poe-code 3.0.71 → 3.0.72-beta.2

package/dist/index.js

@@ -31,34 +31,469 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/auth/src/encrypted-file-auth-store.ts
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import path from "node:path";
+function defaultMachineIdentity() {
+  return {
+    hostname: hostname(),
+    username: userInfo().username
+  };
+}
+async function deriveEncryptionKey(getMachineIdentity) {
+  const machineIdentity = await getMachineIdentity();
+  const secret = `${machineIdentity.hostname}:${machineIdentity.username}`;
+  return await new Promise((resolve, reject) => {
+    scrypt(secret, ENCRYPTION_SALT, ENCRYPTION_KEY_BYTES, (error2, derivedKey) => {
+      if (error2) {
+        reject(error2);
+        return;
+      }
+      resolve(Buffer.from(derivedKey));
+    });
+  });
+}
+function parseEncryptedDocument(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed)) {
+      return null;
+    }
+    if (parsed.version !== ENCRYPTION_VERSION) {
+      return null;
+    }
+    if (typeof parsed.iv !== "string" || typeof parsed.authTag !== "string" || typeof parsed.ciphertext !== "string") {
+      return null;
+    }
+    return {
+      version: parsed.version,
+      iv: parsed.iv,
+      authTag: parsed.authTag,
+      ciphertext: parsed.ciphertext
+    };
+  } catch {
+    return null;
+  }
+}
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isNotFoundError(error2) {
+  return Boolean(
+    error2 && typeof error2 === "object" && "code" in error2 && error2.code === "ENOENT"
+  );
+}
+var ENCRYPTION_ALGORITHM, ENCRYPTION_VERSION, ENCRYPTION_KEY_BYTES, ENCRYPTION_IV_BYTES, ENCRYPTION_AUTH_TAG_BYTES, ENCRYPTION_SALT, ENCRYPTION_FILE_MODE, EncryptedFileAuthStore;
+var init_encrypted_file_auth_store = __esm({
+  "packages/auth/src/encrypted-file-auth-store.ts"() {
+    "use strict";
+    ENCRYPTION_ALGORITHM = "aes-256-gcm";
+    ENCRYPTION_VERSION = 1;
+    ENCRYPTION_KEY_BYTES = 32;
+    ENCRYPTION_IV_BYTES = 12;
+    ENCRYPTION_AUTH_TAG_BYTES = 16;
+    ENCRYPTION_SALT = "poe-code:encrypted-file-auth-store:v1";
+    ENCRYPTION_FILE_MODE = 384;
+    EncryptedFileAuthStore = class {
+      fs;
+      filePath;
+      getMachineIdentity;
+      getRandomBytes;
+      keyPromise = null;
+      constructor(input = {}) {
+        this.fs = input.fs ?? fs;
+        this.filePath = input.filePath ?? path.join(
+          (input.getHomeDirectory ?? homedir)(),
+          ".poe-code",
+          "credentials.enc"
+        );
+        this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
+        this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+      }
+      async getApiKey() {
+        let rawDocument;
+        try {
+          rawDocument = await this.fs.readFile(this.filePath, "utf8");
+        } catch (error2) {
+          if (isNotFoundError(error2)) {
+            return null;
+          }
+          throw error2;
+        }
+        const document = parseEncryptedDocument(rawDocument);
+        if (!document) {
+          return null;
+        }
+        const key = await this.getEncryptionKey();
+        try {
+          const iv = Buffer.from(document.iv, "base64");
+          const authTag = Buffer.from(document.authTag, "base64");
+          const ciphertext = Buffer.from(document.ciphertext, "base64");
+          if (iv.byteLength !== ENCRYPTION_IV_BYTES || authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+            return null;
+          }
+          const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
+          decipher.setAuthTag(authTag);
+          const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+          return plaintext.toString("utf8");
+        } catch {
+          return null;
+        }
+      }
+      async setApiKey(apiKey) {
+        const key = await this.getEncryptionKey();
+        const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
+        const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
+        const ciphertext = Buffer.concat([
+          cipher.update(apiKey, "utf8"),
+          cipher.final()
+        ]);
+        const authTag = cipher.getAuthTag();
+        const document = {
+          version: ENCRYPTION_VERSION,
+          iv: iv.toString("base64"),
+          authTag: authTag.toString("base64"),
+          ciphertext: ciphertext.toString("base64")
+        };
+        await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
+        await this.fs.writeFile(this.filePath, JSON.stringify(document), {
+          encoding: "utf8"
+        });
+        await this.fs.chmod(this.filePath, ENCRYPTION_FILE_MODE);
+      }
+      async deleteApiKey() {
+        try {
+          await this.fs.unlink(this.filePath);
+        } catch (error2) {
+          if (!isNotFoundError(error2)) {
+            throw error2;
+          }
+        }
+      }
+      getEncryptionKey() {
+        if (!this.keyPromise) {
+          this.keyPromise = deriveEncryptionKey(this.getMachineIdentity);
+        }
+        return this.keyPromise;
+      }
+    };
+  }
+});
+
+// packages/auth/src/keychain-auth-store.ts
+import { spawn } from "node:child_process";
+function runSecurityCommand(command, args) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error2) => {
+      const message = error2 instanceof Error ? error2.message : String(error2 ?? "Unknown error");
+      resolve({
+        stdout,
+        stderr: stderr ? `${stderr}${message}` : message,
+        exitCode: 127
+      });
+    });
+    child.on("close", (code) => {
+      resolve({
+        stdout,
+        stderr,
+        exitCode: code ?? 0
+      });
+    });
+  });
+}
+function stripTrailingLineBreak(value) {
+  if (value.endsWith("\r\n")) {
+    return value.slice(0, -2);
+  }
+  if (value.endsWith("\n") || value.endsWith("\r")) {
+    return value.slice(0, -1);
+  }
+  return value;
+}
+function isKeychainEntryNotFound(result) {
+  if (result.exitCode === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE) {
+    return true;
+  }
+  const output = `${result.stderr}
+${result.stdout}`.toLowerCase();
+  return output.includes("could not be found") || output.includes("item not found") || output.includes("errsecitemnotfound");
+}
+function createSecurityCliFailure(operation, result) {
+  const details = result.stderr.trim() || result.stdout.trim();
+  if (details) {
+    return new Error(
+      `Failed to ${operation}: security exited with code ${result.exitCode}: ${details}`
+    );
+  }
+  return new Error(`Failed to ${operation}: security exited with code ${result.exitCode}`);
+}
+var SECURITY_CLI, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE, KeychainAuthStore;
+var init_keychain_auth_store = __esm({
+  "packages/auth/src/keychain-auth-store.ts"() {
+    "use strict";
+    SECURITY_CLI = "security";
+    KEYCHAIN_SERVICE = "poe-code";
+    KEYCHAIN_ACCOUNT = "api-key";
+    KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE = 44;
+    KeychainAuthStore = class {
+      runCommand;
+      service;
+      account;
+      constructor(input = {}) {
+        this.runCommand = input.runCommand ?? runSecurityCommand;
+        this.service = input.service ?? KEYCHAIN_SERVICE;
+        this.account = input.account ?? KEYCHAIN_ACCOUNT;
+      }
+      async getApiKey() {
+        const result = await this.executeSecurityCommand(
+          ["find-generic-password", "-s", this.service, "-a", this.account, "-w"],
+          "read API key from macOS Keychain"
+        );
+        if (result.exitCode === 0) {
+          return stripTrailingLineBreak(result.stdout);
+        }
+        if (isKeychainEntryNotFound(result)) {
+          return null;
+        }
+        throw createSecurityCliFailure("read API key from macOS Keychain", result);
+      }
+      async setApiKey(apiKey) {
+        const result = await this.executeSecurityCommand(
+          [
+            "add-generic-password",
+            "-s",
+            this.service,
+            "-a",
+            this.account,
+            "-w",
+            apiKey,
+            "-U"
+          ],
+          "store API key in macOS Keychain"
+        );
+        if (result.exitCode !== 0) {
+          throw createSecurityCliFailure("store API key in macOS Keychain", result);
+        }
+      }
+      async deleteApiKey() {
+        const result = await this.executeSecurityCommand(
+          ["delete-generic-password", "-s", this.service, "-a", this.account],
+          "delete API key from macOS Keychain"
+        );
+        if (result.exitCode === 0 || isKeychainEntryNotFound(result)) {
+          return;
+        }
+        throw createSecurityCliFailure("delete API key from macOS Keychain", result);
+      }
+      async executeSecurityCommand(args, operation) {
+        try {
+          return await this.runCommand(SECURITY_CLI, args);
+        } catch (error2) {
+          const message = error2 instanceof Error ? error2.message : String(error2);
+          throw new Error(`Failed to ${operation}: ${message}`);
+        }
+      }
+    };
+  }
+});
+
+// packages/auth/src/create-auth-store.ts
+import { promises as nodeFs } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path2 from "node:path";
+function createAuthStore(input = {}) {
+  const backend = resolveBackend(input);
+  const platform = input.platform ?? process.platform;
+  if (backend === "keychain" && platform !== MACOS_PLATFORM) {
+    throw new Error(
+      `POE_AUTH_BACKEND=keychain is only supported on macOS. Current platform: ${platform}`
+    );
+  }
+  const store = authStoreFactories[backend](input);
+  return {
+    backend,
+    store: enableLegacyCredentialsMigration(store, input)
+  };
+}
+function resolveBackend(input) {
+  const configuredBackend = input.backend ?? input.env?.[AUTH_BACKEND_ENV_VAR] ?? process.env[AUTH_BACKEND_ENV_VAR];
+  if (configuredBackend === "keychain") {
+    return "keychain";
+  }
+  return "file";
+}
+function enableLegacyCredentialsMigration(store, input) {
+  const migrationContext = createLegacyMigrationContext(input);
+  const readApiKeyFromStore = store.getApiKey.bind(store);
+  let hasCheckedLegacyCredentials = false;
+  let legacyMigrationPromise = null;
+  store.getApiKey = async () => {
+    const storedApiKey = await readApiKeyFromStore();
+    if (isNonEmptyString(storedApiKey)) {
+      return storedApiKey;
+    }
+    if (hasCheckedLegacyCredentials) {
+      return null;
+    }
+    if (!legacyMigrationPromise) {
+      legacyMigrationPromise = migrateLegacyApiKey(store, migrationContext).finally(() => {
+        hasCheckedLegacyCredentials = true;
+        legacyMigrationPromise = null;
+      });
+    }
+    return legacyMigrationPromise;
+  };
+  return store;
+}
+async function migrateLegacyApiKey(store, migrationContext) {
+  const legacyCredentials = await loadLegacyCredentials(
+    migrationContext.fs,
+    migrationContext.filePath
+  );
+  if (!legacyCredentials || !isNonEmptyString(legacyCredentials.apiKey)) {
+    return null;
+  }
+  const plaintextApiKey = legacyCredentials.apiKey;
+  try {
+    await store.setApiKey(plaintextApiKey);
+    delete legacyCredentials.apiKey;
+    await saveLegacyCredentials(
+      migrationContext.fs,
+      migrationContext.filePath,
+      legacyCredentials
+    );
+  } catch (error2) {
+    migrationContext.logWarning(
+      `Failed to migrate plaintext API key from ${migrationContext.filePath}.`,
+      error2
+    );
+  }
+  return plaintextApiKey;
+}
+function createLegacyMigrationContext(input) {
+  const legacyCredentialsInput = input.legacyCredentials;
+  const getHomeDirectory = legacyCredentialsInput?.getHomeDirectory ?? homedir2;
+  return {
+    fs: legacyCredentialsInput?.fs ?? input.fileStore?.fs ?? nodeFs,
+    filePath: legacyCredentialsInput?.filePath ?? path2.join(
+      getHomeDirectory(),
+      LEGACY_CREDENTIALS_RELATIVE_PATH
+    ),
+    logWarning: legacyCredentialsInput?.logWarning ?? defaultMigrationWarning
+  };
+}
+async function loadLegacyCredentials(fs3, filePath) {
+  let raw;
+  try {
+    raw = await fs3.readFile(filePath, "utf8");
+  } catch (error2) {
+    if (isNotFoundError2(error2)) {
+      return null;
+    }
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord2(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function saveLegacyCredentials(fs3, filePath, document) {
+  await fs3.mkdir(path2.dirname(filePath), { recursive: true });
+  await fs3.writeFile(filePath, `${JSON.stringify(document, null, 2)}
+`, {
+    encoding: "utf8"
+  });
+}
+function defaultMigrationWarning(message, error2) {
+  const details = toErrorDetails(error2);
+  if (details.length > 0) {
+    console.warn(`${message} ${details}`);
+    return;
+  }
+  console.warn(message);
+}
+function toErrorDetails(error2) {
+  if (error2 instanceof Error) {
+    return error2.message;
+  }
+  return typeof error2 === "string" ? error2 : "";
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isRecord2(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isNotFoundError2(error2) {
+  return Boolean(
+    error2 && typeof error2 === "object" && "code" in error2 && error2.code === "ENOENT"
+  );
+}
+var AUTH_BACKEND_ENV_VAR, MACOS_PLATFORM, LEGACY_CREDENTIALS_RELATIVE_PATH, authStoreFactories;
+var init_create_auth_store = __esm({
+  "packages/auth/src/create-auth-store.ts"() {
+    "use strict";
+    init_encrypted_file_auth_store();
+    init_keychain_auth_store();
+    AUTH_BACKEND_ENV_VAR = "POE_AUTH_BACKEND";
+    MACOS_PLATFORM = "darwin";
+    LEGACY_CREDENTIALS_RELATIVE_PATH = ".poe-code/credentials.json";
+    authStoreFactories = {
+      file: (input) => new EncryptedFileAuthStore(input.fileStore),
+      keychain: (input) => new KeychainAuthStore(input.keychainStore)
+    };
+  }
+});
+
+// packages/auth/src/index.ts
+var init_src = __esm({
+  "packages/auth/src/index.ts"() {
+    "use strict";
+    init_create_auth_store();
+    init_encrypted_file_auth_store();
+    init_keychain_auth_store();
+  }
+});
+
 // src/sdk/credentials.ts
-import * as fs from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
 async function getPoeApiKey() {
   const envKey = process.env.POE_API_KEY;
   if (typeof envKey === "string" && envKey.trim().length > 0) {
     return envKey.trim();
   }
-  const homeDir = os.homedir();
-  const credentialsPath = path.join(homeDir, CREDENTIALS_RELATIVE_PATH);
-  try {
-    const content = await fs.readFile(credentialsPath, "utf8");
-    const parsed = JSON.parse(content);
-    if (typeof parsed === "object" && parsed !== null && typeof parsed.apiKey === "string" && parsed.apiKey.length > 0) {
-      return parsed.apiKey;
-    }
-  } catch {
+  const { store } = createAuthStore();
+  const storedKey = await store.getApiKey();
+  if (typeof storedKey === "string" && storedKey.trim().length > 0) {
+    return storedKey.trim();
   }
   throw new Error(
     "No API key found. Set POE_API_KEY or run 'poe-code login'."
   );
 }
-var CREDENTIALS_RELATIVE_PATH;
 var init_credentials = __esm({
   "src/sdk/credentials.ts"() {
     "use strict";
-    CREDENTIALS_RELATIVE_PATH = ".poe-code/credentials.json";
+    init_src();
   }
 });
 
