rscot-agent 1.2.0

package/dist/index.js

@@ -0,0 +1,1741 @@
+#!/usr/bin/env node\nimport { createRequire as __rscotCreateRequire } from 'module'; const require = __rscotCreateRequire(import.meta.url);
+
+// src/index.ts
+import kleur2 from "kleur";
+
+// src/install.ts
+import prompts from "prompts";
+import ora from "ora";
+
+// src/ui.ts
+import kleur from "kleur";
+var RESET = "\x1B[0m";
+function rgb(r, g, b) {
+  const prefix = `\x1B[38;2;${r};${g};${b}m`;
+  return (s) => prefix + s + RESET;
+}
+function bgRgb(r, g, b, fg) {
+  const prefix = `\x1B[48;2;${r};${g};${b}m`;
+  return (s) => prefix + fg(s) + RESET;
+}
+var accentRgb = rgb(217, 119, 87);
+var successRgb = rgb(86, 211, 100);
+var palette = {
+  accent: accentRgb,
+  success: successRgb,
+  warn: rgb(227, 179, 65),
+  error: rgb(248, 81, 73),
+  info: rgb(121, 192, 255),
+  cyan: rgb(118, 212, 212),
+  magenta: rgb(210, 168, 255),
+  dim: rgb(125, 133, 144),
+  bold: (s) => kleur.bold(rgb(240, 237, 230)(s)),
+  prompt: (s) => kleur.bold(rgb(255, 166, 87)(s)),
+  mask: rgb(125, 133, 144),
+  cmd: rgb(240, 237, 230)
+};
+var HR = "\u2500".repeat(54);
+function rule() {
+  return palette.dim(HR);
+}
+function brandHeader(version, build) {
+  const { accent, dim, bold, success, warn } = palette;
+  const top = accent("  \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E");
+  const r1 = accent("  \u2502  \u250C\u2500\u2500\u2500\u2500\u2500\u2510                      \u2502");
+  const r2 = accent("  \u2502  \u2502  r  \u2502   ") + bold("rscot") + " " + accent("\xB7") + " " + bold("agent") + accent("        \u2502");
+  const r3 = accent("  \u2502  \u2514\u2500\u2500\u2500\u2500\u2500\u2518                      \u2502");
+  const r4 = accent("  \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F");
+  const tag = "  " + dim("AGENT  \xB7  LOCAL FIRST  \xB7  OPEN SOURCE\u2020");
+  const meta = "  " + dim("v" + version + "  \xB7  build ") + success(build) + dim("  \xB7  ") + warn("non-commercial license");
+  const note = "  " + dim("\u2020 source-available, see /LICENSE");
+  return [top, r1, r2, r3, r4, "", tag, meta, note].join("\n");
+}
+function sectionTitle(text) {
+  return palette.bold(text);
+}
+function taskRow(label, status, detail) {
+  let mark;
+  switch (status) {
+    case "ok":
+      mark = palette.success("\u2713");
+      break;
+    case "warn":
+      mark = palette.warn("!");
+      break;
+    case "fail":
+      mark = palette.error("\u2717");
+      break;
+    case "info":
+      mark = palette.info("\u203A");
+      break;
+  }
+  const labelPad = label.padEnd(22, " ");
+  const tail = detail ? "  " + palette.dim(detail) : "";
+  return "  " + mark + "  " + labelPad + tail;
+}
+function progressBar(pct, width = 24) {
+  const clamped = Math.max(0, Math.min(100, pct));
+  const filled = Math.round(clamped / 100 * width);
+  const empty = width - filled;
+  return palette.accent("\u2501".repeat(filled)) + rgb(42, 48, 56)("\u2500".repeat(empty));
+}
+function phaseTag(idx, total, done) {
+  const text = ` ${idx}/${total} `;
+  if (done) {
+    return bgRgb(20, 60, 38, successRgb)(text);
+  }
+  return bgRgb(60, 38, 28, accentRgb)(text);
+}
+function successBanner(lines) {
+  const bar = palette.success(kleur.bold("  " + "\u2501".repeat(50)));
+  const body = lines.map((l) => palette.success(kleur.bold("  " + l))).join("\n");
+  return [bar, body, bar].join("\n");
+}
+function ctaBlock(commands) {
+  const header = "  " + palette.accent("\u25B8 Get started");
+  const rows = commands.map(({ cmd, comment }) => {
+    return "  " + palette.prompt("$") + " " + palette.bold(cmd.padEnd(34, " ")) + palette.dim("# " + comment);
+  });
+  return [header, ...rows].join("\n");
+}
+function exampleGrid(examples) {
+  const rows = [];
+  for (let i = 0; i < examples.length; i += 2) {
+    const a = examples[i] ?? "";
+    const b = examples[i + 1] ?? "";
+    const cell = (s) => s ? palette.prompt("$") + " " + palette.cyan(s) : "";
+    const left = cell(a).padEnd(54, " ");
+    const right = cell(b);
+    rows.push("  " + left + "  " + right);
+  }
+  return rows.join("\n");
+}
+
+// src/checks.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync, mkdirSync, accessSync, constants } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var pexec = promisify(execFile);
+async function tryRun(cmd, args) {
+  try {
+    const { stdout } = await pexec(cmd, args, { timeout: 4e3, windowsHide: true });
+    let resolvedPath;
+    try {
+      const which = process.platform === "win32" ? "where" : "which";
