs, path12.dirname(clonePath));
+    await ensureDirectory2(container.fs, path11.dirname(clonePath));
     const exists = await pathExists2(container.fs, clonePath);
     if (!exists) {
       const cloneResult = await container.commandRunner(
@@ -7284,10 +6834,10 @@ function formatYamlString(value) {
   return JSON.stringify(value);
 }
 function resolvePath2(baseDir, candidate) {
-  if (path12.isAbsolute(candidate)) {
+  if (path11.isAbsolute(candidate)) {
     return candidate;
   }
-  return path12.resolve(baseDir, candidate);
+  return path11.resolve(baseDir, candidate);
 }
 function teeAcpStream(events) {
   const chunks = [];
@@ -7347,7 +6897,7 @@ async function removePathFallback(fs3, target) {
   if (stats && typeof stats.isDirectory === "function" && stats.isDirectory()) {
     const entries = await fs3.readdir(target);
     for (const entry of entries) {
-      await removePathFallback(fs3, path12.join(target, entry));
+      await removePathFallback(fs3, path11.join(target, entry));
     }
   }
   try {
@@ -7451,7 +7001,7 @@ async function resolveResearchAgent(input) {
   if (input.flags.assumeYes) {
     const configured = await loadConfiguredServices({
       fs: input.container.fs,
-      filePath: input.container.env.configPath
+      filePath: input.container.env.credentialsPath
     });
     const configuredService = spawnable.find(
       (service) => service.name in configured
@@ -7513,8 +7063,8 @@ async function resolveResearchModel(input) {
 var init_research2 = __esm({
   async "src/cli/commands/research.ts"() {
     "use strict";
-    init_src5();
-    init_config();
+    init_src4();
+    init_credentials2();
     await init_research();
     init_errors();
     init_shared();
@@ -7522,13 +7072,13 @@ var init_research2 = __esm({
 });
 
 // src/cli/isolated-env-runner.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 async function isolatedEnvRunner(input) {
   const details = await resolveIsolatedEnvDetails(
     input.env,
     input.isolated,
     input.providerName,
-    input.readApiKey
+    input.fs
   );
   let args = input.argv.slice(2);
   if (input.isolated.requiresConfig !== false) {
@@ -7543,11 +7093,11 @@ async function isolatedEnvRunner(input) {
     const resolvedSettings = await resolveCliSettings(
       input.isolated.cliSettings,
       input.env,
-      input.readApiKey
+      input.fs
     );
     args = buildArgsWithMergedSettings(args, resolvedSettings);
   }
-  const child = spawn5(details.agentBinary, args, {
+  const child = spawn4(details.agentBinary, args, {
     stdio: "inherit",
     env: {
       ...process.env,
@@ -7580,7 +7130,7 @@ async function configExists(fs3, filePath) {
 var init_isolated_env_runner = __esm({
   "src/cli/isolated-env-runner.ts"() {
     "use strict";
-    init_src2();
+    init_src();
     init_isolated_env();
     init_cli_settings_merge();
   }
@@ -7630,7 +7180,6 @@ function registerWrapCommand(program, container) {
     await isolatedEnvRunner({
       env: container.env,
       fs: container.fs,
-      readApiKey: container.readApiKey,
       providerName: adapter.name,
       isolated,
       argv: ["node", "poe-code", ...forwarded]
@@ -7650,66 +7199,46 @@ var init_wrap = __esm({
 // src/cli/commands/login.ts
 function registerLoginCommand(program, container) {
   program.command("login").description("Store a Poe API key for reuse across commands.").option("--api-key <key>", "Poe API key").action(async (options) => {
-    await executeLogin(program, container, options);
-  });
-}
-async function executeLogin(program, container, options) {
-  const flags = resolveCommandFlags(program);
-  const resources = createExecutionResources(
-    container,
-    flags,
-    "login"
-  );
-  resources.logger.intro("login");
-  try {
-    const input = await resolveApiKeyInput(container, options);
-    const normalized = container.options.normalizeApiKey(input);
-    const configuredServices = await loadConfiguredServices({
-      fs: container.fs,
-      filePath: container.env.configPath
-    });
-    if (!flags.dryRun) {
-      await container.writeApiKey(normalized);
-    }
-    await reconfigureServices({
-      program,
+    const flags = resolveCommandFlags(program);
+    const resources = createExecutionResources(
       container,
-      apiKey: normalized,
-      configuredServices
-    });
-    resources.context.complete({
-      success: "Logged in.",
-      dry: "Dry run: would save API key."
-    });
-    resources.context.finalize();
-  } catch (error2) {
-    if (error2 instanceof Error) {
-      resources.logger.logException(error2, "login command", {
-        operation: "login",
-        configPath: container.env.configPath
+      flags,
+      "login"
+    );
+    resources.logger.intro("login");
+    try {
+      const configuredServices = await loadConfiguredServices({
+        fs: container.fs,
+        filePath: container.env.credentialsPath
+      });
+      const apiKey = await container.options.resolveApiKey({
+        value: options.apiKey,
+        envValue: container.env.getVariable("POE_API_KEY"),
+        dryRun: flags.dryRun,
+        assumeYes: flags.assumeYes,
+        allowStored: false
       });
+      await reconfigureServices({
+        program,
+        container,
+        apiKey,
+        configuredServices
+      });
+      resources.context.complete({
+        success: "Logged in.",
+        dry: "Dry run: would save API key."
+      });
+      resources.context.finalize();
+    } catch (error2) {
+      if (error2 instanceof Error) {
+        resources.logger.logException(error2, "login command", {
+          operation: "login",
+          credentialsPath: container.env.credentialsPath
+        });
+      }
+      throw error2;
     }
-    throw error2;
-  }
-}
-async function resolveApiKeyInput(container, options) {
-  if (options.apiKey) {
-    return options.apiKey;
-  }
-  const envKey = container.env.getVariable("POE_API_KEY");
-  if (envKey && envKey.trim().length > 0) {
-    return envKey;
-  }
-  const descriptor = container.promptLibrary.loginApiKey();
-  const response = await container.prompts(descriptor);
-  const value = response[descriptor.name];
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new ValidationError("POE API key is required.", {
-      operation: "login",
-      field: "apiKey"
-    });
-  }
-  return value;
+  });
 }
 async function reconfigureServices(input) {
   const { program, container, apiKey, configuredServices } = input;
@@ -7763,8 +7292,7 @@ var init_login = __esm({
   "src/cli/commands/login.ts"() {
     "use strict";
     init_shared();
-    init_config();
-    init_errors();
+    init_credentials2();
     init_mutation_events();
   }
 });
@@ -7844,7 +7372,7 @@ async function executeUnconfigure(program, container, service, options) {
   if (!flags.dryRun) {
     await unconfigureService({
       fs: container.fs,
-      filePath: providerContext.env.configPath,
+      filePath: providerContext.env.credentialsPath,
       service: canonicalService
     });
   }
@@ -7889,7 +7417,7 @@ function formatUnconfigureMessages(service, label, unconfigured, _payload) {
 var init_unconfigure = __esm({
   "src/cli/commands/unconfigure.ts"() {
     "use strict";
-    init_config();
+    init_credentials2();
     init_mutation_events();
     init_isolated_env();
     init_shared();
@@ -7898,157 +7426,53 @@ var init_unconfigure = __esm({
 