@@ -383,16 +818,16 @@ function getConfigFormat(pathOrFormat) {
   }
   return formatRegistry[formatName];
 }
-function detectFormat(path20) {
-  const ext = getExtension(path20);
+function detectFormat(path21) {
+  const ext = getExtension(path21);
   return extensionMap[ext];
 }
-function getExtension(path20) {
-  const lastDot = path20.lastIndexOf(".");
+function getExtension(path21) {
+  const lastDot = path21.lastIndexOf(".");
   if (lastDot === -1) {
     return "";
   }
-  return path20.slice(lastDot).toLowerCase();
+  return path21.slice(lastDot).toLowerCase();
 }
 var formatRegistry, extensionMap;
 var init_formats = __esm({
@@ -414,7 +849,7 @@ var init_formats = __esm({
 });
 
 // packages/config-mutations/src/execution/path-utils.ts
-import path2 from "node:path";
+import path3 from "node:path";
 function expandHome(targetPath, homeDir) {
   if (!targetPath?.startsWith("~")) {
     return targetPath;
@@ -431,7 +866,7 @@ function expandHome(targetPath, homeDir) {
       remainder = remainder.slice(1);
     }
   }
-  return remainder.length === 0 ? homeDir : path2.join(homeDir, remainder);
+  return remainder.length === 0 ? homeDir : path3.join(homeDir, remainder);
 }
 function validateHomePath(targetPath) {
   if (typeof targetPath !== "string" || targetPath.length === 0) {
@@ -449,12 +884,12 @@ function resolvePath(rawPath, homeDir, pathMapper) {
   if (!pathMapper) {
     return expanded;
   }
-  const rawDirectory = path2.dirname(expanded);
+  const rawDirectory = path3.dirname(expanded);
   const mappedDirectory = pathMapper.mapTargetDirectory({
     targetDirectory: rawDirectory
   });
-  const filename = path2.basename(expanded);
-  return filename.length === 0 ? mappedDirectory : path2.join(mappedDirectory, filename);
+  const filename = path3.basename(expanded);
+  return filename.length === 0 ? mappedDirectory : path3.join(mappedDirectory, filename);
 }
 var init_path_utils = __esm({
   "packages/config-mutations/src/execution/path-utils.ts"() {
@@ -1115,7 +1550,7 @@ var init_types = __esm({
 });
 
 // packages/config-mutations/src/index.ts
-var init_src = __esm({
+var init_src2 = __esm({
   "packages/config-mutations/src/index.ts"() {
     "use strict";
     init_config_mutation();
@@ -1135,38 +1570,38 @@ import { createTwoFilesPatch } from "diff";
 import chalk from "chalk";
 function createDryRunFileSystem(base, recorder) {
   const proxy = {
-    async readFile(path20, encoding) {
+    async readFile(path21, encoding) {
       if (encoding) {
-        return base.readFile(path20, encoding);
+        return base.readFile(path21, encoding);
       }
-      return base.readFile(path20);
+      return base.readFile(path21);
     },
-    async writeFile(path20, data, options) {
-      const previousContent = await tryReadText(base, path20);
+    async writeFile(path21, data, options) {
+      const previousContent = await tryReadText(base, path21);
       const nextContent = formatData(data, options?.encoding);
       recorder.record({
         type: "writeFile",
-        path: path20,
+        path: path21,
         nextContent,
         previousContent
       });
     },
-    async mkdir(path20, options) {
-      recorder.record({ type: "mkdir", path: path20, options });
+    async mkdir(path21, options) {
+      recorder.record({ type: "mkdir", path: path21, options });
     },
-    async stat(path20) {
-      return base.stat(path20);
+    async stat(path21) {
+      return base.stat(path21);
     },
-    async unlink(path20) {
-      recorder.record({ type: "unlink", path: path20 });
+    async unlink(path21) {
+      recorder.record({ type: "unlink", path: path21 });
     },
-    async readdir(path20) {
-      return base.readdir(path20);
+    async readdir(path21) {
+      return base.readdir(path21);
     }
   };
   if (typeof base.rm === "function") {
-    proxy.rm = async (path20, options) => {
-      recorder.record({ type: "rm", path: path20, options });
+    proxy.rm = async (path21, options) => {
+      recorder.record({ type: "rm", path: path21, options });
     };
   }
   if (typeof base.copyFile === "function") {
@@ -1256,8 +1691,8 @@ function describeWriteChange(previous, next) {
   }
   return "update";
 }
-function renderWriteCommand(path20, change) {
-  const command = `cat > ${path20}`;
+function renderWriteCommand(path21, change) {
+  const command = `cat > ${path21}`;
   if (change === "create") {
     return renderOperationCommand(command, chalk.green, "# create");
   }
@@ -1419,9 +1854,9 @@ function redactTomlLine(line) {
   }
   return line;
 }
-async function tryReadText(base, path20) {
+async function tryReadText(base, path21) {
   try {
-    return await base.readFile(path20, "utf8");
+    return await base.readFile(path21, "utf8");
   } catch (error2) {
     if (isNotFound(error2)) {
       return null;
@@ -1447,7 +1882,7 @@ var REDACTED_PLACEHOLDER, JSON_SENSITIVE_KEYS, AUTH_SENSITIVE_KEYS, TOML_SENSITI
 var init_dry_run = __esm({
   "src/utils/dry-run.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     REDACTED_PLACEHOLDER = "<redacted>";
     JSON_SENSITIVE_KEYS = ["apiKey", "api_key", "apiKeyHelper"];
     AUTH_SENSITIVE_KEYS = ["key"];
@@ -1598,170 +2033,9 @@ var init_context = __esm({
   }
 });
 
-// src/services/credentials.ts
-import path3 from "node:path";
-async function saveCredentials(options) {
-  const { fs: fs3, filePath, apiKey } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  document.apiKey = apiKey;
-  await writeCredentialsDocument(fs3, filePath, document);
-}
-async function loadCredentials(options) {
-  const { fs: fs3, filePath } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  return typeof document.apiKey === "string" && document.apiKey.length > 0 ? document.apiKey : null;
-}
-async function deleteCredentials(options) {
-  const { fs: fs3, filePath } = options;
-  try {
-    await fs3.unlink(filePath);
-    return true;
-  } catch (error2) {
-    if (isNotFound(error2)) {
-      return false;
-    }
-    throw error2;
-  }
-}
-async function loadConfiguredServices(options) {
-  const { fs: fs3, filePath } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  return { ...document.configured_services ?? {} };
-}
-async function saveConfiguredService(options) {
-  const { fs: fs3, filePath, service, metadata } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  const normalized = normalizeConfiguredServiceMetadata(metadata);
-  document.configured_services = {
-    ...document.configured_services ?? {},
-    [service]: normalized
-  };
-  await writeCredentialsDocument(fs3, filePath, document);
-}
-async function unconfigureService(options) {
-  const { fs: fs3, filePath, service } = options;
-  const document = await readCredentialsDocument(fs3, filePath);
-  const services = document.configured_services;
-  if (!services || !(service in services)) {
-    return false;
-  }
-  delete services[service];
-  if (Object.keys(services).length === 0) {
-    delete document.configured_services;
-  }
-  await writeCredentialsDocument(fs3, filePath, document);
-  return true;
-}
-function normalizeConfiguredServiceMetadata(metadata) {
-  const seen = /* @__PURE__ */ new Set();
-  const files = [];
-  for (const entry of metadata.files ?? []) {
-    if (typeof entry !== "string" || entry.length === 0) {
-      continue;
-    }
-    if (!seen.has(entry)) {
-      files.push(entry);
-      seen.add(entry);
-    }
-  }
-  return {
-    files
-  };
-}
-async function readCredentialsDocument(fs3, filePath) {
-  try {
-    const raw = await fs3.readFile(filePath, "utf8");
-    return await parseCredentialsDocument(fs3, filePath, raw);
-  } catch (error2) {
-    if (isNotFound(error2)) {
-      return {};
-    }
-    throw error2;
-  }
-}
-async function parseCredentialsDocument(fs3, filePath, raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    return normalizeCredentialsDocument(parsed);
-  } catch (error2) {
-    if (error2 instanceof SyntaxError) {
-      await recoverInvalidCredentials(fs3, filePath, raw);
-      return {};
-    }
-    throw error2;
-  }
-}
-function normalizeCredentialsDocument(value) {
-  if (!isRecord(value)) {
-    return {};
-  }
-  const document = {};
-  if (typeof value.apiKey === "string" && value.apiKey.length > 0) {
-    document.apiKey = value.apiKey;
-  }
-  const services = normalizeConfiguredServices(value.configured_services);
-  if (Object.keys(services).length > 0) {
-    document.configured_services = services;
-  }
-  return document;
-}
-function normalizeConfiguredServices(value) {
-  if (!isRecord(value)) {
-    return {};
-  }
-  const entries = {};
-  for (const [key, entry] of Object.entries(value)) {
-    if (!isRecord(entry)) {
-      continue;
-    }
-    const normalized = normalizeConfiguredServiceMetadata({
-      files: Array.isArray(entry.files) ? entry.files : []
-    });
-    entries[key] = normalized;
-  }
-  return entries;
-}
-async function writeCredentialsDocument(fs3, filePath, document) {
-  await fs3.mkdir(path3.dirname(filePath), { recursive: true });
-  const payload = {};
-  if (document.apiKey) {
-    payload.apiKey = document.apiKey;
-  }
-  if (document.configured_services) {
-    payload.configured_services = document.configured_services;
-  }
-  await fs3.writeFile(filePath, `${JSON.stringify(payload, null, 2)}
-`, {
-    encoding: "utf8"
-  });
-}
-async function recoverInvalidCredentials(fs3, filePath, content) {
-  const backupPath = createInvalidBackupPath(filePath);
-  await fs3.writeFile(backupPath, content, { encoding: "utf8" });
-  await fs3.writeFile(filePath, EMPTY_DOCUMENT, { encoding: "utf8" });
-}
-function createInvalidBackupPath(filePath) {
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dir = path3.dirname(filePath);
-  const base = path3.basename(filePath);
-  return path3.join(dir, `${base}.invalid-${timestamp}.json`);
-}
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-var EMPTY_DOCUMENT;
-var init_credentials2 = __esm({
-  "src/services/credentials.ts"() {
-    "use strict";
-    init_src();
-    EMPTY_DOCUMENT = `${JSON.stringify({}, null, 2)}
-`;
-  }
-});
-
 // src/cli/isolated-env.ts
 import path4 from "node:path";
-async function resolveIsolatedEnvDetails(env, isolated, providerName, fs3) {
+async function resolveIsolatedEnvDetails(env, isolated, providerName, readApiKey) {
   if (!providerName) {
     throw new Error("resolveIsolatedEnvDetails requires providerName.");
   }
@@ -1774,7 +2048,7 @@ async function resolveIsolatedEnvDetails(env, isolated, providerName, fs3) {
   }
   return {
     agentBinary: isolated.agentBinary,
-    env: await resolveIsolatedEnvVars(env, baseDir, isolated.env, fs3),
+    env: await resolveIsolatedEnvVars(env, baseDir, isolated.env, readApiKey),
     configProbePath: isolated.configProbe ? resolveIsolatedEnvPath(env, baseDir, isolated.configProbe) : void 0
   };
 }
@@ -1803,14 +2077,14 @@ function resolveIsolatedTargetDirectory(input) {
 function resolveIsolatedBaseDir(env, providerName) {
   return env.resolveHomePath(".poe-code", providerName);
 }
-async function resolveIsolatedEnvVars(env, baseDir, vars, fs3) {
+async function resolveIsolatedEnvVars(env, baseDir, vars, readApiKey) {
   const out = {};
   for (const [key, value] of Object.entries(vars)) {
-    out[key] = await resolveIsolatedEnvValue(env, baseDir, value, fs3);
+    out[key] = await resolveIsolatedEnvValue(env, baseDir, value, readApiKey);
   }
   return out;
 }
-async function resolveIsolatedEnvValue(env, baseDir, value, fs3) {
+async function resolveIsolatedEnvValue(env, baseDir, value, readApiKey) {
   if (typeof value === "string") {
     return expandHomeShortcut(env, value);
   }
@@ -1828,12 +2102,12 @@ async function resolveIsolatedEnvValue(env, baseDir, value, fs3) {
     if (typeof resolved === "string" && resolved.trim().length > 0) {
       return resolved;
     }
-    if (!fs3) {
+    if (!readApiKey) {
       throw new Error(
         'Missing Poe API key for isolated wrapper. Set "POE_API_KEY" or run "poe-code login".'
       );
     }
-    return await resolvePoeApiKeyFromCredentials({ fs: fs3, env });
+    return await resolvePoeApiKeyFromAuthStore(readApiKey);
   }
   if (isPoeBaseUrlReference(value)) {
     return env.poeBaseUrl;
@@ -1860,8 +2134,8 @@ function isPoeApiKeyReference(value) {
 function isPoeBaseUrlReference(value) {
   return typeof value === "object" && value.kind === "poeBaseUrl";
 }
-async function resolvePoeApiKeyFromCredentials(input) {
-  const stored = await loadCredentials({ fs: input.fs, filePath: input.env.credentialsPath }) ?? void 0;
+async function resolvePoeApiKeyFromAuthStore(readApiKey) {
+  const stored = await readApiKey();
   if (typeof stored !== "string" || stored.trim().length === 0) {
     throw new Error(
       'Missing Poe API key for isolated wrapper. Set "POE_API_KEY" or run "poe-code login".'
@@ -1904,11 +2178,11 @@ async function applyIsolatedEnvRepairs(input) {
     }
   }
 }
-async function resolveCliSettings(cliSettings, env, fs3) {
+async function resolveCliSettings(cliSettings, env, readApiKey) {
   const result = { ...cliSettings.values };
   if (cliSettings.resolved) {
     for (const [key, value] of Object.entries(cliSettings.resolved)) {
-      result[key] = await resolveCliSettingValue(value, env, fs3);
+      result[key] = await resolveCliSettingValue(value, env, readApiKey);
     }
   }
   if (cliSettings.env) {
@@ -1917,21 +2191,21 @@ async function resolveCliSettings(cliSettings, env, fs3) {
       if (typeof value === "string") {
         resolvedEnv[key] = value;
       } else {
-        resolvedEnv[key] = await resolveCliSettingValue(value, env, fs3);
+        resolvedEnv[key] = await resolveCliSettingValue(value, env, readApiKey);
       }
     }
     result.env = resolvedEnv;
   }
   return result;
 }
-async function resolveCliSettingValue(value, env, fs3) {
+async function resolveCliSettingValue(value, env, readApiKey) {
   if (isPoeApiKeyReference(value)) {
     const resolved = env.getVariable("POE_API_KEY");
     if (typeof resolved === "string" && resolved.trim().length > 0) {
       return resolved;
     }
-    if (fs3) {
-      return await resolvePoeApiKeyFromCredentials({ fs: fs3, env });
+    if (readApiKey) {
+      return await resolvePoeApiKeyFromAuthStore(readApiKey);
     }
     throw new Error(
       'Missing Poe API key for CLI settings. Set "POE_API_KEY" or run "poe-code login".'
@@ -1972,17 +2246,16 @@ function expandHomeShortcut(env, input) {
 var init_isolated_env = __esm({
   "src/cli/isolated-env.ts"() {
     "use strict";
-    init_src();
-    init_credentials2();
+    init_src2();
   }
 });
 