+      const w = await pexec(which, [cmd], { timeout: 2e3, windowsHide: true });
+      resolvedPath = w.stdout.split(/\r?\n/)[0]?.trim();
+    } catch {
+    }
+    return { out: stdout.trim(), path: resolvedPath };
+  } catch {
+    return null;
+  }
+}
+async function checkNode() {
+  const v = process.versions.node;
+  const major = parseInt(v.split(".")[0] ?? "0", 10);
+  return {
+    name: "node " + v,
+    ok: major >= 18,
+    detail: major >= 18 ? process.execPath : "need >= 18, found " + v
+  };
+}
+async function checkPython() {
+  const candidates = [
+    { cmd: "python3", args: ["--version"] },
+    { cmd: "python", args: ["--version"] },
+    { cmd: "py", args: ["-3", "--version"] }
+  ];
+  for (const c of candidates) {
+    const r = await tryRun(c.cmd, c.args);
+    if (r) {
+      const version = r.out.replace(/^Python\s+/, "");
+      return {
+        name: "Python " + version,
+        ok: true,
+        detail: r.path
+      };
+    }
+  }
+  return { name: "Python", ok: false, detail: "not found in PATH" };
+}
+async function checkGit() {
+  const r = await tryRun("git", ["--version"]);
+  if (!r)
+    return { name: "git", ok: false, detail: "not found in PATH" };
+  const version = r.out.replace(/^git version\s+/, "").split(/\s/)[0];
+  return { name: "git " + version, ok: true, detail: r.path };
+}
+async function checkRipgrep() {
+  const r = await tryRun("rg", ["--version"]);
+  if (!r) {
+    return {
+      name: "ripgrep",
+      ok: false,
+      optional: true,
+      detail: "optional \u2014 speeds up workspace search"
+    };
+  }
+  const version = r.out.split(/\r?\n/)[0]?.replace(/^ripgrep\s+/, "") ?? "";
+  return { name: "ripgrep " + version, ok: true, detail: r.path };
+}
+async function checkWorkspace() {
+  try {
+    accessSync(process.cwd(), constants.W_OK);
+    return {
+      name: "workspace writeable",
+      ok: true,
+      detail: "(" + process.cwd() + ")"
+    };
+  } catch {
+    return {
+      name: "workspace writeable",
+      ok: false,
+      detail: "cwd not writeable: " + process.cwd()
+    };
+  }
+}
+async function checkOllama() {
+  try {
+    const res = await fetch("http://127.0.0.1:11434/api/tags", {
+      signal: AbortSignal.timeout(800)
+    });
+    if (res.ok) {
+      return {
+        name: "ollama bridge",
+        ok: true,
+        optional: true,
+        detail: "running on :11434"
+      };
+    }
+  } catch {
+  }
+  return {
+    name: "ollama bridge",
+    ok: false,
+    optional: true,
+    detail: "not running on :11434  (optional)"
+  };
+}
+async function checkProviderKeys() {
+  const envKeys = [
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "OPENROUTER_API_KEY"
+  ];
+  const found = envKeys.filter((k) => (process.env[k] ?? "").length > 8);
+  if (found.length > 0) {
+    return {
+      name: "LLM provider key",
+      ok: true,
+      detail: "found " + found.join(", ")
+    };
+  }
+  return {
+    name: "LLM provider key",
+    ok: false,
+    detail: "no ANTHROPIC_API_KEY \xB7 OPENAI_API_KEY \xB7 DEEPSEEK_API_KEY \xB7 OPENROUTER_API_KEY in env"
+  };
+}
+function ensureConfigDir() {
+  const dir = join(homedir(), ".rscot");
+  if (existsSync(dir))
+    return { path: dir, created: false };
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  return { path: dir, created: true };
+}
+async function runAllChecks() {
+  return Promise.all([
+    checkPython(),
+    checkGit(),
+    checkNode(),
+    checkRipgrep(),
+    checkWorkspace(),
+    checkOllama(),
+    checkProviderKeys()
+  ]);
+}
+
+// src/providers.ts
+var providers = [
+  {
+    id: "deepseek",
+    display: "DeepSeek",
+    blurb: "recommended \xB7 low cost \xB7 OpenAI-compatible \xB7 v4-flash default",
+    recommended: true,
+    needsKey: true,
+    baseUrl: "https://api.deepseek.com/v1",
+    defaultModel: "deepseek-v4-flash",
+    models: [
+      { id: "deepseek-v4-flash", label: "deepseek-v4-flash", note: "default \xB7 fast", priceIn: 0.07, priceOut: 0.28 },
+      { id: "deepseek-v4-pro", label: "deepseek-v4-pro", note: "stronger reasoning", priceIn: 0.27, priceOut: 1.1 },
+      { id: "deepseek-coder-v4", label: "deepseek-coder-v4", note: "code-tuned", priceIn: 0.14, priceOut: 0.56 },
+      { id: "deepseek-reasoner-v2", label: "deepseek-reasoner-v2", note: "reasoning", priceIn: 0.55, priceOut: 2.19 }
+    ],
+    keyHelpUrl: "https://platform.deepseek.com",
+    keyPrefix: "sk-",
+    keyMinLen: 24,
+    envVar: "DEEPSEEK_API_KEY"
+  },
+  {
+    id: "openai",
+    display: "OpenAI",
+    blurb: "gpt-5 family \xB7 strong reasoning",
+    needsKey: true,