 // src/cli/commands/logout.ts
 function registerLogoutCommand(program, container) {
-  program.command("logout").description("Remove all Poe API configuration.").action(async () => {
-    await executeLogout(program, container);
-  });
-}
-async function executeLogout(program, container) {
-  const flags = resolveCommandFlags(program);
-  const resources = createExecutionResources(
-    container,
-    flags,
-    "logout"
-  );
-  resources.logger.intro("logout");
-  const configuredServices = await loadConfiguredServices({
-    fs: container.fs,
-    filePath: container.env.configPath
-  });
-  for (const serviceName of Object.keys(configuredServices)) {
-    const adapter = container.registry.get(serviceName);
-    if (!adapter) {
-      continue;
+  program.command("logout").description("Remove all Poe API configuration and stored credentials.").action(async () => {
+    const flags = resolveCommandFlags(program);
+    const resources = createExecutionResources(
+      container,
+      flags,
+      "logout"
+    );
+    resources.logger.intro("logout");
+    const configuredServices = await loadConfiguredServices({
+      fs: container.fs,
+      filePath: container.env.credentialsPath
+    });
+    for (const serviceName of Object.keys(configuredServices)) {
+      const adapter = container.registry.get(serviceName);
+      if (!adapter) {
+        continue;
+      }
+      await executeUnconfigure(program, container, serviceName, {});
     }
-    await executeUnconfigure(program, container, serviceName, {});
-  }
-  if (flags.dryRun) {
+    if (flags.dryRun) {
+      resources.context.complete({
+        success: "Logged out.",
+        dry: `Dry run: would delete credentials at ${container.env.credentialsPath}.`
+      });
+      resources.context.finalize();
+      return;
+    }
+    const deleted = await deleteCredentials({
+      fs: container.fs,
+      filePath: container.env.credentialsPath
+    });
     resources.context.complete({
-      success: "Logged out.",
-      dry: `Dry run: would delete config at ${container.env.configPath}.`
+      success: deleted ? "Logged out." : "Already logged out.",
+      dry: `Dry run: would delete credentials at ${container.env.credentialsPath}.`
     });
     resources.context.finalize();
-    return;
-  }
-  const deleted = await deleteConfig({
-    fs: container.fs,
-    filePath: container.env.configPath
-  });
-  resources.context.complete({
-    success: deleted ? "Logged out." : "Already logged out.",
-    dry: `Dry run: would delete config at ${container.env.configPath}.`
   });
-  resources.context.finalize();
 }
 var init_logout = __esm({
   "src/cli/commands/logout.ts"() {
     "use strict";
-    init_config();
+    init_credentials2();
     init_shared();
     init_unconfigure();
   }
 });
 
-// src/cli/commands/auth.ts
-function registerAuthCommand(program, container) {
-  const auth = program.command("auth").description("Authentication and account commands.").action(async () => {
-    await executeStatus(program, container);
-  });
-  auth.command("status").description("Show login, balance, and configuration status.").action(async () => {
-    await executeStatus(program, container);
-  });
-  auth.command("api_key").description("Display stored API key.").action(async () => {
-    await executeApiKey(program, container);
-  });
-  auth.command("login").description("Store a Poe API key.").option("--api-key <key>", "Poe API key").action(async (options) => {
-    await executeLogin(program, container, options);
-  });
-  auth.command("logout").description("Remove all configuration and credentials.").action(async () => {
-    await executeLogout(program, container);
-  });
-}
-async function executeStatus(program, container) {
-  const flags = resolveCommandFlags(program);
-  const resources = createExecutionResources(container, flags, "auth:status");
-  resources.logger.intro("auth status");
-  try {
-    const apiKey = await container.readApiKey();
-    const loggedIn = Boolean(apiKey);
-    resources.logger.info(loggedIn ? "Logged in" : "Not logged in");
-    if (loggedIn) {
-      if (flags.dryRun) {
-        resources.logger.dryRun(
-          "Dry run: would fetch usage balance from Poe API."
-        );
-      } else {
-        const response = await container.httpClient(
-          `${container.env.poeBaseUrl}/usage/current_balance`,
-          {
-            method: "GET",
-            headers: {
-              Authorization: `Bearer ${apiKey}`
-            }
-          }
-        );
-        if (!response.ok) {
-          throw new ApiError(
-            `Failed to fetch usage balance (HTTP ${response.status})`,
-            {
-              httpStatus: response.status,
-              endpoint: "/usage/current_balance"
-            }
-          );
-        }
-        const data = await response.json();
-        const formattedBalance = data.current_point_balance.toLocaleString(
-          "en-US"
-        );
-        resources.logger.info(`Current balance: ${formattedBalance} points`);
-      }
-    }
-    const configuredServices = await loadConfiguredServices({
-      fs: container.fs,
-      filePath: container.env.configPath
-    });
-    const configuredAgentNames = Object.keys(configuredServices).sort();
-    if (configuredAgentNames.length === 0) {
-      resources.logger.info("No agents configured.");
-    } else {
-      resources.logger.info(
-        `Configured agents: ${configuredAgentNames.join(", ")}`
-      );
-    }
-    resources.context.finalize();
-  } catch (error2) {
-    if (error2 instanceof Error) {
-      resources.logger.logException(error2, "auth status", {
-        operation: "auth-status"
-      });
-    }
-    throw error2;
-  }
-}
-async function executeApiKey(program, container) {
-  const flags = resolveCommandFlags(program);
-  const resources = createExecutionResources(container, flags, "auth:api_key");
-  resources.logger.intro("auth api_key");
-  const apiKey = await container.readApiKey();
-  if (!apiKey) {
-    resources.logger.info("No API key stored.");
-    return;
-  }
-  resources.logger.info(`API key: ${apiKey}`);
-}
-var init_auth = __esm({
-  "src/cli/commands/auth.ts"() {
-    "use strict";
-    init_errors();
-    init_config();
-    init_shared();
-    init_login();
-    init_logout();
-  }
-});
-
 // src/cli/commands/install.ts
 function registerInstallCommand(program, container) {
   const serviceNames = container.registry.list().filter((service) => typeof service.install === "function").map((service) => service.name);
@@ -8143,7 +7567,7 @@ async function executeTest(program, container, service, options = {}) {
     container.env,
     adapter.isolatedEnv,
     adapter.name,
-    container.readApiKey
+    container.fs
   ) : null;
   if (options.isolated && adapter.isolatedEnv) {
     const { ensureIsolatedConfigForService: ensureIsolatedConfigForService2 } = await Promise.resolve().then(() => (init_ensure_isolated_config(), ensure_isolated_config_exports));
@@ -8192,7 +7616,7 @@ var init_test = __esm({
     init_shared();
     init_configure();
     init_isolated_env();
-    init_src4();
+    init_src3();
   }
 });
 