 // packages/agent-spawn/src/run-command.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 function runCommand(command, args, options) {
   return new Promise((resolve) => {
     const hasStdin = options?.stdin != null;
-    const child = spawn(command, args, {
+    const child = spawn2(command, args, {
       stdio: [hasStdin ? "pipe" : "ignore", "pipe", "pipe"],
       cwd: options?.cwd,
       env: options?.env ? {
@@ -2185,7 +2458,7 @@ var init_registry = __esm({
 });
 
 // packages/agent-defs/src/index.ts
-var init_src2 = __esm({
+var init_src3 = __esm({
   "packages/agent-defs/src/index.ts"() {
     "use strict";
     init_agents();
@@ -2410,7 +2683,7 @@ var allSpawnConfigs, lookup2;
 var init_configs = __esm({
   "packages/agent-spawn/src/configs/index.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_claude_code2();
     init_codex2();
     init_opencode2();
@@ -2445,7 +2718,7 @@ function resolveConfig(agentId) {
 var init_resolve_config = __esm({
   "packages/agent-spawn/src/configs/resolve-config.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_configs();
   }
 });
@@ -2528,7 +2801,7 @@ function buildCliArgs(config2, options, stdinMode) {
   }
   return args;
 }
-async function spawn2(agentId, options, context) {
+async function spawn3(agentId, options, context) {
   const { agentId: resolvedId, binaryName, spawnConfig } = resolveCliConfig(agentId);
   const stdinMode = options.useStdin && spawnConfig.stdinMode ? spawnConfig.stdinMode : void 0;
   const spawnArgs = buildCliArgs(spawnConfig, options, stdinMode);
@@ -3341,7 +3614,7 @@ var init_static = __esm({
 });
 
 // packages/design-system/src/index.ts
-var init_src3 = __esm({
+var init_src4 = __esm({
   "packages/design-system/src/index.ts"() {
     "use strict";
     init_tokens();
@@ -3434,7 +3707,7 @@ async function renderAcpStream(events) {
 var init_renderer = __esm({
   "packages/agent-spawn/src/acp/renderer.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
   }
 });
 
@@ -3444,13 +3717,13 @@ function truncate2(text4, maxLength) {
   if (maxLength <= 3) return text4.slice(0, maxLength);
   return `${text4.slice(0, maxLength - 3)}...`;
 }
-function isNonEmptyString(value) {
+function isNonEmptyString2(value) {
   return typeof value === "string" && value.length > 0;
 }
 function extractThreadId(value) {
   if (!value || typeof value !== "object") return;
   const obj = value;
-  const maybeThreadId = isNonEmptyString(obj.thread_id) && obj.thread_id || isNonEmptyString(obj.threadId) && obj.threadId || isNonEmptyString(obj.threadID) && obj.threadID || isNonEmptyString(obj.session_id) && obj.session_id || isNonEmptyString(obj.sessionId) && obj.sessionId || isNonEmptyString(obj.sessionID) && obj.sessionID;
+  const maybeThreadId = isNonEmptyString2(obj.thread_id) && obj.thread_id || isNonEmptyString2(obj.threadId) && obj.threadId || isNonEmptyString2(obj.threadID) && obj.threadID || isNonEmptyString2(obj.session_id) && obj.session_id || isNonEmptyString2(obj.sessionId) && obj.sessionId || isNonEmptyString2(obj.sessionID) && obj.sessionID;
   return maybeThreadId || void 0;
 }
 var init_utils = __esm({
@@ -3496,7 +3769,7 @@ async function* adaptClaude(lines) {
       continue;
     }
     const eventType = event.type;
-    if (!isNonEmptyString(eventType)) continue;
+    if (!isNonEmptyString2(eventType)) continue;
     if (!emittedSessionStart) {
       const threadId = extractThreadId(event);
       emittedSessionStart = true;
@@ -3519,16 +3792,16 @@ async function* adaptClaude(lines) {
       const item = block;
       if (!item || typeof item !== "object") continue;
       const blockType = item.type;
-      if (!isNonEmptyString(blockType)) continue;
+      if (!isNonEmptyString2(blockType)) continue;
       if (eventType === "assistant") {
-        if (blockType === "text" && isNonEmptyString(item.text)) {
+        if (blockType === "text" && isNonEmptyString2(item.text)) {
           yield {
             event: "agent_message",
             text: item.text
           };
           continue;
         }
-        if (blockType === "tool_use" && isNonEmptyString(item.id) && isNonEmptyString(item.name)) {
+        if (blockType === "tool_use" && isNonEmptyString2(item.id) && isNonEmptyString2(item.name)) {
           const kind = TOOL_KIND_MAP[item.name] ?? "other";
           toolKindsById.set(item.id, kind);
           yield {
@@ -3542,25 +3815,25 @@ async function* adaptClaude(lines) {
         continue;
       }
       if (eventType === "user") {
-        if (!isNonEmptyString(item.tool_use_id)) continue;
+        if (!isNonEmptyString2(item.tool_use_id)) continue;
         if (blockType !== "tool_result") continue;
         const kind = toolKindsById.get(item.tool_use_id);
         toolKindsById.delete(item.tool_use_id);
-        let path20;
+        let path21;
         if (typeof item.content === "string") {
-          path20 = item.content;
+          path21 = item.content;
         } else {
           try {
-            path20 = JSON.stringify(item.content);
+            path21 = JSON.stringify(item.content);
           } catch {
-            path20 = String(item.content);
+            path21 = String(item.content);
           }
         }
         yield {
           event: "tool_complete",
           id: item.tool_use_id,
           kind,
-          path: path20
+          path: path21
         };
       }
     }
@@ -3614,7 +3887,7 @@ async function* adaptCodex(lines) {
       continue;
     }
     const eventType = event.type;
-    if (!isNonEmptyString(eventType)) continue;
+    if (!isNonEmptyString2(eventType)) continue;
     if (eventType === "thread.started") {
       const maybeThreadId = extractThreadId(event);
       yield { event: "session_start", threadId: maybeThreadId };
@@ -3638,23 +3911,23 @@ async function* adaptCodex(lines) {
     const item = event.item ?? null;
     if (!item || typeof item !== "object") continue;
     const itemType = item.type;
-    if (!isNonEmptyString(itemType)) continue;
+    if (!isNonEmptyString2(itemType)) continue;
     if (eventType === "item.started") {
-      if (!isNonEmptyString(item.id)) continue;
+      if (!isNonEmptyString2(item.id)) continue;
       let kind;
       let title;
       if (itemType === "command_execution") {
         kind = "exec";
-        title = truncate2(isNonEmptyString(item.command) ? item.command : "", 80);
+        title = truncate2(isNonEmptyString2(item.command) ? item.command : "", 80);
       } else if (itemType === "file_edit") {
         kind = "edit";
-        title = isNonEmptyString(item.path) ? item.path : "";
+        title = isNonEmptyString2(item.path) ? item.path : "";
       } else if (itemType === "thinking") {
         kind = "think";
         title = "thinking...";
       } else if (itemType === "mcp_tool_call") {
-        const server = isNonEmptyString(item.server) ? item.server : "unknown";
-        const tool = isNonEmptyString(item.tool) ? item.tool : "unknown";
+        const server = isNonEmptyString2(item.server) ? item.server : "unknown";
+        const tool = isNonEmptyString2(item.tool) ? item.tool : "unknown";
         kind = "other";
         title = `${server}.${tool}`;
       }
@@ -3667,25 +3940,25 @@ async function* adaptCodex(lines) {
     }
     if (eventType === "item.completed") {
       if (itemType === "agent_message") {
-        if (!isNonEmptyString(item.text)) continue;
+        if (!isNonEmptyString2(item.text)) continue;
         yield { event: "agent_message", text: item.text };
         continue;
       }
       if (itemType === "reasoning") {
-        const text4 = isNonEmptyString(item.text) ? item.text : isNonEmptyString(item.content) ? item.content : isNonEmptyString(item.summary) ? item.summary : void 0;
+        const text4 = isNonEmptyString2(item.text) ? item.text : isNonEmptyString2(item.content) ? item.content : isNonEmptyString2(item.summary) ? item.summary : void 0;
         if (!text4) continue;
         yield { event: "reasoning", text: text4 };
         continue;
       }
-      if (!isNonEmptyString(item.id)) continue;
+      if (!isNonEmptyString2(item.id)) continue;
       if (itemType === "command_execution" || itemType === "file_edit" || itemType === "mcp_tool_call") {
         const kindFromStart = toolKindById.get(item.id);
         const kind = kindFromStart ?? (itemType === "command_execution" ? "exec" : itemType === "file_edit" ? "edit" : "other");
-        const titleFromEvent = isNonEmptyString(item.path) ? item.path : itemType === "mcp_tool_call" ? `${isNonEmptyString(item.server) ? item.server : "unknown"}.${isNonEmptyString(item.tool) ? item.tool : "unknown"}` : void 0;
-        const path20 = titleFromEvent ?? toolTitleById.get(item.id) ?? "";
+        const titleFromEvent = isNonEmptyString2(item.path) ? item.path : itemType === "mcp_tool_call" ? `${isNonEmptyString2(item.server) ? item.server : "unknown"}.${isNonEmptyString2(item.tool) ? item.tool : "unknown"}` : void 0;
+        const path21 = titleFromEvent ?? toolTitleById.get(item.id) ?? "";
         toolTitleById.delete(item.id);
         toolKindById.delete(item.id);
-        yield { event: "tool_complete", id: item.id, kind, path: path20 };
+        yield { event: "tool_complete", id: item.id, kind, path: path21 };
       }
     }
   }
@@ -3724,9 +3997,9 @@ async function* adaptKimi(lines) {
       }
     }
     const role = event.role;
-    if (!isNonEmptyString(role) || role !== "assistant") continue;
+    if (!isNonEmptyString2(role) || role !== "assistant") continue;
     const content = event.content;
-    if (!isNonEmptyString(content)) continue;
+    if (!isNonEmptyString2(content)) continue;
     yield { event: "agent_message", text: content };
   }
 }
@@ -3755,7 +4028,7 @@ async function* adaptNative(lines) {
       continue;
     }
     const maybeEventType = event?.event;
-    if (!isNonEmptyString(maybeEventType)) {
+    if (!isNonEmptyString2(maybeEventType)) {
       yield {
         event: "error",
         message: `[adaptNative] Line missing string "event" field: ${truncate2(line, 200)}`
@@ -3814,23 +4087,23 @@ async function* adaptOpenCode(lines) {
     }
     if (!event || typeof event !== "object") continue;
     const sessionID = extractThreadId(event);
-    if (!emittedSessionStart && isNonEmptyString(sessionID)) {
+    if (!emittedSessionStart && isNonEmptyString2(sessionID)) {
       emittedSessionStart = true;
       yield { event: "session_start", threadId: sessionID };
     }
     const eventType = event.type;
-    if (!isNonEmptyString(eventType)) continue;
+    if (!isNonEmptyString2(eventType)) continue;
     if (eventType === "text") {
       const part = event.part ?? null;
       if (!part || typeof part !== "object") continue;
-      if (!isNonEmptyString(part.text)) continue;
+      if (!isNonEmptyString2(part.text)) continue;
       yield { event: "agent_message", text: part.text };
       continue;
     }
     if (eventType === "tool_use") {
       const part = event.part ?? null;
       if (!part || typeof part !== "object") continue;
-      if (!isNonEmptyString(part.callID) || !isNonEmptyString(part.tool)) continue;
+      if (!isNonEmptyString2(part.callID) || !isNonEmptyString2(part.tool)) continue;
       const state = part.state ?? null;
       if (!state || typeof state !== "object") continue;
       const kind = guessToolKind(part.tool);
@@ -3842,7 +4115,7 @@ async function* adaptOpenCode(lines) {
         const maybeInput = state.input;
         if (kind === "exec" && maybeInput && typeof maybeInput === "object") {
           const command = maybeInput.command;
-          if (isNonEmptyString(command)) {
+          if (isNonEmptyString2(command)) {
             title = truncate2(command, 80);
           }
         }
@@ -4046,7 +4319,7 @@ var init_spawn2 = __esm({
 });
 
 // packages/agent-spawn/src/index.ts
-var init_src4 = __esm({
+var init_src5 = __esm({
   "packages/agent-spawn/src/index.ts"() {
     "use strict";
     init_run_command();
@@ -4226,8 +4499,8 @@ var init_shared = __esm({
     "use strict";
     init_context();
     init_isolated_env();
-    init_src4();
-    init_src2();
+    init_src5();
+    init_src3();
   }
 });
 
@@ -4348,7 +4621,7 @@ import path7 from "node:path";
 function createCliEnvironment(init) {
   const platform = init.platform ?? process.platform;
   const variables = init.variables ?? process.env;
-  const credentialsPath = resolveCredentialsPath(init.homeDir);
+  const configPath = resolveConfigPath(init.homeDir);
   const logDir = resolveLogDir(init.homeDir);
   const { poeApiBaseUrl, poeBaseUrl } = resolvePoeBaseUrls(variables);
   const resolveHomePath = (...segments) => path7.join(init.homeDir, ...segments);
@@ -4357,7 +4630,7 @@ function createCliEnvironment(init) {
     cwd: init.cwd,
     homeDir: init.homeDir,
     platform,
-    credentialsPath,
+    configPath,
     logDir,
     poeApiBaseUrl,
     poeBaseUrl,
@@ -4366,8 +4639,8 @@ function createCliEnvironment(init) {
     getVariable
   };
 }
-function resolveCredentialsPath(homeDir) {
-  return path7.join(homeDir, ".poe-code", "credentials.json");
+function resolveConfigPath(homeDir) {
+  return path7.join(homeDir, ".poe-code", "config.json");
 }
 function resolveLogDir(homeDir) {
   return path7.join(homeDir, ".poe-code", "logs");
@@ -4538,7 +4811,7 @@ function createServiceRegistry() {
 var init_service_registry = __esm({
   "src/cli/service-registry.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
   }
 });
 