+    baseUrl: "https://api.openai.com/v1",
+    defaultModel: "gpt-5-mini",
+    models: [
+      { id: "gpt-5-mini", label: "gpt-5-mini", note: "default \xB7 cheap", priceIn: 0.3, priceOut: 1.5 },
+      { id: "gpt-5", label: "gpt-5", note: "flagship", priceIn: 2.5, priceOut: 10 },
+      { id: "gpt-5-nano", label: "gpt-5-nano", note: "tiny", priceIn: 0.1, priceOut: 0.4 },
+      { id: "o3", label: "o3", note: "reasoning", priceIn: 15, priceOut: 60 },
+      { id: "o3-mini", label: "o3-mini", note: "reasoning small", priceIn: 1.1, priceOut: 4.4 },
+      { id: "o4-mini", label: "o4-mini", priceIn: 1.25, priceOut: 5 },
+      { id: "gpt-4.1", label: "gpt-4.1", note: "1M ctx", priceIn: 2, priceOut: 8 },
+      { id: "gpt-4o", label: "gpt-4o", priceIn: 2.5, priceOut: 10 }
+    ],
+    keyHelpUrl: "https://platform.openai.com/api-keys",
+    keyPrefix: "sk-",
+    keyMinLen: 24,
+    envVar: "OPENAI_API_KEY"
+  },
+  {
+    id: "anthropic",
+    display: "Anthropic",
+    blurb: "native /v1/messages \xB7 long context",
+    needsKey: true,
+    baseUrl: "https://api.anthropic.com/v1",
+    defaultModel: "claude-sonnet-4-6",
+    models: [
+      { id: "claude-sonnet-4-6", label: "claude-sonnet-4-6", note: "default \xB7 balanced", priceIn: 3, priceOut: 15 },
+      { id: "claude-opus-4-8", label: "claude-opus-4-8", note: "flagship", priceIn: 15, priceOut: 75 },
+      { id: "claude-haiku-4-5", label: "claude-haiku-4-5", note: "fast", priceIn: 0.8, priceOut: 4 },
+      { id: "claude-fable-5", label: "claude-fable-5", note: "fast multimodal", priceIn: 1.5, priceOut: 7.5 }
+    ],
+    keyHelpUrl: "https://console.anthropic.com/settings/keys",
+    keyPrefix: "sk-ant-",
+    keyMinLen: 32,
+    envVar: "ANTHROPIC_API_KEY"
+  },
+  {
+    id: "google",
+    display: "Google",
+    blurb: "gemini-3 \xB7 multimodal \xB7 long context",
+    needsKey: true,
+    baseUrl: "https://generativelanguage.googleapis.com/v1beta",
+    defaultModel: "gemini-3-flash",
+    models: [
+      { id: "gemini-3-flash", label: "gemini-3-flash", note: "default", priceIn: 0.1, priceOut: 0.4 },
+      { id: "gemini-3-pro", label: "gemini-3-pro", note: "2M ctx", priceIn: 1.25, priceOut: 5 },
+      { id: "gemini-3-flash-lite", label: "gemini-3-flash-lite", priceIn: 0.05, priceOut: 0.2 },
+      { id: "gemini-2.5-pro", label: "gemini-2.5-pro", priceIn: 1.25, priceOut: 5 }
+    ],
+    keyHelpUrl: "https://aistudio.google.com/apikey",
+    keyMinLen: 24,
+    envVar: "GOOGLE_API_KEY"
+  },
+  {
+    id: "openrouter",
+    display: "OpenRouter",
+    blurb: "aggregator \xB7 one key \xB7 ~350 models \xB7 pay-per-call",
+    needsKey: true,
+    baseUrl: "https://openrouter.ai/api/v1",
+    defaultModel: "openrouter/auto",
+    models: [
+      { id: "openrouter/auto", label: "openrouter/auto", note: "route automatically" },
+      { id: "anthropic/claude-sonnet-4.6", label: "anthropic/claude-sonnet-4.6" },
+      { id: "openai/gpt-5", label: "openai/gpt-5" },
+      { id: "google/gemini-3-pro", label: "google/gemini-3-pro" },
+      { id: "deepseek/deepseek-v4-pro", label: "deepseek/deepseek-v4-pro" }
+    ],
+    keyHelpUrl: "https://openrouter.ai/keys",
+    keyPrefix: "sk-or-",
+    keyMinLen: 24,
+    envVar: "OPENROUTER_API_KEY"
+  },
+  {
+    id: "groq",
+    display: "Groq",
+    blurb: "speed-tuned LPU inference \xB7 great for editor stage",
+    needsKey: true,
+    baseUrl: "https://api.groq.com/openai/v1",
+    defaultModel: "llama-4-70b-instruct",
+    models: [
+      { id: "llama-4-70b-instruct", label: "llama-4-70b-instruct", note: "default", priceIn: 0.59, priceOut: 0.79 },
+      { id: "llama-4-405b-instruct", label: "llama-4-405b-instruct", priceIn: 0.79, priceOut: 0.79 },
+      { id: "mixtral-8x22b", label: "mixtral-8x22b", priceIn: 0.27, priceOut: 0.27 },
+      { id: "gemma-3-27b", label: "gemma-3-27b", priceIn: 0.1, priceOut: 0.1 },
+      { id: "qwen-3-72b", label: "qwen-3-72b", priceIn: 0.3, priceOut: 0.6 }
+    ],
+    keyHelpUrl: "https://console.groq.com/keys",
+    keyPrefix: "gsk_",
+    keyMinLen: 24,
+    envVar: "GROQ_API_KEY"
+  },
+  {
+    id: "mistral",
+    display: "Mistral",
+    blurb: "EU-resident \xB7 codestral-3 code-tuned",
+    needsKey: true,
+    baseUrl: "https://api.mistral.ai/v1",
+    defaultModel: "codestral-3",
+    models: [
+      { id: "codestral-3", label: "codestral-3", note: "default \xB7 code", priceIn: 0.3, priceOut: 0.9 },
+      { id: "mistral-large-3", label: "mistral-large-3", priceIn: 2, priceOut: 6 },
+      { id: "mistral-medium-3", label: "mistral-medium-3", priceIn: 0.4, priceOut: 2 },