@@ -8245,7 +7669,7 @@ var init_media_download = __esm({
 });
 
 // src/cli/commands/generate.ts
-import path13 from "node:path";
+import path12 from "node:path";
 function registerGenerateCommand(program, container) {
   const generate2 = program.command("generate").description("Generate content via Poe API").option("--model <model>", `Model identifier (default: ${DEFAULT_TEXT_MODEL})`).option(
     "--param <key=value>",
@@ -8424,13 +7848,10 @@ async function resolveClient2(container) {
   try {
     return getGlobalClient();
   } catch {
-    const apiKey = await container.readApiKey();
-    if (!apiKey) {
-      throw new Error("Poe API key not found. Run 'poe-code login' first.");
-    }
     const apiBaseUrl = resolveApiBaseUrl(container);
     await initializeClient({
-      apiKey,
+      fs: container.fs,
+      credentialsPath: container.env.credentialsPath,
       baseUrl: apiBaseUrl,
       httpClient: container.httpClient
     });
@@ -8511,11 +7932,11 @@ function getDefaultMimeType(type) {
   return defaults[type];
 }
 function resolveOutputPath(filename, cwd) {
-  if (path13.isAbsolute(filename)) {
+  if (path12.isAbsolute(filename)) {
     return { path: filename, label: filename };
   }
   return {
-    path: path13.join(cwd, filename),
+    path: path12.join(cwd, filename),
     label: `./${filename}`
   };
 }
@@ -8523,7 +7944,7 @@ var MODEL_ENV_KEYS2, DEFAULT_MODELS2;
 var init_generate = __esm({
   "src/cli/commands/generate.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
     init_constants();
     init_shared();
     init_client_instance();
@@ -9619,8 +9040,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path21, errorMaps, issueData } = params;
-      const fullPath = [...path21, ...issueData.path || []];
+      const { data, path: path20, errorMaps, issueData } = params;
+      const fullPath = [...path20, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -9900,11 +9321,11 @@ var init_types3 = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path21, key) {
+      constructor(parent, value, path20, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path21;
+        this._path = path20;
         this._key = key;
       }
       get path() {
@@ -13408,10 +12829,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path21) {
-  if (!path21)
+function getElementAtPath(obj, path20) {
+  if (!path20)
     return obj;
-  return path21.reduce((acc, key) => acc?.[key], obj);
+  return path20.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -13723,11 +13144,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path21, issues) {
+function prefixIssues(path20, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path21);
+    iss.path.unshift(path20);
     return iss;
   });
 }
@@ -14103,7 +13524,7 @@ __export(regexes_exports, {
   extendedDuration: () => extendedDuration,
   guid: () => guid,
   hex: () => hex,
-  hostname: () => hostname2,
+  hostname: () => hostname,
   html5Email: () => html5Email,
   idnEmail: () => idnEmail,
   integer: () => integer,
@@ -14170,7 +13591,7 @@ function fixedBase64(bodyLength, padding) {
 function fixedBase64url(length) {
   return new RegExp(`^[A-Za-z0-9_-]{${length}}$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname2, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
 var init_regexes = __esm({
   "node_modules/zod/v4/core/regexes.js"() {
     init_util2();
@@ -14208,7 +13629,7 @@ var init_regexes = __esm({
     cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
     base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
     base64url = /^[A-Za-z0-9_-]*$/;
-    hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+    hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
     domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
     e164 = /^\+[1-9]\d{6,14}$/;
     dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
@@ -19414,7 +18835,7 @@ __export(schemas_exports3, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname3,
+  hostname: () => hostname2,
   httpUrl: () => httpUrl,
   instanceof: () => _instanceof,
   int: () => int,
@@ -19561,7 +18982,7 @@ function jwt(params) {
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname3(_params) {
+function hostname2(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
 }
 function hex2(_params) {
@@ -25685,8 +25106,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path21) {
-      let input = path21;
+    function removeDotSegments(path20) {
+      let input = path20;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -25885,8 +25306,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path21, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path21 && path21 !== "/" ? path21 : void 0;
+        const [path20, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path20 && path20 !== "/" ? path20 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -35000,7 +34421,7 @@ var init_content = __esm({
 });
 
 // packages/tiny-stdio-mcp-server/src/index.ts
-var init_src6 = __esm({
+var init_src5 = __esm({
   "packages/tiny-stdio-mcp-server/src/index.ts"() {
     "use strict";
     init_server();
@@ -35304,7 +34725,7 @@ var generateTextSchema, generateImageSchema, generateVideoSchema, generateAudioS
 var init_mcp_server = __esm({
   "src/cli/mcp-server.ts"() {
     "use strict";
-    init_src6();
+    init_src5();
     init_client_instance();
     init_constants();
     generateTextSchema = defineSchema({
@@ -35562,7 +34983,7 @@ ${panel.footer}`);
 var init_command_not_found = __esm({
   "src/cli/command-not-found.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
     init_execution_context();
     init_errors();
   }
@@ -35587,7 +35008,7 @@ function getAgentConfig(agentId) {
   const support = resolveAgentSupport(agentId);
   return support.status === "supported" ? support.config : void 0;
 }
-function resolveConfigPath2(config2, platform) {
+function resolveConfigPath(config2, platform) {
   if (typeof config2.configFile === "function") {
     return config2.configFile(platform);
   }
@@ -35597,7 +35018,7 @@ var agentMcpConfigs, supportedAgents;
 var init_configs2 = __esm({
   "packages/agent-mcp-config/src/configs.ts"() {
     "use strict";
-    init_src3();
+    init_src2();
     agentMcpConfigs = {
       "claude-code": {
         configFile: "~/.claude.json",
@@ -35710,9 +35131,9 @@ var init_shapes = __esm({
 });
 