@@ -4806,7 +5079,7 @@ function isSilentError(error2) {
   }
   return error2.name === "SilentError" || error2.name === "OperationCancelledError";
 }
-var CliError, SilentError, ApiError, ValidationError, AuthenticationError, OperationCancelledError;
+var CliError, SilentError, ApiError, ValidationError, OperationCancelledError;
 var init_errors = __esm({
   "src/cli/errors.ts"() {
     "use strict";
@@ -4846,11 +5119,6 @@ var init_errors = __esm({
         super(message, context, { isUserError: true });
       }
     };
-    AuthenticationError = class extends CliError {
-      constructor(message, context) {
-        super(message, context, { isUserError: true });
-      }
-    };
     OperationCancelledError = class extends SilentError {
       constructor(message = "Operation cancelled.") {
         super(message, { isUserError: true });
@@ -5059,7 +5327,7 @@ function createLoggerFactory(emitter, theme) {
 var init_logger2 = __esm({
   "src/cli/logger.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_errors();
   }
 });
@@ -5447,7 +5715,7 @@ async function ensureIsolatedConfigForService(input) {
     container.env,
     isolated,
     adapter.name,
-    container.fs
+    container.readApiKey
   );
   const hasConfig = await isolatedConfigExists(
     container.fs,
@@ -5522,7 +5790,7 @@ function createPoeCodeCommandRunner(input) {
       container.env,
       adapter.isolatedEnv,
       adapter.name,
-      container.fs
+      container.readApiKey
     );
     if (adapter.isolatedEnv.requiresConfig !== false) {
       const hasConfig = await isolatedConfigExists(
@@ -5553,7 +5821,7 @@ function createPoeCodeCommandRunner(input) {
       const resolvedSettings = await resolveCliSettings(
         adapter.isolatedEnv.cliSettings,
         container.env,
-        container.fs
+        container.readApiKey
       );
       forwarded = buildArgsWithMergedSettings(forwarded, resolvedSettings);
     }
@@ -5582,11 +5850,11 @@ var init_poe_code_command_runner = __esm({
 
 // src/sdk/container.ts
 import * as fs2 from "node:fs/promises";
-import * as os2 from "node:os";
+import * as os from "node:os";
 import * as nodeFsSync from "node:fs";
 function createSdkContainer(options) {
   const cwd = options?.cwd ?? process.cwd();
-  const homeDir = options?.homeDir ?? os2.homedir();
+  const homeDir = options?.homeDir ?? os.homedir();
   const variables = options?.variables ?? process.env;
   const verbose = options?.verbose ?? false;
   const environment = createCliEnvironment({
@@ -5605,23 +5873,44 @@ function createSdkContainer(options) {
   });
   loggerFactory.setErrorLogger(errorLogger);
   const asyncFs = {
-    readFile: ((path20, encoding) => {
+    readFile: ((path21, encoding) => {
       if (encoding) {
-        return fs2.readFile(path20, encoding);
+        return fs2.readFile(path21, encoding);
       }
-      return fs2.readFile(path20);
+      return fs2.readFile(path21);
     }),
-    writeFile: (path20, data, opts) => fs2.writeFile(path20, data, opts),
-    mkdir: (path20, opts) => fs2.mkdir(path20, opts).then(() => {
+    writeFile: (path21, data, opts) => fs2.writeFile(path21, data, opts),
+    mkdir: (path21, opts) => fs2.mkdir(path21, opts).then(() => {
     }),
-    stat: (path20) => fs2.stat(path20),
-    rm: (path20, opts) => fs2.rm(path20, opts),
-    unlink: (path20) => fs2.unlink(path20),
-    readdir: (path20) => fs2.readdir(path20),
+    stat: (path21) => fs2.stat(path21),
+    rm: (path21, opts) => fs2.rm(path21, opts),
+    unlink: (path21) => fs2.unlink(path21),
+    readdir: (path21) => fs2.readdir(path21),
     copyFile: (src, dest) => fs2.copyFile(src, dest),
-    chmod: (path20, mode) => fs2.chmod(path20, mode)
+    chmod: (path21, mode) => fs2.chmod(path21, mode)
   };
   const contextFactory = createCommandContextFactory({ fs: asyncFs });
+  const authFs = {
+    readFile: (filePath, encoding) => fs2.readFile(filePath, encoding),
+    writeFile: (filePath, data, options2) => fs2.writeFile(filePath, data, options2),
+    mkdir: (directoryPath, options2) => fs2.mkdir(directoryPath, options2).then(() => void 0),
+    unlink: (filePath) => fs2.unlink(filePath),
+    chmod: (filePath, mode) => fs2.chmod(filePath, mode)
+  };
+  const { store: authStore } = createAuthStore({
+    env: variables,
+    platform: process.platform,
+    fileStore: {
+      fs: authFs,
+      getHomeDirectory: () => homeDir
+    },
+    legacyCredentials: {
+      fs: authFs,
+      getHomeDirectory: () => homeDir
+    }
+  });
+  const readApiKey = authStore.getApiKey.bind(authStore);
+  const writeApiKey = authStore.setApiKey.bind(authStore);
   const noopPrompts = async () => {
     throw new Error("SDK does not support interactive prompts");
   };
@@ -5630,15 +5919,8 @@ function createSdkContainer(options) {
     prompts: noopPrompts,
     promptLibrary,
     apiKeyStore: {
-      read: () => loadCredentials({
-        fs: asyncFs,
-        filePath: environment.credentialsPath
-      }),
-      write: (value) => saveCredentials({
-        fs: asyncFs,
-        filePath: environment.credentialsPath,
-        apiKey: value
-      })
+      read: readApiKey,
+      write: writeApiKey
     },
     confirm: async () => true
   });
@@ -5685,7 +5967,9 @@ function createSdkContainer(options) {
         platform: process.platform,
         variables
       }
-    }
+    },
+    readApiKey,
+    writeApiKey
   };
   return container;
 }
@@ -5699,15 +5983,15 @@ var init_container = __esm({
     init_options();
     init_logger2();
     init_error_logger();
-    init_src4();
+    init_src5();
     await init_providers();
     init_poe_code_command_runner();
-    init_credentials2();
+    init_src();
   }
 });
 
 // src/sdk/spawn.ts
-function spawn3(service, promptOrOptions, maybeOptions) {
+function spawn4(service, promptOrOptions, maybeOptions) {
   const options = typeof promptOrOptions === "string" ? { ...maybeOptions, prompt: promptOrOptions } : promptOrOptions;
   const emptyEvents = (async function* () {
   })();
@@ -5770,7 +6054,7 @@ function spawn3(service, promptOrOptions, maybeOptions) {
       }
       if (spawnConfig && spawnConfig.kind === "cli") {
         resolveEventsOnce(emptyEvents);
-        return spawn2(service, {
+        return spawn3(service, {
           prompt: options.prompt,
           cwd: options.cwd,
           model: options.model,
@@ -5804,9 +6088,9 @@ var init_spawn3 = __esm({
     init_credentials();
     init_spawn_core();
     await init_container();
-    init_src4();
-    spawn3.pretty = async function pretty(service, promptOrOptions, maybeOptions) {
-      const { events, result } = spawn3(service, promptOrOptions, maybeOptions);
+    init_src5();
+    spawn4.pretty = async function pretty(service, promptOrOptions, maybeOptions) {
+      const { events, result } = spawn4(service, promptOrOptions, maybeOptions);
       await renderAcpStream(events);
       return result;
     };
@@ -5877,13 +6161,13 @@ async function readErrorBody(response) {
   }
 }
 function extractTextContent(data) {
-  if (!isRecord2(data)) return void 0;
+  if (!isRecord3(data)) return void 0;
   const choices = data.choices;
   if (!Array.isArray(choices) || choices.length === 0) return void 0;
   const first = choices[0];
-  if (!isRecord2(first)) return void 0;
+  if (!isRecord3(first)) return void 0;
   const message = first.message;
-  if (!isRecord2(message)) return void 0;
+  if (!isRecord3(message)) return void 0;
   return typeof message.content === "string" ? message.content : void 0;
 }
 function extractMediaFromCompletion(data) {
@@ -5891,14 +6175,14 @@ function extractMediaFromCompletion(data) {
   if (!content) return {};
   try {
     const parsed = JSON.parse(content);
-    if (isRecord2(parsed) && typeof parsed.url === "string") {
+    if (isRecord3(parsed) && typeof parsed.url === "string") {
       return {
         url: parsed.url,
         mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0,
         data: typeof parsed.data === "string" ? parsed.data : void 0
       };
     }
-    if (isRecord2(parsed) && typeof parsed.data === "string") {
+    if (isRecord3(parsed) && typeof parsed.data === "string") {
       return {
         data: parsed.data,
         mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0
@@ -5932,7 +6216,7 @@ function isValidUrl(value) {
     return false;
   }
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 var init_llm_client = __esm({
@@ -5956,17 +6240,8 @@ async function initializeClient(options) {
   if (globalClient !== null) {
     return;
   }
-  const apiKey = await loadCredentials({
-    fs: options.fs,
-    filePath: options.credentialsPath
-  });
-  if (!apiKey) {
-    throw new AuthenticationError(
-      "Poe API key not found. Run 'poe-code login' first."
-    );
-  }
   const client = createPoeClient({
-    apiKey,
+    apiKey: options.apiKey,
     baseUrl: options.baseUrl,
     httpClient: options.httpClient
   });
@@ -5976,8 +6251,6 @@ var globalClient;
 var init_client_instance = __esm({
   "src/services/client-instance.ts"() {
     "use strict";
-    init_errors();
-    init_credentials2();
     init_llm_client();
     globalClient = null;
   }
@@ -6018,19 +6291,33 @@ function createCliContainer(dependencies) {
   });
   const commandRunner = dependencies.commandRunner ?? runCommand;
   const promptLibrary = createPromptLibrary();
+  const authFs = {
+    readFile: (filePath, encoding) => dependencies.fs.readFile(filePath, encoding),
+    writeFile: (filePath, data, opts) => dependencies.fs.writeFile(filePath, data, opts),
+    mkdir: (directoryPath, opts) => dependencies.fs.mkdir(directoryPath, opts).then(() => void 0),
+    unlink: (filePath) => dependencies.fs.unlink(filePath),
+    chmod: (filePath, mode) => dependencies.fs.chmod ? dependencies.fs.chmod(filePath, mode) : Promise.resolve()
+  };
+  const { store: authStore } = createAuthStore({
+    env: dependencies.env.variables,
+    platform: dependencies.env.platform,
+    fileStore: {
+      fs: authFs,
+      getHomeDirectory: () => dependencies.env.homeDir
+    },
+    legacyCredentials: {
+      fs: authFs,
+      getHomeDirectory: () => dependencies.env.homeDir
+    }
+  });
+  const readApiKey = authStore.getApiKey.bind(authStore);
+  const writeApiKey = authStore.setApiKey.bind(authStore);
   const options = createOptionResolvers({
     prompts: dependencies.prompts,
     promptLibrary,
     apiKeyStore: {
-      read: () => loadCredentials({
-        fs: dependencies.fs,
-        filePath: environment.credentialsPath
-      }),
-      write: (value) => saveCredentials({
-        fs: dependencies.fs,
-        filePath: environment.credentialsPath,
-        apiKey: value
-      })
+      read: readApiKey,
+      write: writeApiKey
     },
     confirm: async (message) => {
       const result = await confirm2({ message });
@@ -6066,14 +6353,16 @@ function createCliContainer(dependencies) {
     httpClient,
     commandRunner: wrappedRunner,
     providers,
-    dependencies
+    dependencies,
+    readApiKey,
+    writeApiKey
   };
   return container;
 }
 var init_container2 = __esm({
   async "src/cli/container.ts"() {
     "use strict";
-    init_credentials2();
+    init_src();
     init_environment();
     init_service_registry();
     init_context();
@@ -6081,14 +6370,176 @@ var init_container2 = __esm({
     init_options();
     init_logger2();
     init_error_logger();
+    init_src5();
     init_src4();
-    init_src3();
     await init_providers();
     init_poe_code_command_runner();
     init_errors();
   }
 });
 