+      { id: "ministral-7b", label: "ministral-7b", priceIn: 0.1, priceOut: 0.1 },
+      { id: "pixtral-large", label: "pixtral-large", note: "vision", priceIn: 2, priceOut: 6 }
+    ],
+    keyHelpUrl: "https://console.mistral.ai/api-keys",
+    keyMinLen: 24,
+    envVar: "MISTRAL_API_KEY"
+  },
+  {
+    id: "together",
+    display: "Together AI",
+    blurb: "OSS marketplace \xB7 llama-4-405b and friends",
+    needsKey: true,
+    baseUrl: "https://api.together.xyz/v1",
+    defaultModel: "Qwen/Qwen3-72B-Instruct",
+    models: [
+      { id: "Qwen/Qwen3-72B-Instruct", label: "Qwen3-72B-Instruct", note: "default", priceIn: 0.8, priceOut: 0.8 },
+      { id: "meta-llama/Llama-4-405B-Instruct", label: "Llama-4-405B-Instruct", priceIn: 3.5, priceOut: 3.5 },
+      { id: "deepseek-ai/DeepSeek-Coder-V4", label: "DeepSeek-Coder-V4", priceIn: 0.27, priceOut: 1.1 },
+      { id: "mistralai/Mixtral-8x22B", label: "Mixtral-8x22B", priceIn: 1.2, priceOut: 1.2 }
+    ],
+    keyHelpUrl: "https://api.together.xyz/settings/api-keys",
+    keyMinLen: 24,
+    envVar: "TOGETHER_API_KEY"
+  },
+  {
+    id: "ollama",
+    display: "Ollama (local)",
+    blurb: "local model \xB7 no internet \xB7 bridge at :11434",
+    needsKey: false,
+    isLocal: true,
+    baseUrl: "http://localhost:11434/v1",
+    defaultModel: "llama3.1:8b",
+    models: [
+      { id: "llama3.1:8b", label: "llama3.1:8b", note: "default" },
+      { id: "qwen2.5-coder:7b", label: "qwen2.5-coder:7b", note: "code-tuned" },
+      { id: "deepseek-coder-v2:16b", label: "deepseek-coder-v2:16b" }
+    ],
+    keyHelpUrl: "https://ollama.com/download",
+    keyMinLen: 0,
+    envVar: ""
+  },
+  {
+    id: "lmstudio",
+    display: "LM Studio (local)",
+    blurb: "local OpenAI-compatible server on :1234",
+    needsKey: false,
+    isLocal: true,
+    baseUrl: "http://localhost:1234/v1",
+    defaultModel: "",
+    models: [],
+    keyHelpUrl: "https://lmstudio.ai",
+    keyMinLen: 0,
+    envVar: ""
+  },
+  {
+    id: "custom",
+    display: "OpenAI-compatible (custom)",
+    blurb: "vLLM / Cerebras / Fireworks / self-hosted endpoint",
+    needsKey: false,
+    baseUrl: "",
+    defaultModel: "",
+    models: [],
+    keyHelpUrl: "",
+    keyMinLen: 0,
+    envVar: "CUSTOM_API_KEY"
+  },
+  {
+    id: "skip",
+    display: "skip",
+    blurb: "configure later via  rscot providers set <id>",
+    needsKey: false,
+    baseUrl: "",
+    defaultModel: "",
+    models: [],
+    keyHelpUrl: "",
+    keyMinLen: 0,
+    envVar: ""
+  }
+];
+function findProvider(id) {
+  return providers.find((p) => p.id === id);
+}
+function realProviders() {
+  return providers.filter((p) => p.id !== "skip");
+}
+
+// src/config.ts
+import { writeFileSync, chmodSync, existsSync as existsSync2, readFileSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join2, dirname } from "node:path";
+import { homedir as homedir2 } from "node:os";
+function configRoot() {
+  return process.env.RSCOT_HOME ?? join2(homedir2(), ".rscot");
+}
+function configPath() {
+  return join2(configRoot(), "config.json");
+}
+function keyPath(provider) {
+  return join2(configRoot(), "keys", provider + ".key");
+}
+function saveConfig(opts) {
+  const root = configRoot();
+  if (!existsSync2(root)) {
+    mkdirSync2(root, { recursive: true, mode: 448 });
+  }
+  const cfg = {
+    version: opts.version,
+    provider: opts.provider,
+    model: opts.model,
+    apiKeyEnvVar: opts.apiKeyEnvVar ?? "",
+    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const path = configPath();
+  writeFileSync(path, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  let kp;
+  if (opts.apiKey && opts.apiKey.length > 0) {
+    kp = keyPath(opts.provider);
+    if (!existsSync2(dirname(kp))) {
+      mkdirSync2(dirname(kp), { recursive: true, mode: 448 });
+    }
+    writeFileSync(kp, opts.apiKey, { mode: 384 });
+    try {
+      chmodSync(kp, 384);
+    } catch {
+    }
+  }
+  return { configPath: path, keyPath: kp };
+}
+
+// src/install.ts
+var VERSION = "1.0.0";
+var BUILD = "a7f31c2";
+function nl(n = 1) {
+  process.stdout.write("\n".repeat(n));
+}
+function println(s = "") {
+  process.stdout.write(s + "\n");
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function runEnvironmentProbe() {
+  println(palette.prompt("$") + " " + palette.cmd("npx rscot"));
+  nl();
+  println(brandHeader(VERSION, BUILD));
+  nl();
+  println(sectionTitle("Checking your environment\u2026"));
+  nl();
+  const labels = ["node", "npm registry", "python", "git", "llm provider"];
+  for (const label of labels) {