 // packages/agent-mcp-config/src/apply.ts
-import path14 from "node:path";
+import path13 from "node:path";
 function getConfigDirectory(configPath) {
-  return path14.dirname(configPath);
+  return path13.dirname(configPath);
 }
 function isConfigObject5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -35729,7 +35150,7 @@ async function configure(agentId, server, options) {
     throw new UnsupportedAgentError(agentId);
   }
   const config2 = getAgentConfig(agentId);
-  const configPath = resolveConfigPath2(config2, options.platform);
+  const configPath = resolveConfigPath(config2, options.platform);
   const shapeTransformer = getShapeTransformer(config2.shape);
   const shaped = shapeTransformer(server);
   if (shaped === void 0) {
@@ -35775,7 +35196,7 @@ async function unconfigure(agentId, serverName, options) {
     throw new UnsupportedAgentError(agentId);
   }
   const config2 = getAgentConfig(agentId);
-  const configPath = resolveConfigPath2(config2, options.platform);
+  const configPath = resolveConfigPath(config2, options.platform);
   await runMutations(
     [
       configMutation.prune({
@@ -35801,7 +35222,7 @@ var UnsupportedAgentError;
 var init_apply = __esm({
   "packages/agent-mcp-config/src/apply.ts"() {
     "use strict";
-    init_src2();
+    init_src();
     init_configs2();
     init_shapes();
     UnsupportedAgentError = class extends Error {
@@ -35814,7 +35235,7 @@ var init_apply = __esm({
 });
 
 // packages/agent-mcp-config/src/index.ts
-var init_src7 = __esm({
+var init_src6 = __esm({
   "packages/agent-mcp-config/src/index.ts"() {
     "use strict";
     init_configs2();
@@ -35872,7 +35293,10 @@ function registerMcpCommand(program, container) {
   mcp.command("configure [agent]").description("Configure MCP client to use poe-code").option("-y, --yes", "Skip prompt, use claude-code").action(async (agentArg, options) => {
     const flags = resolveCommandFlags(program);
     const resources = createExecutionResources(container, flags, "mcp");
-    const existingKey = await container.readApiKey();
+    const existingKey = await loadCredentials({
+      fs: container.fs,
+      filePath: container.env.credentialsPath
+    });
     if (!existingKey) {
       resources.logger.intro("login");
       await container.options.resolveApiKey({ dryRun: flags.dryRun });
@@ -35972,13 +35396,17 @@ async function runMcpServer(container, options) {
   const outputFormatPreferences = parseMcpOutputFormatPreferences(
     options.outputFormat
   );
-  const apiKey = await container.readApiKey();
+  const apiKey = await loadCredentials({
+    fs: container.fs,
+    filePath: container.env.credentialsPath
+  });
   if (!apiKey) {
-    process.stderr.write("No API key found. Run 'poe-code login' first.\n");
+    process.stderr.write("No credentials found. Run 'poe-code login' first.\n");
     process.exit(1);
   }
   await initializeClient({
-    apiKey,
+    fs: container.fs,
+    credentialsPath: container.env.credentialsPath,
     baseUrl: container.env.poeApiBaseUrl,
     httpClient: container.httpClient
   });
@@ -35988,21 +35416,22 @@ var DEFAULT_MCP_AGENT;
 var init_mcp2 = __esm({
   "src/cli/commands/mcp.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
+    init_credentials2();
     init_client_instance();
     init_mcp_server();
     init_shared();
     init_mcp_output_format();
     init_command_not_found();
-    init_src7();
+    init_src6();
     init_execution_context();
     DEFAULT_MCP_AGENT = "claude-code";
   }
 });
 
 // packages/agent-skill-config/src/configs.ts
-import os2 from "node:os";
-import path15 from "node:path";
+import os3 from "node:os";
+import path14 from "node:path";
 function resolveAgentSupport2(input, registry2 = agentSkillConfigs) {
   const resolvedId = resolveAgentId(input);
   if (!resolvedId) {
@@ -36018,7 +35447,7 @@ var agentSkillConfigs, supportedAgents2;
 var init_configs3 = __esm({
   "packages/agent-skill-config/src/configs.ts"() {
     "use strict";
-    init_src3();
+    init_src2();
     agentSkillConfigs = {
       "claude-code": {
         globalSkillDir: "~/.claude/skills",
@@ -36038,7 +35467,7 @@ var init_configs3 = __esm({
 });
 
 // packages/agent-skill-config/src/templates.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 async function getTemplates() {
   if (templatesCache) {
     return templatesCache;
@@ -36047,7 +35476,7 @@ async function getTemplates() {
     "./templates/poe-generate.md",
     import.meta.url
   );
-  const poeGenerateTemplate = await readFile2(poeGenerateTemplateUrl, "utf8");
+  const poeGenerateTemplate = await readFile3(poeGenerateTemplateUrl, "utf8");
   templatesCache = {
     "poe-generate.md": poeGenerateTemplate
   };
@@ -36179,7 +35608,7 @@ var UnsupportedAgentError2, bundledSkillTemplateIds, SKILL_TEMPLATE_ID;
 var init_apply2 = __esm({
   "packages/agent-skill-config/src/apply.ts"() {
     "use strict";
-    init_src2();
+    init_src();
     init_configs3();
     init_templates();
     UnsupportedAgentError2 = class extends Error {
@@ -36194,7 +35623,7 @@ var init_apply2 = __esm({
 });
 
 // packages/agent-skill-config/src/index.ts
-var init_src8 = __esm({
+var init_src7 = __esm({
   "packages/agent-skill-config/src/index.ts"() {
     "use strict";
     init_configs3();
@@ -36418,8 +35847,8 @@ var DEFAULT_SKILL_AGENT;
 var init_skill = __esm({
   "src/cli/commands/skill.ts"() {
     "use strict";
-    init_src4();
-    init_src8();
+    init_src3();
+    init_src7();
     init_shared();
     init_command_not_found();
     DEFAULT_SKILL_AGENT = "claude-code";
@@ -36509,7 +35938,7 @@ async function displayVersion(container, currentVersion) {
 var init_version2 = __esm({
   "src/cli/commands/version.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
     init_version();
     init_exit_signals();
   }
@@ -36634,10 +36063,10 @@ var init_registry2 = __esm({
 });
 