+// src/services/config.ts
+import path10 from "node:path";
+async function deleteConfig(options) {
+  const { fs: fs3, filePath } = options;
+  try {
+    await fs3.unlink(filePath);
+    return true;
+  } catch (error2) {
+    if (isNotFound(error2)) {
+      return false;
+    }
+    throw error2;
+  }
+}
+async function loadConfiguredServices(options) {
+  const { fs: fs3, filePath } = options;
+  const document = await readConfigDocument(fs3, filePath);
+  return { ...document.configured_services ?? {} };
+}
+async function saveConfiguredService(options) {
+  const { fs: fs3, filePath, service, metadata } = options;
+  const document = await readConfigDocument(fs3, filePath);
+  const normalized = normalizeConfiguredServiceMetadata(metadata);
+  document.configured_services = {
+    ...document.configured_services ?? {},
+    [service]: normalized
+  };
+  await writeConfigDocument(fs3, filePath, document);
+}
+async function unconfigureService(options) {
+  const { fs: fs3, filePath, service } = options;
+  const document = await readConfigDocument(fs3, filePath);
+  const services = document.configured_services;
+  if (!services || !(service in services)) {
+    return false;
+  }
+  delete services[service];
+  if (Object.keys(services).length === 0) {
+    delete document.configured_services;
+  }
+  await writeConfigDocument(fs3, filePath, document);
+  return true;
+}
+function normalizeConfiguredServiceMetadata(metadata) {
+  const seen = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const entry of metadata.files ?? []) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      continue;
+    }
+    if (!seen.has(entry)) {
+      files.push(entry);
+      seen.add(entry);
+    }
+  }
+  return {
+    files
+  };
+}
+async function readConfigDocument(fs3, filePath) {
+  try {
+    const raw = await fs3.readFile(filePath, "utf8");
+    return await parseConfigDocument(fs3, filePath, raw);
+  } catch (error2) {
+    if (isNotFound(error2)) {
+      return migrateLegacyCredentialsFile(fs3, filePath);
+    }
+    throw error2;
+  }
+}
+async function migrateLegacyCredentialsFile(fs3, configPath) {
+  const legacyPath = path10.join(path10.dirname(configPath), "credentials.json");
+  try {
+    const raw = await fs3.readFile(legacyPath, "utf8");
+    const document = await parseConfigDocument(fs3, legacyPath, raw);
+    await writeConfigDocument(fs3, configPath, document);
+    await fs3.unlink(legacyPath);
+    return document;
+  } catch {
+    return {};
+  }
+}
+async function parseConfigDocument(fs3, filePath, raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return normalizeConfigDocument(parsed);
+  } catch (error2) {
+    if (error2 instanceof SyntaxError) {
+      await recoverInvalidConfig(fs3, filePath, raw);
+      return {};
+    }
+    throw error2;
+  }
+}
+function normalizeConfigDocument(value) {
+  if (!isRecord4(value)) {
+    return {};
+  }
+  const document = {};
+  if (typeof value.apiKey === "string" && value.apiKey.length > 0) {
+    document.apiKey = value.apiKey;
+  }
+  const services = normalizeConfiguredServices(value.configured_services);
+  if (Object.keys(services).length > 0) {
+    document.configured_services = services;
+  }
+  return document;
+}
+function normalizeConfiguredServices(value) {
+  if (!isRecord4(value)) {
+    return {};
+  }
+  const entries = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (!isRecord4(entry)) {
+      continue;
+    }
+    const normalized = normalizeConfiguredServiceMetadata({
+      files: Array.isArray(entry.files) ? entry.files : []
+    });
+    entries[key] = normalized;
+  }
+  return entries;
+}
+async function writeConfigDocument(fs3, filePath, document) {
+  await fs3.mkdir(path10.dirname(filePath), { recursive: true });
+  const payload = {};
+  if (document.apiKey) {
+    payload.apiKey = document.apiKey;
+  }
+  if (document.configured_services) {
+    payload.configured_services = document.configured_services;
+  }
+  await fs3.writeFile(filePath, `${JSON.stringify(payload, null, 2)}
+`, {
+    encoding: "utf8"
+  });
+}
+async function recoverInvalidConfig(fs3, filePath, content) {
+  const backupPath = createInvalidBackupPath(filePath);
+  await fs3.writeFile(backupPath, content, { encoding: "utf8" });
+  await fs3.writeFile(filePath, EMPTY_DOCUMENT, { encoding: "utf8" });
+}
+function createInvalidBackupPath(filePath) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const dir = path10.dirname(filePath);
+  const base = path10.basename(filePath);
+  return path10.join(dir, `${base}.invalid-${timestamp}.json`);
+}
+function isRecord4(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+var EMPTY_DOCUMENT;
+var init_config = __esm({
+  "src/services/config.ts"() {
+    "use strict";
+    init_src2();
+    EMPTY_DOCUMENT = `${JSON.stringify({}, null, 2)}
+`;
+  }
+});
+
 // src/cli/commands/configure.ts
 function registerConfigureCommand(program, container) {
   const serviceNames = container.registry.list().map((service) => service.name);
@@ -6153,7 +6604,7 @@ async function executeConfigure(program, container, service, options) {
     if (!flags.dryRun) {
       await saveConfiguredService({
         fs: container.fs,
-        filePath: providerContext.env.credentialsPath,
+        filePath: providerContext.env.configPath,
         service: canonicalService,
         metadata: {
           files: tracker.files()
@@ -6253,7 +6704,7 @@ var init_configure = __esm({
     "use strict";
     init_shared();
     init_errors();
-    init_credentials2();
+    init_config();
     init_mutation_events();
     init_configure_payload();
     serviceSelectionPrompt = (action) => `Pick an agent to ${action}:`;
@@ -6261,7 +6712,7 @@ var init_configure = __esm({
 });
 
 // src/cli/commands/spawn.ts
-import path10 from "node:path";
+import path11 from "node:path";
 function registerSpawnCommand(program, container, options = {}) {
   const spawnServices = container.registry.list().filter((service) => typeof service.spawn === "function" || getSpawnConfig(service.name)).map((service) => service.name);
   const extraServices = options.extraServices ?? [];
@@ -6393,7 +6844,7 @@ function registerSpawnCommand(program, container, options = {}) {
       if (!proceed) {
         return;
       }
-      const { events, result } = spawn3(canonicalService, {
+      const { events, result } = spawn4(canonicalService, {
         prompt: spawnOptions.prompt,
         args: spawnOptions.args,
         model: spawnOptions.model,
@@ -6440,7 +6891,7 @@ Resume: ${resumeCommand}`));
 async function confirmUnconfiguredService(container, service, label, flags) {
   const configuredServices = await loadConfiguredServices({
     fs: container.fs,
-    filePath: container.env.credentialsPath
+    filePath: container.env.configPath
   });
   if (service in configuredServices) {
     return true;
@@ -6460,10 +6911,10 @@ function resolveSpawnWorkingDirectory2(baseDir, candidate) {
   if (!candidate || candidate.trim().length === 0) {
     return void 0;
   }
-  if (path10.isAbsolute(candidate)) {
+  if (path11.isAbsolute(candidate)) {
     return candidate;
   }
-  return path10.resolve(baseDir, candidate);
+  return path11.resolve(baseDir, candidate);
 }
 function parseMcpSpawnConfig(input) {
   if (!input) {
@@ -6556,9 +7007,9 @@ function isObjectRecord(value) {
 var init_spawn4 = __esm({
   async "src/cli/commands/spawn.ts"() {
     "use strict";
+    init_src5();
     init_src4();
-    init_src3();
-    init_credentials2();
+    init_config();
     init_shared();
     init_spawn_core();
     await init_spawn3();
@@ -6567,7 +7018,7 @@ var init_spawn4 = __esm({
 });
 
 // src/sdk/research.ts
-import path11 from "node:path";
+import path12 from "node:path";
 async function research(container, options) {
   const logger2 = options.logger;
   const source = await resolveSource({
@@ -6577,7 +7028,7 @@ async function research(container, options) {
   });
   const researchPrompt = buildResearchPrompt(options.prompt);
   const mode = options.mode ?? "read";
-  const { events, result } = spawn3(options.agent, {
+  const { events, result } = spawn4(options.agent, {
     prompt: researchPrompt,
     args: options.args ?? [],
     model: options.model,
@@ -6602,7 +7053,7 @@ async function research(container, options) {
         markdown: markdownOutput
       });
       outputPath = buildOutputPath(container.env.homeDir, options.prompt);
-      await ensureDirectory2(container.fs, path11.dirname(outputPath));
+      await ensureDirectory2(container.fs, path12.dirname(outputPath));
       await container.fs.writeFile(outputPath, document, {
         encoding: "utf8"
       });
@@ -6677,7 +7128,7 @@ function buildResearchDocument(input) {
 }
 function buildClonePath(homeDir, github) {
   const slug = extractRepoSlug(github);
-  return path11.join(homeDir, ".poe-code", "repos", slug);
+  return path12.join(homeDir, ".poe-code", "repos", slug);
 }
 function extractRepoSlug(value) {
   const trimmed = value.trim();
@@ -6715,7 +7166,7 @@ function extractRepoSlug(value) {
 function buildOutputPath(homeDir, prompt, now = /* @__PURE__ */ new Date()) {
   const timestamp = formatTimestamp(now);
   const slug = buildSlug(prompt);
-  return path11.join(
+  return path12.join(
     homeDir,
     ".poe-code",
     "research",
@@ -6736,7 +7187,7 @@ async function resolveSource(input) {
   if (options.github) {
     const cloneUrl = resolveGithubCloneUrl(options.github);
     const clonePath = buildClonePath(container.env.homeDir, options.github);
-    await ensureDirectory2(container.fs, path11.dirname(clonePath));
+    await ensureDirectory2(container.fs, path12.dirname(clonePath));
     const exists = await pathExists2(container.fs, clonePath);
     if (!exists) {
       const cloneResult = await container.commandRunner(
@@ -6834,10 +7285,10 @@ function formatYamlString(value) {
   return JSON.stringify(value);
 }
 function resolvePath2(baseDir, candidate) {
-  if (path11.isAbsolute(candidate)) {
+  if (path12.isAbsolute(candidate)) {
     return candidate;
   }
-  return path11.resolve(baseDir, candidate);
+  return path12.resolve(baseDir, candidate);
 }
 function teeAcpStream(events) {
   const chunks = [];
@@ -6897,7 +7348,7 @@ async function removePathFallback(fs3, target) {
   if (stats && typeof stats.isDirectory === "function" && stats.isDirectory()) {
     const entries = await fs3.readdir(target);
     for (const entry of entries) {
-      await removePathFallback(fs3, path11.join(target, entry));
+      await removePathFallback(fs3, path12.join(target, entry));
     }
   }
   try {
@@ -7001,7 +7452,7 @@ async function resolveResearchAgent(input) {
   if (input.flags.assumeYes) {
     const configured = await loadConfiguredServices({
       fs: input.container.fs,
-      filePath: input.container.env.credentialsPath
+      filePath: input.container.env.configPath
     });
     const configuredService = spawnable.find(
       (service) => service.name in configured
@@ -7063,8 +7514,8 @@ async function resolveResearchModel(input) {
 var init_research2 = __esm({
   async "src/cli/commands/research.ts"() {
     "use strict";
-    init_src4();
-    init_credentials2();
+    init_src5();
+    init_config();
     await init_research();
     init_errors();
     init_shared();
@@ -7072,13 +7523,13 @@ var init_research2 = __esm({
 });
 
 // src/cli/isolated-env-runner.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 async function isolatedEnvRunner(input) {
   const details = await resolveIsolatedEnvDetails(
     input.env,
     input.isolated,
     input.providerName,
-    input.fs
+    input.readApiKey
   );
   let args = input.argv.slice(2);
   if (input.isolated.requiresConfig !== false) {
@@ -7093,11 +7544,11 @@ async function isolatedEnvRunner(input) {
     const resolvedSettings = await resolveCliSettings(
       input.isolated.cliSettings,
       input.env,
-      input.fs
+      input.readApiKey
     );
     args = buildArgsWithMergedSettings(args, resolvedSettings);
   }
-  const child = spawn4(details.agentBinary, args, {
+  const child = spawn5(details.agentBinary, args, {
     stdio: "inherit",
     env: {
       ...process.env,
@@ -7130,7 +7581,7 @@ async function configExists(fs3, filePath) {
 var init_isolated_env_runner = __esm({
   "src/cli/isolated-env-runner.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     init_isolated_env();
     init_cli_settings_merge();
   }
@@ -7180,6 +7631,7 @@ function registerWrapCommand(program, container) {
     await isolatedEnvRunner({
       env: container.env,
       fs: container.fs,
+      readApiKey: container.readApiKey,
       providerName: adapter.name,
       isolated,
       argv: ["node", "poe-code", ...forwarded]
@@ -7199,46 +7651,66 @@ var init_wrap = __esm({
 // src/cli/commands/login.ts
 function registerLoginCommand(program, container) {
   program.command("login").description("Store a Poe API key for reuse across commands.").option("--api-key <key>", "Poe API key").action(async (options) => {
-    const flags = resolveCommandFlags(program);
-    const resources = createExecutionResources(
+    await executeLogin(program, container, options);
+  });
+}
+async function executeLogin(program, container, options) {
+  const flags = resolveCommandFlags(program);
+  const resources = createExecutionResources(
+    container,
+    flags,
+    "login"
+  );
+  resources.logger.intro("login");
+  try {
+    const input = await resolveApiKeyInput(container, options);
+    const normalized = container.options.normalizeApiKey(input);
+    const configuredServices = await loadConfiguredServices({
+      fs: container.fs,
+      filePath: container.env.configPath
+    });
+    if (!flags.dryRun) {
+      await container.writeApiKey(normalized);
+    }
+    await reconfigureServices({
+      program,
       container,
-      flags,
-      "login"
-    );
-    resources.logger.intro("login");
-    try {
-      const configuredServices = await loadConfiguredServices({
-        fs: container.fs,
-        filePath: container.env.credentialsPath
-      });
-      const apiKey = await container.options.resolveApiKey({
-        value: options.apiKey,
-        envValue: container.env.getVariable("POE_API_KEY"),
-        dryRun: flags.dryRun,
-        assumeYes: flags.assumeYes,
-        allowStored: false
-      });
-      await reconfigureServices({
-        program,
-        container,
-        apiKey,
-        configuredServices
-      });
-      resources.context.complete({
-        success: "Logged in.",
-        dry: "Dry run: would save API key."
+      apiKey: normalized,
+      configuredServices
+    });
+    resources.context.complete({
+      success: "Logged in.",
+      dry: "Dry run: would save API key."
+    });
+    resources.context.finalize();
+  } catch (error2) {
+    if (error2 instanceof Error) {
+      resources.logger.logException(error2, "login command", {
+        operation: "login",
+        configPath: container.env.configPath
       });
-      resources.context.finalize();
-    } catch (error2) {
-      if (error2 instanceof Error) {
-        resources.logger.logException(error2, "login command", {
-          operation: "login",
-          credentialsPath: container.env.credentialsPath
-        });
-      }
-      throw error2;
     }
-  });
+    throw error2;
+  }
+}
+async function resolveApiKeyInput(container, options) {
+  if (options.apiKey) {
+    return options.apiKey;
+  }
+  const envKey = container.env.getVariable("POE_API_KEY");
+  if (envKey && envKey.trim().length > 0) {
+    return envKey;
+  }
+  const descriptor = container.promptLibrary.loginApiKey();
+  const response = await container.prompts(descriptor);
+  const value = response[descriptor.name];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new ValidationError("POE API key is required.", {
+      operation: "login",
+      field: "apiKey"
+    });
+  }
+  return value;
 }
 async function reconfigureServices(input) {
   const { program, container, apiKey, configuredServices } = input;
@@ -7292,7 +7764,8 @@ var init_login = __esm({
   "src/cli/commands/login.ts"() {
     "use strict";
     init_shared();
-    init_credentials2();
+    init_config();
+    init_errors();
     init_mutation_events();
   }
 });
@@ -7372,7 +7845,7 @@ async function executeUnconfigure(program, container, service, options) {
   if (!flags.dryRun) {
     await unconfigureService({
       fs: container.fs,
-      filePath: providerContext.env.credentialsPath,
+      filePath: providerContext.env.configPath,
       service: canonicalService
     });
   }
@@ -7417,7 +7890,7 @@ function formatUnconfigureMessages(service, label, unconfigured, _payload) {
 var init_unconfigure = __esm({
   "src/cli/commands/unconfigure.ts"() {
     "use strict";
-    init_credentials2();
+    init_config();
     init_mutation_events();
     init_isolated_env();
     init_shared();
@@ -7426,53 +7899,157 @@ var init_unconfigure = __esm({
 