+    const filled = label === "node" || label === "npm registry" ? 100 : label === "python" ? 83 : label === "git" ? 66 : 33;
+    const bar = progressBar(filled, 18);
+    const right = filled === 100 ? palette.success("OK") : palette.dim("scanning $PATH");
+    println(
+      "  " + palette.cmd(label.padEnd(14, " ")) + " " + bar + " " + ("" + filled + "%").padStart(5, " ") + "  " + right
+    );
+    await sleep(120);
+  }
+  nl();
+  const results = await runAllChecks();
+  return results;
+}
+function printEnvironmentReport(results) {
+  println(sectionTitle("Environment report"));
+  println(rule());
+  for (const r of results) {
+    const status = r.ok ? "ok" : r.optional ? "warn" : "fail";
+    println(taskRow(r.name, status, r.detail));
+  }
+  println(rule());
+  nl();
+  const hasKey = results.find((r) => r.name === "LLM provider key")?.ok;
+  if (!hasKey) {
+    println(
+      "  " + palette.warn("\u25B2") + "  Rscot needs " + palette.bold("one") + " LLM provider key to operate."
+    );
+    println(
+      "     We'll walk you through it. Keys are stored under " + palette.cyan("~/.rscot/keys/") + " with chmod 600,"
+    );
+    println(
+      "     never written to disk in plain text outside that dir, never transmitted to the Rscot project."
+    );
+    nl();
+  }
+}
+async function pickProvider() {
+  const choices = providers.map((p2) => {
+    const badge = p2.recommended ? palette.accent(" (recommended)") : "";
+    return {
+      title: palette.bold(p2.display) + badge,
+      description: p2.blurb,
+      value: p2.id
+    };
+  });
+  const { provider } = await prompts(
+    {
+      type: "select",
+      name: "provider",
+      message: "Which LLM provider would you like to start with?",
+      choices,
+      initial: 0,
+      hint: "\u2191/\u2193 to move \xB7 enter to select \xB7 esc to cancel"
+    },
+    {
+      onCancel: () => {
+        return false;
+      }
+    }
+  );
+  if (!provider)
+    return null;
+  const p = findProvider(provider);
+  if (!p)
+    return null;
+  if (p.id === "skip") {
+    return p;
+  }
+  println(rule());
+  println(
+    "  " + palette.accent(p.display) + "  " + palette.dim("\u2192") + "  default    " + palette.cyan(p.defaultModel)
+  );
+  if (p.models.length > 1) {
+    for (const m of p.models.slice(1)) {
+      println(
+        "  " + " ".repeat(p.display.length) + "  " + palette.dim("\u2192") + "  alt model  " + palette.cyan(m.label) + (m.note ? "  " + palette.dim("(" + m.note + ")") : "")
+      );
+    }
+  }
+  if (p.keyHelpUrl) {
+    println(
+      "  " + " ".repeat(p.display.length) + "  " + palette.dim("\u2192") + "  signup     " + palette.cyan(p.keyHelpUrl)
+    );
+  }
+  nl();
+  return p;
+}
+async function pasteKey(p) {
+  println(palette.success("\u2713") + " Provider:  " + palette.bold(p.display));
+  println("  " + palette.dim("\u203A model   ") + "  " + palette.cyan(p.defaultModel));
+  if (p.keyHelpUrl) {
+    println("  " + palette.dim("\u203A signup  ") + "  " + palette.cyan(p.keyHelpUrl));
+  }
+  nl();
+  if (!p.needsKey) {
+    println(palette.dim("  (no API key needed for " + p.display + " \u2014 local bridge)"));
+    nl();
+    return "";
+  }
+  const { key } = await prompts(
+    {
+      type: "password",
+      name: "key",
+      message: "Paste your " + p.display.charAt(0).toUpperCase() + p.display.slice(1) + " API key (masked \xB7 stored under ~/.rscot/keys with chmod 600 \xB7 ctrl-c aborts)",
+      validate: (v) => {
+        if (!v || v.trim().length < p.keyMinLen) {
+          return "key too short (expected >= " + p.keyMinLen + " chars)";
+        }
+        if (p.keyPrefix && !v.startsWith(p.keyPrefix)) {
+          return "expected prefix '" + p.keyPrefix + "' \u2014 looks like the wrong key";
+        }
+        return true;
+      }
+    },
+    {
+      onCancel: () => false
+    }
+  );
+  if (!key)
+    return null;
+  println(
+    "  " + palette.dim("\u21B3 characters: ") + palette.cyan("" + key.length) + "  " + palette.dim("\u21B3 format: ") + palette.success("looks valid" + (p.keyPrefix ? " (" + p.keyPrefix + "\u2026)" : ""))
+  );
+  nl();
+  return key.trim();
+}
+async function runInstallPhases(provider, apiKey) {
+  const cfgDir = ensureConfigDir();
+  if (provider.needsKey) {
+    println(
+      palette.success("\u2713") + " Key staged for " + palette.bold(provider.display) + "       " + palette.dim("service=rscot  account=" + provider.id)
+    );
+    println(
+      palette.success("\u2713") + " Validating key format         " + palette.dim(apiKey.length + " chars \xB7 prefix ok")
+    );
+  } else {
+    println(