 // packages/worktree/src/create.ts
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 async function createWorktree(opts) {
   const branch = `poe-code/${opts.name}`;
-  const worktreePath = join(opts.worktreeDir, opts.name);
+  const worktreePath = join2(opts.worktreeDir, opts.name);
   try {
     await opts.deps.exec(`git worktree remove ${worktreePath} --force`, { cwd: opts.cwd });
   } catch {
@@ -36712,7 +36141,7 @@ var init_list = __esm({
 });
 
 // packages/worktree/src/index.ts
-var init_src9 = __esm({
+var init_src8 = __esm({
   "packages/worktree/src/index.ts"() {
     "use strict";
     init_create();
@@ -36801,13 +36230,13 @@ function getDirtyFiles(cwd) {
   for (const line of lines) {
     if (!line) continue;
     if (line.length < 4) continue;
-    let path21 = line.slice(3).trim();
+    let path20 = line.slice(3).trim();
     const renameArrow = " -> ";
-    const arrowIndex = path21.lastIndexOf(renameArrow);
+    const arrowIndex = path20.lastIndexOf(renameArrow);
     if (arrowIndex >= 0) {
-      path21 = path21.slice(arrowIndex + renameArrow.length).trim();
+      path20 = path20.slice(arrowIndex + renameArrow.length).trim();
     }
-    if (path21) files.push(path21);
+    if (path20) files.push(path20);
   }
   return files;
 }
@@ -36819,7 +36248,7 @@ var init_utils2 = __esm({
 
 // packages/ralph/src/plan/parser.ts
 import { parse as parse7 } from "yaml";
-function isRecord5(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asOptionalString(value, field) {
@@ -36870,7 +36299,7 @@ function normalizeStatus(value) {
   );
 }
 function parseStory(value, index) {
-  if (!isRecord5(value)) throw new Error(`Invalid stories[${index}]: expected object`);
+  if (!isRecord3(value)) throw new Error(`Invalid stories[${index}]: expected object`);
   return {
     id: asRequiredString(value.id, `stories[${index}].id`),
     title: asRequiredString(value.title, `stories[${index}].title`),
@@ -36894,7 +36323,7 @@ function parsePlan(yamlContent) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     throw new Error(`Invalid plan YAML: ${message}`, { cause: error2 });
   }
-  if (!isRecord5(doc)) {
+  if (!isRecord3(doc)) {
     throw new Error("Invalid plan YAML: expected top-level object");
   }
   const storiesValue = doc.stories;
@@ -36960,17 +36389,17 @@ function serializePlan(prd) {
   return yaml.endsWith("\n") ? yaml : `${yaml}
 `;
 }
-function lockPlanFile(path21) {
-  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile(path20) {
+  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
-async function writePlan(path21, prd, options = {}) {
+async function writePlan(path20, prd, options = {}) {
   const fs3 = options.fs ?? fsPromises2;
   const lock = options.lock ?? lockPlanFile;
-  await fs3.mkdir(dirname3(path21), { recursive: true });
-  const release = await lock(path21);
+  await fs3.mkdir(dirname3(path20), { recursive: true });
+  const release = await lock(path20);
   try {
     const yaml = serializePlan(prd);
-    await fs3.writeFile(path21, yaml, { encoding: "utf8" });
+    await fs3.writeFile(path20, yaml, { encoding: "utf8" });
   } finally {
     await release();
   }
@@ -36989,7 +36418,7 @@ function renderPrompt(template, variables) {
 var init_renderer2 = __esm({
   "packages/ralph/src/prompt/renderer.ts"() {
     "use strict";
-    init_src2();
+    init_src();
   }
 });
 
@@ -37058,8 +36487,8 @@ var init_selector = __esm({
 // packages/ralph/src/story/updater.ts
 import { dirname as dirname4 } from "node:path";
 import * as fsPromises3 from "node:fs/promises";
-function lockPlanFile2(path21) {
-  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile2(path20) {
+  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
 function assertStoryStatus(value) {
   if (value === "open") return;
@@ -37140,9 +36569,9 @@ function appendSection(lines, title, items, options) {
   }
   lines.push("");
 }
-async function writeRunMeta(path21, metadata, options = {}) {
+async function writeRunMeta(path20, metadata, options = {}) {
   const fs3 = options.fs ?? fsPromises4;
-  await fs3.mkdir(dirname5(path21), { recursive: true });
+  await fs3.mkdir(dirname5(path20), { recursive: true });
   const lines = [];
   lines.push("# Ralph Run Summary", "");
   lines.push(`- Run ID: ${metadata.runId}`);
@@ -37171,7 +36600,7 @@ async function writeRunMeta(path21, metadata, options = {}) {
   const git = metadata.git ?? null;
   if (!git) {
     lines.push("");
-    await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
+    await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
     return;
   }
   lines.push("", "## Git");
@@ -37186,7 +36615,7 @@ async function writeRunMeta(path21, metadata, options = {}) {
     lines.push("");
   } else {
     lines.push("");
-    await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
+    await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
     return;
   }
   if (git.commits !== void 0 && git.commits !== null) {
@@ -37206,7 +36635,7 @@ async function writeRunMeta(path21, metadata, options = {}) {
   appendSection(lines, "### Uncommitted Changes", git.dirtyFiles, {
     emptyLabel: "(none)"
   });
-  await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
+  await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
 }
 var init_metadata = __esm({
   "packages/ralph/src/run/metadata.ts"() {
@@ -37294,9 +36723,9 @@ async function defaultStreamingSpawn(agentId, options) {
     exitCode: result.exitCode
   };
 }
-function absPath(cwd, path21) {
-  if (!path21) return resolvePath3(cwd);
-  return path21.startsWith("/") ? path21 : resolvePath3(cwd, path21);
+function absPath(cwd, path20) {
+  if (!path20) return resolvePath3(cwd);
+  return path20.startsWith("/") ? path20 : resolvePath3(cwd, path20);
 }
 function pad2(value) {
   return value < 10 ? `0${value}` : String(value);
@@ -37346,8 +36775,8 @@ async function appendToErrorsLog(fs3, errorsLogPath, message) {
   await fs3.mkdir(dirname6(errorsLogPath), { recursive: true });
   await fs3.writeFile(errorsLogPath, `${previous}${next}`, { encoding: "utf8" });
 }
-function lockPlanFile3(path21) {
-  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile3(path20) {
+  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
 function getCurrentBranch(cwd) {
   try {
@@ -37449,7 +36878,7 @@ async function defaultPromptOverbake(args) {
 async function buildLoop(options) {
   const fs3 = options.deps?.fs ?? fsPromises5;
   const lock = options.deps?.lock ?? lockPlanFile3;
-  const spawn6 = options.deps?.spawn ?? defaultStreamingSpawn;
+  const spawn5 = options.deps?.spawn ?? defaultStreamingSpawn;
   const git = options.deps?.git ?? {
     getHead,
     getCommitList,
@@ -37503,7 +36932,7 @@ async function buildLoop(options) {
       });
       worktreeBranch = entry.branch;
       const worktreePath = entry.path;
-      const symlinkFn = fs3.symlink ?? ((target, path21) => fsPromises5.symlink(target, path21));
+      const symlinkFn = fs3.symlink ?? ((target, path20) => fsPromises5.symlink(target, path20));
       const exec = worktreeDeps.exec;
       const dirsToLink = [".poe-code-ralph", ".agents/poe-code-ralph"];
       for (const dir of dirsToLink) {
@@ -37618,7 +37047,7 @@ async function buildLoop(options) {
     let stderrForErrorsLog;
     let overbakeAction = null;
     try {
-      const result = await spawn6(options.agent, {
+      const result = await spawn5(options.agent, {
         prompt,
         cwd,
         model: options.model,
@@ -37791,10 +37220,10 @@ var init_loop = __esm({
   "packages/ralph/src/build/loop.ts"() {
     "use strict";
     init_lock();
-    init_src5();
     init_src4();
-    init_src2();
-    init_src9();
+    init_src3();
+    init_src();
+    init_src8();
     init_detector();
     init_utils2();
     init_parser();
@@ -37808,18 +37237,18 @@ var init_loop = __esm({
 });
 