 // src/cli/commands/logout.ts
 function registerLogoutCommand(program, container) {
-  program.command("logout").description("Remove all Poe API configuration and stored credentials.").action(async () => {
-    const flags = resolveCommandFlags(program);
-    const resources = createExecutionResources(
-      container,
-      flags,
-      "logout"
-    );
-    resources.logger.intro("logout");
-    const configuredServices = await loadConfiguredServices({
-      fs: container.fs,
-      filePath: container.env.credentialsPath
-    });
-    for (const serviceName of Object.keys(configuredServices)) {
-      const adapter = container.registry.get(serviceName);
-      if (!adapter) {
-        continue;
-      }
-      await executeUnconfigure(program, container, serviceName, {});
-    }
-    if (flags.dryRun) {
-      resources.context.complete({
-        success: "Logged out.",
-        dry: `Dry run: would delete credentials at ${container.env.credentialsPath}.`
-      });
-      resources.context.finalize();
-      return;
+  program.command("logout").description("Remove all Poe API configuration.").action(async () => {
+    await executeLogout(program, container);
+  });
+}
+async function executeLogout(program, container) {
+  const flags = resolveCommandFlags(program);
+  const resources = createExecutionResources(
+    container,
+    flags,
+    "logout"
+  );
+  resources.logger.intro("logout");
+  const configuredServices = await loadConfiguredServices({
+    fs: container.fs,
+    filePath: container.env.configPath
+  });
+  for (const serviceName of Object.keys(configuredServices)) {
+    const adapter = container.registry.get(serviceName);
+    if (!adapter) {
+      continue;
     }
-    const deleted = await deleteCredentials({
-      fs: container.fs,
-      filePath: container.env.credentialsPath
-    });
+    await executeUnconfigure(program, container, serviceName, {});
+  }
+  if (flags.dryRun) {
     resources.context.complete({
-      success: deleted ? "Logged out." : "Already logged out.",
-      dry: `Dry run: would delete credentials at ${container.env.credentialsPath}.`
+      success: "Logged out.",
+      dry: `Dry run: would delete config at ${container.env.configPath}.`
     });
     resources.context.finalize();
+    return;
+  }
+  const deleted = await deleteConfig({
+    fs: container.fs,
+    filePath: container.env.configPath
+  });
+  resources.context.complete({
+    success: deleted ? "Logged out." : "Already logged out.",
+    dry: `Dry run: would delete config at ${container.env.configPath}.`
   });
+  resources.context.finalize();
 }
 var init_logout = __esm({
   "src/cli/commands/logout.ts"() {
     "use strict";
-    init_credentials2();
+    init_config();
     init_shared();
     init_unconfigure();
   }
 });
 
+// src/cli/commands/auth.ts
+function registerAuthCommand(program, container) {
+  const auth = program.command("auth").description("Authentication and account commands.").action(async () => {
+    await executeStatus(program, container);
+  });
+  auth.command("status").description("Show login, balance, and configuration status.").action(async () => {
+    await executeStatus(program, container);
+  });
+  auth.command("api_key").description("Display stored API key.").action(async () => {
+    await executeApiKey(program, container);
+  });
+  auth.command("login").description("Store a Poe API key.").option("--api-key <key>", "Poe API key").action(async (options) => {
+    await executeLogin(program, container, options);
+  });
+  auth.command("logout").description("Remove all configuration and credentials.").action(async () => {
+    await executeLogout(program, container);
+  });
+}
+async function executeStatus(program, container) {
+  const flags = resolveCommandFlags(program);
+  const resources = createExecutionResources(container, flags, "auth:status");
+  resources.logger.intro("auth status");
+  try {
+    const apiKey = await container.readApiKey();
+    const loggedIn = Boolean(apiKey);
+    resources.logger.info(loggedIn ? "Logged in" : "Not logged in");
+    if (loggedIn) {
+      if (flags.dryRun) {
+        resources.logger.dryRun(
+          "Dry run: would fetch usage balance from Poe API."
+        );
+      } else {
+        const response = await container.httpClient(
+          `${container.env.poeBaseUrl}/usage/current_balance`,
+          {
+            method: "GET",
+            headers: {
+              Authorization: `Bearer ${apiKey}`
+            }
+          }
+        );
+        if (!response.ok) {
+          throw new ApiError(
+            `Failed to fetch usage balance (HTTP ${response.status})`,
+            {
+              httpStatus: response.status,
+              endpoint: "/usage/current_balance"
+            }
+          );
+        }
+        const data = await response.json();
+        const formattedBalance = data.current_point_balance.toLocaleString(
+          "en-US"
+        );
+        resources.logger.info(`Current balance: ${formattedBalance} points`);
+      }
+    }
+    const configuredServices = await loadConfiguredServices({
+      fs: container.fs,
+      filePath: container.env.configPath
+    });
+    const configuredAgentNames = Object.keys(configuredServices).sort();
+    if (configuredAgentNames.length === 0) {
+      resources.logger.info("No agents configured.");
+    } else {
+      resources.logger.info(
+        `Configured agents: ${configuredAgentNames.join(", ")}`
+      );
+    }
+    resources.context.finalize();
+  } catch (error2) {
+    if (error2 instanceof Error) {
+      resources.logger.logException(error2, "auth status", {
+        operation: "auth-status"
+      });
+    }
+    throw error2;
+  }
+}
+async function executeApiKey(program, container) {
+  const flags = resolveCommandFlags(program);
+  const resources = createExecutionResources(container, flags, "auth:api_key");
+  resources.logger.intro("auth api_key");
+  const apiKey = await container.readApiKey();
+  if (!apiKey) {
+    resources.logger.info("No API key stored.");
+    return;
+  }
+  resources.logger.info(`API key: ${apiKey}`);
+}
+var init_auth = __esm({
+  "src/cli/commands/auth.ts"() {
+    "use strict";
+    init_errors();
+    init_config();
+    init_shared();
+    init_login();
+    init_logout();
+  }
+});
+
 // src/cli/commands/install.ts
 function registerInstallCommand(program, container) {
   const serviceNames = container.registry.list().filter((service) => typeof service.install === "function").map((service) => service.name);
@@ -7567,7 +8144,7 @@ async function executeTest(program, container, service, options = {}) {
     container.env,
     adapter.isolatedEnv,
     adapter.name,
-    container.fs
+    container.readApiKey
   ) : null;
   if (options.isolated && adapter.isolatedEnv) {
     const { ensureIsolatedConfigForService: ensureIsolatedConfigForService2 } = await Promise.resolve().then(() => (init_ensure_isolated_config(), ensure_isolated_config_exports));
@@ -7616,7 +8193,7 @@ var init_test = __esm({
     init_shared();
     init_configure();
     init_isolated_env();
-    init_src3();
+    init_src4();
   }
 });
 
@@ -7669,7 +8246,7 @@ var init_media_download = __esm({
 });
 
 // src/cli/commands/generate.ts
-import path12 from "node:path";
+import path13 from "node:path";
 function registerGenerateCommand(program, container) {
   const generate2 = program.command("generate").description("Generate content via Poe API").option("--model <model>", `Model identifier (default: ${DEFAULT_TEXT_MODEL})`).option(
     "--param <key=value>",
@@ -7848,10 +8425,13 @@ async function resolveClient2(container) {
   try {
     return getGlobalClient();
   } catch {
+    const apiKey = await container.readApiKey();
+    if (!apiKey) {
+      throw new Error("Poe API key not found. Run 'poe-code login' first.");
+    }
     const apiBaseUrl = resolveApiBaseUrl(container);
     await initializeClient({
-      fs: container.fs,
-      credentialsPath: container.env.credentialsPath,
+      apiKey,
       baseUrl: apiBaseUrl,
       httpClient: container.httpClient
     });
@@ -7932,11 +8512,11 @@ function getDefaultMimeType(type) {
   return defaults[type];
 }
 function resolveOutputPath(filename, cwd) {
-  if (path12.isAbsolute(filename)) {
+  if (path13.isAbsolute(filename)) {
     return { path: filename, label: filename };
   }
   return {
-    path: path12.join(cwd, filename),
+    path: path13.join(cwd, filename),
     label: `./${filename}`
   };
 }
@@ -7944,7 +8524,7 @@ var MODEL_ENV_KEYS2, DEFAULT_MODELS2;
 var init_generate = __esm({
   "src/cli/commands/generate.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_constants();
     init_shared();
     init_client_instance();
@@ -9040,8 +9620,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path20, errorMaps, issueData } = params;
-      const fullPath = [...path20, ...issueData.path || []];
+      const { data, path: path21, errorMaps, issueData } = params;
+      const fullPath = [...path21, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -9321,11 +9901,11 @@ var init_types3 = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path20, key) {
+      constructor(parent, value, path21, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path20;
+        this._path = path21;
         this._key = key;
       }
       get path() {
@@ -12829,10 +13409,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path20) {
-  if (!path20)
+function getElementAtPath(obj, path21) {
+  if (!path21)
     return obj;
-  return path20.reduce((acc, key) => acc?.[key], obj);
+  return path21.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -13144,11 +13724,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path20, issues) {
+function prefixIssues(path21, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path20);
+    iss.path.unshift(path21);
     return iss;
   });
 }
@@ -13524,7 +14104,7 @@ __export(regexes_exports, {
   extendedDuration: () => extendedDuration,
   guid: () => guid,
   hex: () => hex,
-  hostname: () => hostname,
+  hostname: () => hostname2,
   html5Email: () => html5Email,
   idnEmail: () => idnEmail,
   integer: () => integer,
@@ -13591,7 +14171,7 @@ function fixedBase64(bodyLength, padding) {
 function fixedBase64url(length) {
   return new RegExp(`^[A-Za-z0-9_-]{${length}}$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname2, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
 var init_regexes = __esm({
   "node_modules/zod/v4/core/regexes.js"() {
     init_util2();
@@ -13629,7 +14209,7 @@ var init_regexes = __esm({
     cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
     base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
     base64url = /^[A-Za-z0-9_-]*$/;
-    hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+    hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
     domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
     e164 = /^\+[1-9]\d{6,14}$/;
     dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
@@ -18835,7 +19415,7 @@ __export(schemas_exports3, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   instanceof: () => _instanceof,
   int: () => int,
@@ -18982,7 +19562,7 @@ function jwt(params) {
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname2(_params) {
+function hostname3(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
 }
 function hex2(_params) {
@@ -25106,8 +25686,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path20) {
-      let input = path20;
+    function removeDotSegments(path21) {
+      let input = path21;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -25306,8 +25886,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path20, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path20 && path20 !== "/" ? path20 : void 0;
+        const [path21, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path21 && path21 !== "/" ? path21 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -34421,7 +35001,7 @@ var init_content = __esm({
 });
 
 // packages/tiny-stdio-mcp-server/src/index.ts
-var init_src5 = __esm({
+var init_src6 = __esm({
   "packages/tiny-stdio-mcp-server/src/index.ts"() {
     "use strict";
     init_server();
@@ -34725,7 +35305,7 @@ var generateTextSchema, generateImageSchema, generateVideoSchema, generateAudioS
 var init_mcp_server = __esm({
   "src/cli/mcp-server.ts"() {
     "use strict";
-    init_src5();
+    init_src6();
     init_client_instance();
     init_constants();
     generateTextSchema = defineSchema({
@@ -34983,7 +35563,7 @@ ${panel.footer}`);
 var init_command_not_found = __esm({
   "src/cli/command-not-found.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_execution_context();
     init_errors();
   }
@@ -35008,7 +35588,7 @@ function getAgentConfig(agentId) {
   const support = resolveAgentSupport(agentId);
   return support.status === "supported" ? support.config : void 0;
 }
-function resolveConfigPath(config2, platform) {
+function resolveConfigPath2(config2, platform) {
   if (typeof config2.configFile === "function") {
     return config2.configFile(platform);
   }
@@ -35018,7 +35598,7 @@ var agentMcpConfigs, supportedAgents;
 var init_configs2 = __esm({
   "packages/agent-mcp-config/src/configs.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     agentMcpConfigs = {
       "claude-code": {
         configFile: "~/.claude.json",
@@ -35131,9 +35711,9 @@ var init_shapes = __esm({
 });
 
 // packages/agent-mcp-config/src/apply.ts
-import path13 from "node:path";
+import path14 from "node:path";
 function getConfigDirectory(configPath) {
-  return path13.dirname(configPath);
+  return path14.dirname(configPath);
 }
 function isConfigObject5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -35150,7 +35730,7 @@ async function configure(agentId, server, options) {
     throw new UnsupportedAgentError(agentId);
   }
   const config2 = getAgentConfig(agentId);
-  const configPath = resolveConfigPath(config2, options.platform);
+  const configPath = resolveConfigPath2(config2, options.platform);
   const shapeTransformer = getShapeTransformer(config2.shape);
   const shaped = shapeTransformer(server);
   if (shaped === void 0) {
@@ -35196,7 +35776,7 @@ async function unconfigure(agentId, serverName, options) {
     throw new UnsupportedAgentError(agentId);
   }
   const config2 = getAgentConfig(agentId);
-  const configPath = resolveConfigPath(config2, options.platform);
+  const configPath = resolveConfigPath2(config2, options.platform);
   await runMutations(
     [
       configMutation.prune({
@@ -35222,7 +35802,7 @@ var UnsupportedAgentError;
 var init_apply = __esm({
   "packages/agent-mcp-config/src/apply.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     init_configs2();
     init_shapes();
     UnsupportedAgentError = class extends Error {
@@ -35235,7 +35815,7 @@ var init_apply = __esm({
 });
 
 // packages/agent-mcp-config/src/index.ts
-var init_src6 = __esm({
+var init_src7 = __esm({
   "packages/agent-mcp-config/src/index.ts"() {
     "use strict";
     init_configs2();
@@ -35293,10 +35873,7 @@ function registerMcpCommand(program, container) {
   mcp.command("configure [agent]").description("Configure MCP client to use poe-code").option("-y, --yes", "Skip prompt, use claude-code").action(async (agentArg, options) => {
     const flags = resolveCommandFlags(program);
     const resources = createExecutionResources(container, flags, "mcp");
-    const existingKey = await loadCredentials({
-      fs: container.fs,
-      filePath: container.env.credentialsPath
-    });
+    const existingKey = await container.readApiKey();
     if (!existingKey) {
       resources.logger.intro("login");
       await container.options.resolveApiKey({ dryRun: flags.dryRun });
@@ -35396,17 +35973,13 @@ async function runMcpServer(container, options) {
   const outputFormatPreferences = parseMcpOutputFormatPreferences(
     options.outputFormat
   );
-  const apiKey = await loadCredentials({
-    fs: container.fs,
-    filePath: container.env.credentialsPath
-  });
+  const apiKey = await container.readApiKey();
   if (!apiKey) {
-    process.stderr.write("No credentials found. Run 'poe-code login' first.\n");
+    process.stderr.write("No API key found. Run 'poe-code login' first.\n");
     process.exit(1);
   }
   await initializeClient({
-    fs: container.fs,
-    credentialsPath: container.env.credentialsPath,
+    apiKey,
     baseUrl: container.env.poeApiBaseUrl,
     httpClient: container.httpClient
   });
@@ -35416,22 +35989,21 @@ var DEFAULT_MCP_AGENT;
 var init_mcp2 = __esm({
   "src/cli/commands/mcp.ts"() {
     "use strict";
-    init_src3();
-    init_credentials2();
+    init_src4();
     init_client_instance();
     init_mcp_server();
     init_shared();
     init_mcp_output_format();
     init_command_not_found();
-    init_src6();
+    init_src7();
     init_execution_context();
     DEFAULT_MCP_AGENT = "claude-code";
   }
 });
 