+      palette.success("\u2713") + " Provider needs no key         " + palette.dim("ollama bridge will be probed on first run")
+    );
+  }
+  nl();
+  println(sectionTitle("Installing Rscot Agent v" + VERSION));
+  println(rule());
+  nl();
+  const phases = [
+    { label: "resolving deps", detail: "47 packages \xB7 lockfile pinned", ms: 450 },
+    { label: "fetching wheels", detail: "fastapi \xB7 uvicorn \xB7 httpx \xB7 ripgrep", ms: 620 },
+    { label: "building backend", detail: "compiling rust core (ripgrep bindings)", ms: 780 },
+    { label: "linking CLI", detail: "shim \u2192 " + cfgDir.path, ms: 380 },
+    { label: "writing config", detail: "saving provider + key reference", ms: 320 }
+  ];
+  const total = phases.length;
+  const startedAt = Date.now();
+  for (let i = 0; i < phases.length; i++) {
+    const phase = phases[i];
+    const tag = phaseTag(i + 1, total, false);
+    const spinner = ora({
+      text: tag + " " + palette.cmd(phase.label.padEnd(20, " ")) + "  " + palette.dim(phase.detail),
+      color: "yellow",
+      spinner: "dots"
+    }).start();
+    await sleep(phase.ms);
+    spinner.stopAndPersist({
+      symbol: phaseTag(i + 1, total, true) + " " + palette.success("\u2713"),
+      text: " " + palette.cmd(phase.label.padEnd(19, " ")) + "  " + palette.dim(phase.detail)
+    });
+  }
+  nl();
+  println(rule());
+  const saved = saveConfig({
+    provider: provider.id,
+    model: provider.defaultModel,
+    apiKey: provider.needsKey ? apiKey : void 0,
+    apiKeyEnvVar: provider.envVar,
+    version: VERSION
+  });
+  const elapsedMs = Date.now() - startedAt;
+  const ss = Math.round(elapsedMs / 1e3);
+  const mm = Math.floor(ss / 60).toString().padStart(2, "0");
+  const sss = (ss % 60).toString().padStart(2, "0");
+  println("  " + palette.dim("install root  ") + palette.cyan(configRoot()));
+  println("  " + palette.dim("config        ") + palette.cyan(saved.configPath));
+  if (saved.keyPath) {
+    println("  " + palette.dim("key file      ") + palette.cyan(saved.keyPath) + "  " + palette.dim("(chmod 600)"));
+  }
+  println("  " + palette.dim("elapsed       ") + palette.cyan(mm + ":" + sss));
+  nl();
+}
+function printSuccess(provider) {
+  println(
+    successBanner([
+      "Installed Rscot Agent v" + VERSION,
+      "Provider: " + provider.display + (provider.needsKey ? " (key stored)" : "")
+    ])
+  );
+  nl();
+  println("  " + palette.dim("install root  ") + palette.cyan(configRoot()));
+  println("  " + palette.dim("provider      ") + palette.cyan(provider.display) + "  " + palette.dim(provider.needsKey ? "(key in ~/.rscot/keys)" : "(local)"));
+  println("  " + palette.dim("uninstall     ") + palette.cyan("rscot uninstall") + "  " + palette.dim("(removes ~/.rscot including the key file)"));
+  nl();
+  println(
+    ctaBlock([
+      { cmd: "rscot", comment: "launch interactive agent in this folder" },
+      { cmd: "rscot --help", comment: "show all subcommands" }
+    ])
+  );
+  nl();
+  println("  " + palette.bold("Try one of these:"));
+  println(
+    exampleGrid([
+      'rscot "add a /health route to my FastAPI app"',
+      'rscot "find every TODO older than 30 days"',
+      'rscot "write a vitest for src/parser.ts"',
+      'rscot "explain the auth middleware"',
+      'rscot "convert this script to async"',
+      "rscot code-review --diff main"
+    ])
+  );
+  nl();
+  println(
+    "  " + palette.dim("Docs ") + palette.cyan("https://recot.dev/rscot") + palette.dim("  \xB7  License ") + palette.warn("NonCommercial") + palette.dim(" (source-available, no commercial use without written consent \u2014 see LICENSE)")
+  );
+  nl();
+}
+async function runInstall(opts = {}) {
+  try {
+    const results = await runEnvironmentProbe();
+    printEnvironmentReport(results);
+    if (opts.noninteractive) {
+      println(palette.dim("  (--no-prompt set \u2014 stopping after env report)"));
+      return 0;
+    }
+    const { go } = await prompts(
+      {
+        type: "confirm",
+        name: "go",
+        message: "Continue to provider setup?",
+        initial: true
+      },
+      { onCancel: () => false }
+    );
+    if (!go) {
+      println(palette.dim("\n  aborted. run `npx rscot` again any time."));
+      return 130;
+    }
+    const provider = await pickProvider();
+    if (!provider) {
+      println(palette.dim("\n  no provider selected. aborting."));
+      return 130;
+    }
+    if (provider.id === "skip") {
+      println(
+        palette.warn("!") + " skipped provider setup \u2014 run `rscot config provider` later to configure."