 // packages/ralph/src/plan/resolver.ts
-import path16 from "node:path";
+import path15 from "node:path";
 import * as fsPromises6 from "node:fs/promises";
 function isPlanCandidateFile(fileName) {
   const lower = fileName.toLowerCase();
   if (!lower.startsWith("plan")) {
     return false;
   }
-  const ext = path16.extname(lower);
+  const ext = path15.extname(lower);
   return ext === ".yml" || ext === ".yaml";
 }
 async function listPlanCandidates(fs3, cwd) {
-  const plansDir = path16.join(cwd, ".agents", "poe-code-ralph", "plans");
+  const plansDir = path15.join(cwd, ".agents", "poe-code-ralph", "plans");
   let entries;
   try {
     entries = await fs3.readdir(plansDir);
@@ -37834,12 +37263,12 @@ async function listPlanCandidates(fs3, cwd) {
     if (!isPlanCandidateFile(entry)) {
       continue;
     }
-    const absPath2 = path16.join(plansDir, entry);
+    const absPath2 = path15.join(plansDir, entry);
     const stats = await fs3.stat(absPath2);
     if (!stats.isFile()) {
       continue;
     }
-    const relativePath = path16.relative(cwd, absPath2);
+    const relativePath = path15.relative(cwd, absPath2);
     const content = await fs3.readFile(absPath2, "utf8");
     const plan = parsePlan(content);
     const done = plan.stories.filter((s) => s.status === "done").length;
@@ -37858,7 +37287,7 @@ async function resolvePlanPath(options) {
   const cwd = options.cwd;
   const provided = options.plan?.trim();
   if (provided) {
-    const absPath2 = path16.isAbsolute(provided) ? provided : path16.resolve(cwd, provided);
+    const absPath2 = path15.isAbsolute(provided) ? provided : path15.resolve(cwd, provided);
     try {
       const stats = await fs3.stat(absPath2);
       if (!stats.isFile()) {
@@ -37907,21 +37336,21 @@ async function resolvePlanPath(options) {
 var init_resolver = __esm({
   "packages/ralph/src/plan/resolver.ts"() {
     "use strict";
-    init_src4();
-    init_src2();
+    init_src3();
+    init_src();
     init_parser();
   }
 });
 
 // packages/ralph/src/plan/generator.ts
-import path17 from "node:path";
+import path16 from "node:path";
 import * as fsPromises7 from "node:fs/promises";
 var PLAN_PROMPT_TEMPLATE;
 var init_generator = __esm({
   "packages/ralph/src/plan/generator.ts"() {
     "use strict";
-    init_src5();
-    init_src2();
+    init_src4();
+    init_src();
     init_renderer2();
     PLAN_PROMPT_TEMPLATE = [
       "# Plan",
@@ -37983,27 +37412,27 @@ function formatTimestamp3(date4) {
   const seconds = pad22(date4.getSeconds());
   return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
 }
-function validateLogPath(path21) {
-  if (typeof path21 !== "string" || path21.trim().length === 0) {
+function validateLogPath(path20) {
+  if (typeof path20 !== "string" || path20.trim().length === 0) {
     throw new Error(
-      `Invalid activity log path: expected a non-empty string, got ${String(path21)}`
+      `Invalid activity log path: expected a non-empty string, got ${String(path20)}`
     );
   }
-  if (path21.includes("\0")) {
+  if (path20.includes("\0")) {
     throw new Error("Invalid activity log path: contains null byte");
   }
 }
-async function logActivity(path21, message, options = {}) {
-  validateLogPath(path21);
+async function logActivity(path20, message, options = {}) {
+  validateLogPath(path20);
   const fs3 = options.fs ?? fsPromises8;
-  const parent = dirname7(path21);
+  const parent = dirname7(path20);
   if (parent && parent !== ".") {
     await fs3.mkdir(parent, { recursive: true });
   }
   const entry = `[${formatTimestamp3(/* @__PURE__ */ new Date())}] ${message}
 `;
   try {
-    await fs3.appendFile(path21, entry, { encoding: "utf8" });
+    await fs3.appendFile(path20, entry, { encoding: "utf8" });
   } catch (error2) {
     const detail = error2 instanceof Error ? error2.message : `Unknown error: ${String(error2)}`;
     throw new Error(`Failed to append activity log entry: ${detail}`, { cause: error2 });
@@ -38016,7 +37445,7 @@ var init_activity = __esm({
 });
 