 // packages/agent-skill-config/src/configs.ts
-import os3 from "node:os";
-import path14 from "node:path";
+import os2 from "node:os";
+import path15 from "node:path";
 function resolveAgentSupport2(input, registry2 = agentSkillConfigs) {
   const resolvedId = resolveAgentId(input);
   if (!resolvedId) {
@@ -35447,7 +36019,7 @@ var agentSkillConfigs, supportedAgents2;
 var init_configs3 = __esm({
   "packages/agent-skill-config/src/configs.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     agentSkillConfigs = {
       "claude-code": {
         globalSkillDir: "~/.claude/skills",
@@ -35467,7 +36039,7 @@ var init_configs3 = __esm({
 });
 
 // packages/agent-skill-config/src/templates.ts
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile2 } from "node:fs/promises";
 async function getTemplates() {
   if (templatesCache) {
     return templatesCache;
@@ -35476,7 +36048,7 @@ async function getTemplates() {
     "./templates/poe-generate.md",
     import.meta.url
   );
-  const poeGenerateTemplate = await readFile3(poeGenerateTemplateUrl, "utf8");
+  const poeGenerateTemplate = await readFile2(poeGenerateTemplateUrl, "utf8");
   templatesCache = {
     "poe-generate.md": poeGenerateTemplate
   };
@@ -35608,7 +36180,7 @@ var UnsupportedAgentError2, bundledSkillTemplateIds, SKILL_TEMPLATE_ID;
 var init_apply2 = __esm({
   "packages/agent-skill-config/src/apply.ts"() {
     "use strict";
-    init_src();
+    init_src2();
     init_configs3();
     init_templates();
     UnsupportedAgentError2 = class extends Error {
@@ -35623,7 +36195,7 @@ var init_apply2 = __esm({
 });
 
 // packages/agent-skill-config/src/index.ts
-var init_src7 = __esm({
+var init_src8 = __esm({
   "packages/agent-skill-config/src/index.ts"() {
     "use strict";
     init_configs3();
@@ -35847,8 +36419,8 @@ var DEFAULT_SKILL_AGENT;
 var init_skill = __esm({
   "src/cli/commands/skill.ts"() {
     "use strict";
-    init_src3();
-    init_src7();
+    init_src4();
+    init_src8();
     init_shared();
     init_command_not_found();
     DEFAULT_SKILL_AGENT = "claude-code";
@@ -35938,7 +36510,7 @@ async function displayVersion(container, currentVersion) {
 var init_version2 = __esm({
   "src/cli/commands/version.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_version();
     init_exit_signals();
   }
@@ -36063,10 +36635,10 @@ var init_registry2 = __esm({
 });
 
 // packages/worktree/src/create.ts
-import { join as join2 } from "node:path";
+import { join } from "node:path";
 async function createWorktree(opts) {
   const branch = `poe-code/${opts.name}`;
-  const worktreePath = join2(opts.worktreeDir, opts.name);
+  const worktreePath = join(opts.worktreeDir, opts.name);
   try {
     await opts.deps.exec(`git worktree remove ${worktreePath} --force`, { cwd: opts.cwd });
   } catch {
@@ -36141,7 +36713,7 @@ var init_list = __esm({
 });
 
 // packages/worktree/src/index.ts
-var init_src8 = __esm({
+var init_src9 = __esm({
   "packages/worktree/src/index.ts"() {
     "use strict";
     init_create();
@@ -36230,13 +36802,13 @@ function getDirtyFiles(cwd) {
   for (const line of lines) {
     if (!line) continue;
     if (line.length < 4) continue;
-    let path20 = line.slice(3).trim();
+    let path21 = line.slice(3).trim();
     const renameArrow = " -> ";
-    const arrowIndex = path20.lastIndexOf(renameArrow);
+    const arrowIndex = path21.lastIndexOf(renameArrow);
     if (arrowIndex >= 0) {
-      path20 = path20.slice(arrowIndex + renameArrow.length).trim();
+      path21 = path21.slice(arrowIndex + renameArrow.length).trim();
     }
-    if (path20) files.push(path20);
+    if (path21) files.push(path21);
   }
   return files;
 }
@@ -36248,7 +36820,7 @@ var init_utils2 = __esm({
 
 // packages/ralph/src/plan/parser.ts
 import { parse as parse7 } from "yaml";
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asOptionalString(value, field) {
@@ -36299,7 +36871,7 @@ function normalizeStatus(value) {
   );
 }
 function parseStory(value, index) {
-  if (!isRecord3(value)) throw new Error(`Invalid stories[${index}]: expected object`);
+  if (!isRecord5(value)) throw new Error(`Invalid stories[${index}]: expected object`);
   return {
     id: asRequiredString(value.id, `stories[${index}].id`),
     title: asRequiredString(value.title, `stories[${index}].title`),
@@ -36323,7 +36895,7 @@ function parsePlan(yamlContent) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     throw new Error(`Invalid plan YAML: ${message}`, { cause: error2 });
   }
-  if (!isRecord3(doc)) {
+  if (!isRecord5(doc)) {
     throw new Error("Invalid plan YAML: expected top-level object");
   }
   const storiesValue = doc.stories;
@@ -36389,17 +36961,17 @@ function serializePlan(prd) {
   return yaml.endsWith("\n") ? yaml : `${yaml}
 `;
 }
-function lockPlanFile(path20) {
-  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile(path21) {
+  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
-async function writePlan(path20, prd, options = {}) {
+async function writePlan(path21, prd, options = {}) {
   const fs3 = options.fs ?? fsPromises2;
   const lock = options.lock ?? lockPlanFile;
-  await fs3.mkdir(dirname3(path20), { recursive: true });
-  const release = await lock(path20);
+  await fs3.mkdir(dirname3(path21), { recursive: true });
+  const release = await lock(path21);
   try {
     const yaml = serializePlan(prd);
-    await fs3.writeFile(path20, yaml, { encoding: "utf8" });
+    await fs3.writeFile(path21, yaml, { encoding: "utf8" });
   } finally {
     await release();
   }
@@ -36418,7 +36990,7 @@ function renderPrompt(template, variables) {
 var init_renderer2 = __esm({
   "packages/ralph/src/prompt/renderer.ts"() {
     "use strict";
-    init_src();
+    init_src2();
   }
 });
 
@@ -36487,8 +37059,8 @@ var init_selector = __esm({
 // packages/ralph/src/story/updater.ts
 import { dirname as dirname4 } from "node:path";
 import * as fsPromises3 from "node:fs/promises";
-function lockPlanFile2(path20) {
-  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile2(path21) {
+  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
 function assertStoryStatus(value) {
   if (value === "open") return;
@@ -36569,9 +37141,9 @@ function appendSection(lines, title, items, options) {
   }
   lines.push("");
 }
-async function writeRunMeta(path20, metadata, options = {}) {
+async function writeRunMeta(path21, metadata, options = {}) {
   const fs3 = options.fs ?? fsPromises4;
-  await fs3.mkdir(dirname5(path20), { recursive: true });
+  await fs3.mkdir(dirname5(path21), { recursive: true });
   const lines = [];
   lines.push("# Ralph Run Summary", "");
   lines.push(`- Run ID: ${metadata.runId}`);
@@ -36600,7 +37172,7 @@ async function writeRunMeta(path20, metadata, options = {}) {
   const git = metadata.git ?? null;
   if (!git) {
     lines.push("");
-    await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
+    await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
     return;
   }
   lines.push("", "## Git");
@@ -36615,7 +37187,7 @@ async function writeRunMeta(path20, metadata, options = {}) {
     lines.push("");
   } else {
     lines.push("");
-    await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
+    await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
     return;
   }
   if (git.commits !== void 0 && git.commits !== null) {
@@ -36635,7 +37207,7 @@ async function writeRunMeta(path20, metadata, options = {}) {
   appendSection(lines, "### Uncommitted Changes", git.dirtyFiles, {
     emptyLabel: "(none)"
   });
-  await fs3.writeFile(path20, lines.join("\n"), { encoding: "utf8" });
+  await fs3.writeFile(path21, lines.join("\n"), { encoding: "utf8" });
 }
 var init_metadata = __esm({
   "packages/ralph/src/run/metadata.ts"() {
@@ -36723,9 +37295,9 @@ async function defaultStreamingSpawn(agentId, options) {
     exitCode: result.exitCode
   };
 }
-function absPath(cwd, path20) {
-  if (!path20) return resolvePath3(cwd);
-  return path20.startsWith("/") ? path20 : resolvePath3(cwd, path20);
+function absPath(cwd, path21) {
+  if (!path21) return resolvePath3(cwd);
+  return path21.startsWith("/") ? path21 : resolvePath3(cwd, path21);
 }
 function pad2(value) {
   return value < 10 ? `0${value}` : String(value);
@@ -36775,8 +37347,8 @@ async function appendToErrorsLog(fs3, errorsLogPath, message) {
   await fs3.mkdir(dirname6(errorsLogPath), { recursive: true });
   await fs3.writeFile(errorsLogPath, `${previous}${next}`, { encoding: "utf8" });
 }
-function lockPlanFile3(path20) {
-  return lockFile(path20, { retries: 20, minTimeout: 25, maxTimeout: 250 });
+function lockPlanFile3(path21) {
+  return lockFile(path21, { retries: 20, minTimeout: 25, maxTimeout: 250 });
 }
 function getCurrentBranch(cwd) {
   try {
@@ -36878,7 +37450,7 @@ async function defaultPromptOverbake(args) {
 async function buildLoop(options) {
   const fs3 = options.deps?.fs ?? fsPromises5;
   const lock = options.deps?.lock ?? lockPlanFile3;
-  const spawn5 = options.deps?.spawn ?? defaultStreamingSpawn;
+  const spawn6 = options.deps?.spawn ?? defaultStreamingSpawn;
   const git = options.deps?.git ?? {
     getHead,
     getCommitList,
@@ -36932,7 +37504,7 @@ async function buildLoop(options) {
       });
       worktreeBranch = entry.branch;
       const worktreePath = entry.path;
-      const symlinkFn = fs3.symlink ?? ((target, path20) => fsPromises5.symlink(target, path20));
+      const symlinkFn = fs3.symlink ?? ((target, path21) => fsPromises5.symlink(target, path21));
       const exec = worktreeDeps.exec;
       const dirsToLink = [".poe-code-ralph", ".agents/poe-code-ralph"];
       for (const dir of dirsToLink) {
@@ -37047,7 +37619,7 @@ async function buildLoop(options) {
     let stderrForErrorsLog;
     let overbakeAction = null;
     try {
-      const result = await spawn5(options.agent, {
+      const result = await spawn6(options.agent, {
         prompt,
         cwd,
         model: options.model,
@@ -37220,10 +37792,10 @@ var init_loop = __esm({
   "packages/ralph/src/build/loop.ts"() {
     "use strict";
     init_lock();
+    init_src5();
     init_src4();
-    init_src3();
-    init_src();
-    init_src8();
+    init_src2();
+    init_src9();
     init_detector();
     init_utils2();
     init_parser();
@@ -37237,18 +37809,18 @@ var init_loop = __esm({
 });
 
 // packages/ralph/src/plan/resolver.ts
-import path15 from "node:path";
+import path16 from "node:path";
 import * as fsPromises6 from "node:fs/promises";
 function isPlanCandidateFile(fileName) {
   const lower = fileName.toLowerCase();
   if (!lower.startsWith("plan")) {
     return false;
   }
-  const ext = path15.extname(lower);
+  const ext = path16.extname(lower);
   return ext === ".yml" || ext === ".yaml";
 }
 async function listPlanCandidates(fs3, cwd) {
-  const plansDir = path15.join(cwd, ".agents", "poe-code-ralph", "plans");
+  const plansDir = path16.join(cwd, ".agents", "poe-code-ralph", "plans");
   let entries;
   try {
     entries = await fs3.readdir(plansDir);
@@ -37263,12 +37835,12 @@ async function listPlanCandidates(fs3, cwd) {
     if (!isPlanCandidateFile(entry)) {
       continue;
     }
-    const absPath2 = path15.join(plansDir, entry);
+    const absPath2 = path16.join(plansDir, entry);
     const stats = await fs3.stat(absPath2);
     if (!stats.isFile()) {
       continue;
     }
-    const relativePath = path15.relative(cwd, absPath2);
+    const relativePath = path16.relative(cwd, absPath2);
     const content = await fs3.readFile(absPath2, "utf8");
     const plan = parsePlan(content);
     const done = plan.stories.filter((s) => s.status === "done").length;
@@ -37287,7 +37859,7 @@ async function resolvePlanPath(options) {
   const cwd = options.cwd;
   const provided = options.plan?.trim();
   if (provided) {
-    const absPath2 = path15.isAbsolute(provided) ? provided : path15.resolve(cwd, provided);
+    const absPath2 = path16.isAbsolute(provided) ? provided : path16.resolve(cwd, provided);
     try {
       const stats = await fs3.stat(absPath2);
       if (!stats.isFile()) {
@@ -37336,21 +37908,21 @@ async function resolvePlanPath(options) {
 var init_resolver = __esm({
   "packages/ralph/src/plan/resolver.ts"() {
     "use strict";
-    init_src3();
-    init_src();
+    init_src4();
+    init_src2();
     init_parser();
   }
 });
 