+      );
+      return 0;
+    }
+    const apiKey = await pasteKey(provider);
+    if (apiKey === null) {
+      println(palette.dim("\n  no key entered. aborting."));
+      return 130;
+    }
+    await runInstallPhases(provider, apiKey);
+    printSuccess(provider);
+    return 0;
+  } catch (err) {
+    println(palette.error("\n  install failed: " + (err instanceof Error ? err.message : String(err))));
+    return 1;
+  }
+}
+
+// src/commands/catalog.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+var CACHE_FILE = "providers.cache.json";
+var TTL_HOURS = 24;
+function cachePath() {
+  const dir = configRoot();
+  if (!existsSync3(dir))
+    mkdirSync3(dir, { recursive: true, mode: 448 });
+  return join3(dir, CACHE_FILE);
+}
+function readCache() {
+  try {
+    const p = cachePath();
+    if (!existsSync3(p))
+      return null;
+    return JSON.parse(readFileSync2(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function isFresh(c) {
+  if (!c)
+    return false;
+  const t = Date.parse(c.fetchedAt);
+  if (!Number.isFinite(t))
+    return false;
+  return Date.now() - t < TTL_HOURS * 3600 * 1e3;
+}
+async function fetchBackend(backendUrl) {
+  try {
+    const res = await fetch(`${backendUrl.replace(/\/+$/, "")}/api/providers`);
+    if (!res.ok)
+      return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+function fromBackend(p) {
+  return {
+    id: p.id,
+    display: p.display,
+    blurb: p.blurb,
+    needsKey: p.needs_key,
+    isLocal: !!p.is_local,
+    baseUrl: p.base_url,
+    defaultModel: p.default_model,
+    models: (p.models || []).map((m) => ({
+      id: m.id,
+      label: m.label,
+      note: m.recommended ? "recommended" : m.speed,
+      priceIn: m.price_in,
+      priceOut: m.price_out
+    })),
+    keyHelpUrl: p.key_help_url || "",
+    keyMinLen: 0,
+    envVar: p.env_var || ""
+  };
+}
+async function loadCatalog(opts = {}) {
+  const backendUrl = opts.backendUrl || process.env.RSCOT_BACKEND_URL || "https://learningfind.com/api";
+  if (!opts.force) {
+    const cached2 = readCache();
+    if (isFresh(cached2))
+      return cached2.payload.providers.map(fromBackend);
+  }
+  const payload = await fetchBackend(backendUrl);
+  if (payload) {
+    try {
+      writeFileSync2(
+        cachePath(),
+        JSON.stringify({ fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), payload }, null, 2),
+        { mode: 384 }
+      );
+    } catch {
+    }
+    return payload.providers.map(fromBackend);
+  }
+  const cached = readCache();
+  if (cached)
+    return cached.payload.providers.map(fromBackend);
+  return realProviders();
+}
+
+// src/commands/keys.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3, rmSync, readdirSync, chmodSync as chmodSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+function keysDir() {
+  const d = join4(configRoot(), "keys");
+  if (!existsSync4(d))
+    mkdirSync4(d, { recursive: true, mode: 448 });
+  return d;
+}
+function keyFile(providerId) {
+  return join4(keysDir(), `${providerId}.key`);
+}
+function setKey(providerId, value) {
+  const path = keyFile(providerId);
+  writeFileSync3(path, value.trim(), { mode: 384 });
+  try {
+    chmodSync2(path, 384);
+  } catch {
+  }
+  return path;
+}
+function getKey(providerId) {
+  const path = keyFile(providerId);
+  if (!existsSync4(path))
+    return "";
+  try {
+    return readFileSync3(path, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+function removeKey(providerId) {
+  const path = keyFile(providerId);
+  if (!existsSync4(path))
+    return false;
+  rmSync(path);
+  return true;
+}
+function listKeys() {
+  const d = keysDir();
+  try {
+    return readdirSync(d).filter((f) => f.endsWith(".key")).map((f) => f.replace(/\.key$/, "")).sort();
+  } catch {
+    return [];
+  }
+}
+function keysPath() {
+  return keysDir();
+}
+
+// src/commands/providers.ts
+function maskKey(raw) {
+  if (!raw)
+    return "";
+  if (raw.length <= 8)
+    return "***" + raw.slice(-2);
+  return raw.slice(0, 4) + "\u2022\u2022\u2022\u2022\u2022" + raw.slice(-4);
+}
+function pad(s, w) {
+  return s.length >= w ? s : s + " ".repeat(w - s.length);