 // packages/ralph/src/config/loader.ts
-import path18 from "node:path";
+import path17 from "node:path";
 import * as fsPromises9 from "node:fs/promises";
 import YAML from "yaml";
 function isPlainObject2(value) {
@@ -38051,8 +37480,8 @@ function pickOptionalPositiveInt(config2, key, options) {
   return value;
 }
 async function loadSingleConfig(configDir, fs3) {
-  const yamlPath = path18.join(configDir, "config.yaml");
-  const jsonPath = path18.join(configDir, "config.json");
+  const yamlPath = path17.join(configDir, "config.yaml");
+  const jsonPath = path17.join(configDir, "config.json");
   let raw = null;
   let format = null;
   let sourcePath = null;
@@ -38125,14 +37554,14 @@ async function loadConfig(cwd, deps) {
   const sources = [];
   let merged = {};
   if (deps?.homeDir) {
-    const globalDir = path18.join(deps.homeDir, ".poe-code", "ralph");
+    const globalDir = path17.join(deps.homeDir, ".poe-code", "ralph");
     const globalResult = await loadSingleConfig(globalDir, fs3);
     if (globalResult) {
       merged = globalResult.config;
       sources.push({ path: globalResult.sourcePath, scope: "global" });
     }
   }
-  const localDir = path18.join(cwd, ".agents", "poe-code-ralph");
+  const localDir = path17.join(cwd, ".agents", "poe-code-ralph");
   const localResult = await loadSingleConfig(localDir, fs3);
   if (localResult) {
     merged = mergeConfigs(merged, localResult.config);
@@ -38143,7 +37572,7 @@ async function loadConfig(cwd, deps) {
 var init_loader = __esm({
   "packages/ralph/src/config/loader.ts"() {
     "use strict";
-    init_src2();
+    init_src();
   }
 });
 
@@ -38154,7 +37583,7 @@ async function ralphBuild(options) {
     cwd: options.cwd ?? process.cwd()
   });
 }
-var init_src10 = __esm({
+var init_src9 = __esm({
   "packages/ralph/src/index.ts"() {
     "use strict";
     init_loop();
@@ -38174,12 +37603,12 @@ var require_PROMPT_worktree_merge = __commonJS({
 });
 
 // src/cli/commands/ralph-worktree.ts
-import path19 from "node:path";
+import path18 from "node:path";
 import { execSync as execSync3 } from "node:child_process";
 function registerRalphWorktreeCommand(ralph, container) {
   ralph.command("worktree").description("Merge a completed worktree back into the main branch.").argument("<name>", "Name of the worktree to merge").option("--agent <name>", "Agent to use for the merge").action(async function(name) {
     const cwd = container.env.cwd;
-    const registryFile = path19.join(cwd, ".poe-code-ralph", "worktrees.yaml");
+    const registryFile = path18.join(cwd, ".poe-code-ralph", "worktrees.yaml");
     const worktrees = await listWorktrees(cwd, registryFile, {
       fs: {
         readFile: (p, enc) => container.fs.readFile(p, enc),
@@ -38242,10 +37671,10 @@ function registerRalphWorktreeCommand(ralph, container) {
 var init_ralph_worktree = __esm({
   "src/cli/commands/ralph-worktree.ts"() {
     "use strict";
+    init_src3();
+    init_src8();
     init_src4();
-    init_src9();
-    init_src5();
-    init_src2();
+    init_src();
     init_errors();
   }
 });
@@ -38321,7 +37750,7 @@ var require_activity = __commonJS({
 });
 
 // src/cli/commands/ralph.ts
-import path20 from "node:path";
+import path19 from "node:path";
 async function loadRalphTemplates() {
   const [
     promptPartialPlan,
@@ -38406,7 +37835,7 @@ async function writeFileOrSkip(args) {
     args.logger.info(`Skip: ${args.displayPath} (already exists)`);
     return "skipped";
   }
-  await args.fs.mkdir(path20.dirname(args.filePath), { recursive: true });
+  await args.fs.mkdir(path19.dirname(args.filePath), { recursive: true });
   await args.fs.writeFile(args.filePath, args.contents, { encoding: "utf8" });
   args.logger.info(`${exists ? "Overwrite" : "Create"}: ${args.displayPath}`);
   return "written";
@@ -38442,22 +37871,22 @@ async function installRalphTemplates(args) {
     const promptPlanContents = templates.promptPlan.replace("{{{PROMPT_PARTIAL_PLAN}}}", templates.promptPartialPlan);
     const templateWrites = [
       {
-        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "PROMPT_plan.md"),
+        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "PROMPT_plan.md"),
         displayPath: ".agents/poe-code-ralph/PROMPT_plan.md",
         contents: promptPlanContents
       },
       {
-        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "PROMPT_build.md"),
+        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "PROMPT_build.md"),
         displayPath: ".agents/poe-code-ralph/PROMPT_build.md",
         contents: templates.promptBuild
       },
       {
-        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "references", "GUARDRAILS.md"),
+        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "references", "GUARDRAILS.md"),
         displayPath: ".agents/poe-code-ralph/references/GUARDRAILS.md",
         contents: templates.refGuardrails
       },
       {
-        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "references", "CONTEXT_ENGINEERING.md"),
+        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "references", "CONTEXT_ENGINEERING.md"),
         displayPath: ".agents/poe-code-ralph/references/CONTEXT_ENGINEERING.md",
         contents: templates.refContextEngineering
       }
@@ -38475,22 +37904,22 @@ async function installRalphTemplates(args) {
     const stateFiles = [
       {
         contents: templates.stateProgress,
-        targetPath: path20.join(cwd, ".poe-code-ralph", "progress.md"),
+        targetPath: path19.join(cwd, ".poe-code-ralph", "progress.md"),
         displayPath: ".poe-code-ralph/progress.md"
       },
       {
         contents: templates.stateGuardrails,
-        targetPath: path20.join(cwd, ".poe-code-ralph", "guardrails.md"),
+        targetPath: path19.join(cwd, ".poe-code-ralph", "guardrails.md"),
         displayPath: ".poe-code-ralph/guardrails.md"
       },
       {
         contents: templates.stateErrors,
-        targetPath: path20.join(cwd, ".poe-code-ralph", "errors.log"),
+        targetPath: path19.join(cwd, ".poe-code-ralph", "errors.log"),
         displayPath: ".poe-code-ralph/errors.log"
       },
       {
         contents: templates.stateActivity,
-        targetPath: path20.join(cwd, ".poe-code-ralph", "activity.log"),
+        targetPath: path19.join(cwd, ".poe-code-ralph", "activity.log"),
         displayPath: ".poe-code-ralph/activity.log"
       }
     ];
@@ -38537,7 +37966,7 @@ function registerRalphCommand(program, container) {
       throw new ValidationError(message2);
     }
     const rawPath = options.activityLog?.trim() || configActivityLogPath || ".poe-code-ralph/activity.log";
-    const resolvedPath = path20.isAbsolute(rawPath) ? rawPath : path20.resolve(container.env.cwd, rawPath);
+    const resolvedPath = path19.isAbsolute(rawPath) ? rawPath : path19.resolve(container.env.cwd, rawPath);
     await logActivity(resolvedPath, trimmedMessage, {
       fs: container.fs
     });
@@ -38549,7 +37978,7 @@ function registerRalphCommand(program, container) {
     if (!planPath) {
       throw new ValidationError("--plan <path> is required.");
     }
-    const resolvedPath = path20.isAbsolute(planPath) ? planPath : path20.resolve(cwd, planPath);
+    const resolvedPath = path19.isAbsolute(planPath) ? planPath : path19.resolve(cwd, planPath);
     let content;
     try {
       content = await container.fs.readFile(resolvedPath, "utf8");
@@ -38723,7 +38152,7 @@ function registerRalphCommand(program, container) {
       } else {
         try {
           const planContent = await container.fs.readFile(
-            path20.resolve(cwd, planPath),
+            path19.resolve(cwd, planPath),
             "utf8"
           );
           const plan = parsePlan(planContent);
@@ -38757,7 +38186,7 @@ function registerRalphCommand(program, container) {
       } else {
         try {
           const planContent = await container.fs.readFile(
-            path20.resolve(cwd, planPath),
+            path19.resolve(cwd, planPath),
             "utf8"
           );
           const plan = parsePlan(planContent);
@@ -38813,10 +38242,10 @@ var templateImports, DEFAULT_RALPH_AGENT;
 var init_ralph = __esm({
   "src/cli/commands/ralph.ts"() {
     "use strict";
-    init_src4();
-    init_src10();
-    init_src8();
-    init_src2();
+    init_src3();
+    init_src9();
+    init_src7();
+    init_src();
     init_errors();
     init_shared();
     init_ralph_worktree();
@@ -39037,7 +38466,7 @@ var init_usage = __esm({
     "use strict";
     init_shared();
     init_errors();
-    init_src4();
+    init_src3();
   }
 });
 