 // packages/ralph/src/plan/generator.ts
-import path16 from "node:path";
+import path17 from "node:path";
 import * as fsPromises7 from "node:fs/promises";
 var PLAN_PROMPT_TEMPLATE;
 var init_generator = __esm({
   "packages/ralph/src/plan/generator.ts"() {
     "use strict";
-    init_src4();
-    init_src();
+    init_src5();
+    init_src2();
     init_renderer2();
     PLAN_PROMPT_TEMPLATE = [
       "# Plan",
@@ -37412,27 +37984,27 @@ function formatTimestamp3(date4) {
   const seconds = pad22(date4.getSeconds());
   return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
 }
-function validateLogPath(path20) {
-  if (typeof path20 !== "string" || path20.trim().length === 0) {
+function validateLogPath(path21) {
+  if (typeof path21 !== "string" || path21.trim().length === 0) {
     throw new Error(
-      `Invalid activity log path: expected a non-empty string, got ${String(path20)}`
+      `Invalid activity log path: expected a non-empty string, got ${String(path21)}`
     );
   }
-  if (path20.includes("\0")) {
+  if (path21.includes("\0")) {
     throw new Error("Invalid activity log path: contains null byte");
   }
 }
-async function logActivity(path20, message, options = {}) {
-  validateLogPath(path20);
+async function logActivity(path21, message, options = {}) {
+  validateLogPath(path21);
   const fs3 = options.fs ?? fsPromises8;
-  const parent = dirname7(path20);
+  const parent = dirname7(path21);
   if (parent && parent !== ".") {
     await fs3.mkdir(parent, { recursive: true });
   }
   const entry = `[${formatTimestamp3(/* @__PURE__ */ new Date())}] ${message}
 `;
   try {
-    await fs3.appendFile(path20, entry, { encoding: "utf8" });
+    await fs3.appendFile(path21, entry, { encoding: "utf8" });
   } catch (error2) {
     const detail = error2 instanceof Error ? error2.message : `Unknown error: ${String(error2)}`;
     throw new Error(`Failed to append activity log entry: ${detail}`, { cause: error2 });
@@ -37445,7 +38017,7 @@ var init_activity = __esm({
 });
 
 // packages/ralph/src/config/loader.ts
-import path17 from "node:path";
+import path18 from "node:path";
 import * as fsPromises9 from "node:fs/promises";
 import YAML from "yaml";
 function isPlainObject2(value) {
@@ -37480,8 +38052,8 @@ function pickOptionalPositiveInt(config2, key, options) {
   return value;
 }
 async function loadSingleConfig(configDir, fs3) {
-  const yamlPath = path17.join(configDir, "config.yaml");
-  const jsonPath = path17.join(configDir, "config.json");
+  const yamlPath = path18.join(configDir, "config.yaml");
+  const jsonPath = path18.join(configDir, "config.json");
   let raw = null;
   let format = null;
   let sourcePath = null;
@@ -37554,14 +38126,14 @@ async function loadConfig(cwd, deps) {
   const sources = [];
   let merged = {};
   if (deps?.homeDir) {
-    const globalDir = path17.join(deps.homeDir, ".poe-code", "ralph");
+    const globalDir = path18.join(deps.homeDir, ".poe-code", "ralph");
     const globalResult = await loadSingleConfig(globalDir, fs3);
     if (globalResult) {
       merged = globalResult.config;
       sources.push({ path: globalResult.sourcePath, scope: "global" });
     }
   }
-  const localDir = path17.join(cwd, ".agents", "poe-code-ralph");
+  const localDir = path18.join(cwd, ".agents", "poe-code-ralph");
   const localResult = await loadSingleConfig(localDir, fs3);
   if (localResult) {
     merged = mergeConfigs(merged, localResult.config);
@@ -37572,7 +38144,7 @@ async function loadConfig(cwd, deps) {
 var init_loader = __esm({
   "packages/ralph/src/config/loader.ts"() {
     "use strict";
-    init_src();
+    init_src2();
   }
 });
 
@@ -37583,7 +38155,7 @@ async function ralphBuild(options) {
     cwd: options.cwd ?? process.cwd()
   });
 }
-var init_src9 = __esm({
+var init_src10 = __esm({
   "packages/ralph/src/index.ts"() {
     "use strict";
     init_loop();
@@ -37603,12 +38175,12 @@ var require_PROMPT_worktree_merge = __commonJS({
 });
 
 // src/cli/commands/ralph-worktree.ts
-import path18 from "node:path";
+import path19 from "node:path";
 import { execSync as execSync3 } from "node:child_process";
 function registerRalphWorktreeCommand(ralph, container) {
   ralph.command("worktree").description("Merge a completed worktree back into the main branch.").argument("<name>", "Name of the worktree to merge").option("--agent <name>", "Agent to use for the merge").action(async function(name) {
     const cwd = container.env.cwd;
-    const registryFile = path18.join(cwd, ".poe-code-ralph", "worktrees.yaml");
+    const registryFile = path19.join(cwd, ".poe-code-ralph", "worktrees.yaml");
     const worktrees = await listWorktrees(cwd, registryFile, {
       fs: {
         readFile: (p, enc) => container.fs.readFile(p, enc),
@@ -37671,10 +38243,10 @@ function registerRalphWorktreeCommand(ralph, container) {
 var init_ralph_worktree = __esm({
   "src/cli/commands/ralph-worktree.ts"() {
     "use strict";
-    init_src3();
-    init_src8();
     init_src4();
-    init_src();
+    init_src9();
+    init_src5();
+    init_src2();
     init_errors();
   }
 });
@@ -37750,7 +38322,7 @@ var require_activity = __commonJS({
 });
 
 // src/cli/commands/ralph.ts
-import path19 from "node:path";
+import path20 from "node:path";
 async function loadRalphTemplates() {
   const [
     promptPartialPlan,
@@ -37835,7 +38407,7 @@ async function writeFileOrSkip(args) {
     args.logger.info(`Skip: ${args.displayPath} (already exists)`);
     return "skipped";
   }
-  await args.fs.mkdir(path19.dirname(args.filePath), { recursive: true });
+  await args.fs.mkdir(path20.dirname(args.filePath), { recursive: true });
   await args.fs.writeFile(args.filePath, args.contents, { encoding: "utf8" });
   args.logger.info(`${exists ? "Overwrite" : "Create"}: ${args.displayPath}`);
   return "written";
@@ -37871,22 +38443,22 @@ async function installRalphTemplates(args) {
     const promptPlanContents = templates.promptPlan.replace("{{{PROMPT_PARTIAL_PLAN}}}", templates.promptPartialPlan);
     const templateWrites = [
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "PROMPT_plan.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "PROMPT_plan.md"),
         displayPath: ".agents/poe-code-ralph/PROMPT_plan.md",
         contents: promptPlanContents
       },
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "PROMPT_build.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "PROMPT_build.md"),
         displayPath: ".agents/poe-code-ralph/PROMPT_build.md",
         contents: templates.promptBuild
       },
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "references", "GUARDRAILS.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "references", "GUARDRAILS.md"),
         displayPath: ".agents/poe-code-ralph/references/GUARDRAILS.md",
         contents: templates.refGuardrails
       },
       {
-        targetPath: path19.join(cwd, ".agents", "poe-code-ralph", "references", "CONTEXT_ENGINEERING.md"),
+        targetPath: path20.join(cwd, ".agents", "poe-code-ralph", "references", "CONTEXT_ENGINEERING.md"),
         displayPath: ".agents/poe-code-ralph/references/CONTEXT_ENGINEERING.md",
         contents: templates.refContextEngineering
       }
@@ -37904,22 +38476,22 @@ async function installRalphTemplates(args) {
     const stateFiles = [
       {
         contents: templates.stateProgress,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "progress.md"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "progress.md"),
         displayPath: ".poe-code-ralph/progress.md"
       },
       {
         contents: templates.stateGuardrails,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "guardrails.md"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "guardrails.md"),
         displayPath: ".poe-code-ralph/guardrails.md"
       },
       {
         contents: templates.stateErrors,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "errors.log"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "errors.log"),
         displayPath: ".poe-code-ralph/errors.log"
       },
       {
         contents: templates.stateActivity,
-        targetPath: path19.join(cwd, ".poe-code-ralph", "activity.log"),
+        targetPath: path20.join(cwd, ".poe-code-ralph", "activity.log"),
         displayPath: ".poe-code-ralph/activity.log"
       }
     ];
@@ -37966,7 +38538,7 @@ function registerRalphCommand(program, container) {
       throw new ValidationError(message2);
     }
     const rawPath = options.activityLog?.trim() || configActivityLogPath || ".poe-code-ralph/activity.log";
-    const resolvedPath = path19.isAbsolute(rawPath) ? rawPath : path19.resolve(container.env.cwd, rawPath);
+    const resolvedPath = path20.isAbsolute(rawPath) ? rawPath : path20.resolve(container.env.cwd, rawPath);
     await logActivity(resolvedPath, trimmedMessage, {
       fs: container.fs
     });
@@ -37978,7 +38550,7 @@ function registerRalphCommand(program, container) {
     if (!planPath) {
       throw new ValidationError("--plan <path> is required.");
     }
-    const resolvedPath = path19.isAbsolute(planPath) ? planPath : path19.resolve(cwd, planPath);
+    const resolvedPath = path20.isAbsolute(planPath) ? planPath : path20.resolve(cwd, planPath);
     let content;
     try {
       content = await container.fs.readFile(resolvedPath, "utf8");
@@ -38152,7 +38724,7 @@ function registerRalphCommand(program, container) {
       } else {
         try {
           const planContent = await container.fs.readFile(
-            path19.resolve(cwd, planPath),
+            path20.resolve(cwd, planPath),
             "utf8"
           );
           const plan = parsePlan(planContent);
@@ -38186,7 +38758,7 @@ function registerRalphCommand(program, container) {
       } else {
         try {
           const planContent = await container.fs.readFile(
-            path19.resolve(cwd, planPath),
+            path20.resolve(cwd, planPath),
             "utf8"
           );
           const plan = parsePlan(planContent);
@@ -38242,10 +38814,10 @@ var templateImports, DEFAULT_RALPH_AGENT;
 var init_ralph = __esm({
   "src/cli/commands/ralph.ts"() {
     "use strict";
-    init_src3();
-    init_src9();
-    init_src7();
-    init_src();
+    init_src4();
+    init_src10();
+    init_src8();
+    init_src2();
     init_errors();
     init_shared();
     init_ralph_worktree();
@@ -38466,7 +39038,7 @@ var init_usage = __esm({
     "use strict";
     init_shared();
     init_errors();
-    init_src3();
+    init_src4();
   }
 });
 
@@ -38559,10 +39131,7 @@ function registerModelsCommand(program, container) {
     const commandOptions = this.opts();
     resources.logger.intro("models");
     try {
-      const apiKey = await loadCredentials({
-        fs: container.fs,
-        filePath: container.env.credentialsPath
-      });
+      const apiKey = await container.readApiKey();
       if (flags.dryRun) {
         resources.logger.dryRun(
           "Dry run: would fetch models from Poe API."
@@ -38750,9 +39319,8 @@ var init_models = __esm({
   "src/cli/commands/models.ts"() {
     "use strict";
     init_shared();
-    init_credentials2();
     init_errors();
-    init_src3();
+    init_src4();
     MAX_VALUES_LENGTH = 105;
     MAX_DEFAULT_LENGTH = 36;
   }
@@ -38764,7 +39332,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "poe-code",
-      version: "3.0.71",
+      version: "3.0.72-beta.2",
       description: "CLI tool to configure Poe API for developer workflows.",
       type: "module",
       main: "./dist/index.js",
@@ -38846,6 +39414,7 @@ var init_package = __esm({
       devDependencies: {
         "@eslint/js": "^9.0.0",
         "@modelcontextprotocol/sdk": "^1.26.0",
+        "@poe-code/auth": "*",
         "@poe-code/agent-spawn": "*",
         "@poe-code/config-mutations": "*",
         "@poe-code/design-system": "*",
@@ -38909,21 +39478,26 @@ function formatHelpText(input) {
       args: "<agent>",
       description: "Remove a previously applied configuration"
     },
+    {
+      name: "login",
+      args: "",
+      description: "Store a Poe API key"
+    },
     {
       name: "logout",
       args: "",
-      description: "Remove all configuration and stored credentials"
+      description: "Remove all configuration"
+    },
+    {
+      name: "auth status",
+      args: "",
+      description: "Show login, balance, and configuration status"
     },
     {
       name: "spawn",
       args: "<agent> [prompt]",
       description: "Launch a coding agent"
     },
-    {
-      name: "research",
-      args: "<prompt>",
-      description: "Research a codebase using a coding agent"
-    },
     {
       name: "generate",
       args: "[type]",
@@ -39107,6 +39681,7 @@ function bootstrapProgram(container) {
   registerUnconfigureCommand(program, container);
   registerLoginCommand(program, container);
   registerLogoutCommand(program, container);
+  registerAuthCommand(program, container);
   registerMcpCommand(program, container);
   registerSkillCommand(program, container);
   registerRalphCommand(program, container);
@@ -39148,13 +39723,14 @@ var init_program = __esm({
   async "src/cli/program.ts"() {
     "use strict";
     await init_container2();
-    init_src3();
+    init_src4();
     init_configure();
     await init_spawn4();
     await init_research2();
     init_wrap();
     init_login();
     init_logout();
+    init_auth();
     init_install();
     init_unconfigure();
     init_test();
@@ -39245,7 +39821,7 @@ function createPromptRunner(adapter = {
 var init_prompt_runner = __esm({
   "src/cli/prompt-runner.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_errors();
   }
 });
@@ -39256,17 +39832,17 @@ __export(bootstrap_exports, {
   createCliMain: () => createCliMain,
   isCliInvocation: () => isCliInvocation
 });
-import * as nodeFs from "node:fs/promises";
+import * as nodeFs2 from "node:fs/promises";
 import * as nodeFsSync3 from "node:fs";
 import { realpathSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
-import { join as join3 } from "node:path";
+import { join as join2 } from "node:path";
 import chalk13 from "chalk";
 function createCliMain(programFactory) {
   return async function runCli() {
-    const homeDir = homedir3();
-    const logDir = join3(homeDir, ".poe-code", "logs");
+    const homeDir = homedir4();
+    const logDir = join2(homeDir, ".poe-code", "logs");
     const promptRunner = createPromptRunner();
     const shouldLogToStderr = process.env.POE_CODE_STDERR_LOGS === "1" || process.env.POE_CODE_STDERR_LOGS === "true";
     const errorLogger = new ErrorLogger({
@@ -39301,7 +39877,7 @@ function createCliMain(programFactory) {
         } else {
           log2.error(`Error: ${error2.message}`);
           log2.message(
-            `See logs at ${join3(logDir, "errors.log")} for more details.`,
+            `See logs at ${join2(logDir, "errors.log")} for more details.`,
             { symbol: chalk13.magenta("\u25CF") }
           );
         }
@@ -39327,11 +39903,11 @@ var fsAdapter;
 var init_bootstrap = __esm({
   "src/cli/bootstrap.ts"() {
     "use strict";
-    init_src3();
+    init_src4();
     init_error_logger();
     init_errors();
     init_prompt_runner();
-    fsAdapter = nodeFs;
+    fsAdapter = nodeFs2;
   }
 });
 
@@ -39470,6 +40046,6 @@ export {
   getPoeApiKey,
   isCliInvocation2 as isCliInvocation,
   main,
-  spawn3 as spawn
+  spawn4 as spawn
 };
 //# sourceMappingURL=index.js.map