@@ -39130,7 +38559,10 @@ function registerModelsCommand(program, container) {
     const commandOptions = this.opts();
     resources.logger.intro("models");
     try {
-      const apiKey = await container.readApiKey();
+      const apiKey = await loadCredentials({
+        fs: container.fs,
+        filePath: container.env.credentialsPath
+      });
       if (flags.dryRun) {
         resources.logger.dryRun(
           "Dry run: would fetch models from Poe API."
@@ -39318,8 +38750,9 @@ var init_models = __esm({
   "src/cli/commands/models.ts"() {
     "use strict";
     init_shared();
+    init_credentials2();
     init_errors();
-    init_src4();
+    init_src3();
     MAX_VALUES_LENGTH = 105;
     MAX_DEFAULT_LENGTH = 36;
   }
@@ -39331,7 +38764,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "poe-code",
-      version: "3.0.71-beta.1",
+      version: "3.0.71",
       description: "CLI tool to configure Poe API for developer workflows.",
       type: "module",
       main: "./dist/index.js",
@@ -39413,7 +38846,6 @@ var init_package = __esm({
       devDependencies: {
         "@eslint/js": "^9.0.0",
         "@modelcontextprotocol/sdk": "^1.26.0",
-        "@poe-code/auth": "*",
         "@poe-code/agent-spawn": "*",
         "@poe-code/config-mutations": "*",
         "@poe-code/design-system": "*",
@@ -39477,26 +38909,21 @@ function formatHelpText(input) {
       args: "<agent>",
       description: "Remove a previously applied configuration"
     },
-    {
-      name: "login",
-      args: "",
-      description: "Store a Poe API key"
-    },
     {
       name: "logout",
       args: "",
-      description: "Remove all configuration"
-    },
-    {
-      name: "auth status",
-      args: "",
-      description: "Show login, balance, and configuration status"
+      description: "Remove all configuration and stored credentials"
     },
     {
       name: "spawn",
       args: "<agent> [prompt]",
       description: "Launch a coding agent"
     },
+    {
+      name: "research",
+      args: "<prompt>",
+      description: "Research a codebase using a coding agent"
+    },
     {
       name: "generate",
       args: "[type]",
@@ -39680,7 +39107,6 @@ function bootstrapProgram(container) {
   registerUnconfigureCommand(program, container);
   registerLoginCommand(program, container);
   registerLogoutCommand(program, container);
-  registerAuthCommand(program, container);
   registerMcpCommand(program, container);
   registerSkillCommand(program, container);
   registerRalphCommand(program, container);
@@ -39722,14 +39148,13 @@ var init_program = __esm({
   async "src/cli/program.ts"() {
     "use strict";
     await init_container2();
-    init_src4();
+    init_src3();
     init_configure();
     await init_spawn4();
     await init_research2();
     init_wrap();
     init_login();
     init_logout();
-    init_auth();
     init_install();
     init_unconfigure();
     init_test();
@@ -39820,7 +39245,7 @@ function createPromptRunner(adapter = {
 var init_prompt_runner = __esm({
   "src/cli/prompt-runner.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
     init_errors();
   }
 });
@@ -39831,17 +39256,17 @@ __export(bootstrap_exports, {
   createCliMain: () => createCliMain,
   isCliInvocation: () => isCliInvocation
 });
-import * as nodeFs2 from "node:fs/promises";
+import * as nodeFs from "node:fs/promises";
 import * as nodeFsSync3 from "node:fs";
 import { realpathSync } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 import chalk13 from "chalk";
 function createCliMain(programFactory) {
   return async function runCli() {
-    const homeDir = homedir4();
-    const logDir = join2(homeDir, ".poe-code", "logs");
+    const homeDir = homedir3();
+    const logDir = join3(homeDir, ".poe-code", "logs");
     const promptRunner = createPromptRunner();
     const shouldLogToStderr = process.env.POE_CODE_STDERR_LOGS === "1" || process.env.POE_CODE_STDERR_LOGS === "true";
     const errorLogger = new ErrorLogger({
@@ -39876,7 +39301,7 @@ function createCliMain(programFactory) {
         } else {
           log2.error(`Error: ${error2.message}`);
           log2.message(
-            `See logs at ${join2(logDir, "errors.log")} for more details.`,
+            `See logs at ${join3(logDir, "errors.log")} for more details.`,
             { symbol: chalk13.magenta("\u25CF") }
           );
         }
@@ -39902,11 +39327,11 @@ var fsAdapter;
 var init_bootstrap = __esm({
   "src/cli/bootstrap.ts"() {
     "use strict";
-    init_src4();
+    init_src3();
     init_error_logger();
     init_errors();
     init_prompt_runner();
-    fsAdapter = nodeFs2;
+    fsAdapter = nodeFs;
   }
 });
 
@@ -40045,6 +39470,6 @@ export {
   getPoeApiKey,
   isCliInvocation2 as isCliInvocation,
   main,
-  spawn4 as spawn
+  spawn3 as spawn
 };
 //# sourceMappingURL=index.js.map