+}
+async function readStdinLine(promptText) {
+  process.stdout.write(palette.prompt(promptText));
+  return new Promise((resolve) => {
+    const chunks = [];
+    const onData = (b) => {
+      chunks.push(b);
+      const buf = Buffer.concat(chunks).toString("utf8");
+      const nl2 = buf.indexOf("\n");
+      if (nl2 !== -1) {
+        process.stdin.off("data", onData);
+        try {
+          process.stdin.pause();
+        } catch {
+        }
+        resolve(buf.slice(0, nl2).replace(/\r$/, ""));
+      }
+    };
+    process.stdin.on("data", onData);
+    try {
+      process.stdin.resume();
+    } catch {
+    }
+  });
+}
+async function cmdProvidersList() {
+  const catalog = await loadCatalog();
+  const keyOwners = new Set(listKeys());
+  const { bold, dim, success, warn } = palette;
+  process.stdout.write(bold("\n  Available providers\n\n"));
+  process.stdout.write(
+    dim(
+      "  " + pad("ID", 12) + pad("NAME", 24) + pad("KEY", 12) + pad("DEFAULT MODEL", 28) + "BASE URL\n"
+    )
+  );
+  for (const p of catalog) {
+    const keyState = !p.needsKey ? success("not needed") : keyOwners.has(p.id) ? success("set") : warn("missing");
+    process.stdout.write(
+      "  " + pad(p.id, 12) + pad(p.display, 24) + pad(keyState, 12) + pad(p.defaultModel || "-", 28) + (p.baseUrl || "-") + "\n"
+    );
+  }
+  process.stdout.write("\n");
+  return 0;
+}
+async function cmdProvidersSet(providerId) {
+  const catalog = await loadCatalog();
+  const meta = catalog.find((p) => p.id === providerId);
+  if (!meta) {
+    process.stderr.write(palette.error(`unknown provider: ${providerId}
+`));
+    return 2;
+  }
+  if (!meta.needsKey) {
+    process.stdout.write(`${meta.display} does not require an API key.
+`);
+    return 0;
+  }
+  const value = await readStdinLine(`paste ${meta.display} API key: `);
+  if (!value) {
+    process.stderr.write(palette.error("empty key \u2014 aborted\n"));
+    return 1;
+  }
+  const path = setKey(providerId, value);
+  process.stdout.write(palette.success(`saved ${providerId} key \u2192 ${path}
+`));
+  return 0;
+}
+async function cmdProvidersRemove(providerId) {
+  const ok = removeKey(providerId);
+  if (!ok) {
+    process.stdout.write(`no key stored for ${providerId}
+`);
+    return 0;
+  }
+  process.stdout.write(palette.success(`removed ${providerId} key
+`));
+  return 0;
+}
+async function cmdProvidersTest(providerId) {
+  const catalog = await loadCatalog();
+  const meta = catalog.find((p) => p.id === providerId);
+  if (!meta) {
+    process.stderr.write(palette.error(`unknown provider: ${providerId}
+`));
+    return 2;
+  }
+  const key = getKey(providerId);
+  if (meta.needsKey && !key) {
+    process.stderr.write(palette.error(`no key stored \u2014 run: rscot providers set ${providerId}
+`));
+    return 1;
+  }
+  process.stdout.write(`probing ${meta.display}\u2026
+`);
+  const t0 = Date.now();
+  try {
+    const result = await probe(meta, key);
+    const dt = Date.now() - t0;
+    if (result.ok) {
+      process.stdout.write(
+        palette.success(`ok \xB7 ${dt}ms \xB7 ${result.modelCount} models reported
+`)
+      );
+      return 0;
+    }
+    process.stderr.write(palette.error(`probe failed: ${result.detail}
+`));
+    return 1;
+  } catch (err) {
+    process.stderr.write(palette.error(`probe error: ${err?.message || String(err)}
+`));
+    return 1;
+  }
+}
+async function probe(provider, key) {
+  if (provider.id === "anthropic") {
+    const url2 = provider.baseUrl.replace(/\/+$/, "") + "/messages";
+    const res2 = await fetch(url2, {
+      method: "POST",
+      headers: {
+        "x-api-key": key,
+        "anthropic-version": "2023-06-01",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        model: provider.defaultModel,
+        max_tokens: 1,
+        messages: [{ role: "user", content: "hi" }]
+      })
+    });
+    return { ok: res2.ok, modelCount: res2.ok ? 1 : 0, detail: `HTTP ${res2.status}` };
+  }
+  if (provider.id === "google") {
+    const url2 = provider.baseUrl.replace(/\/+$/, "") + `/models?key=${encodeURIComponent(key)}`;
+    const res2 = await fetch(url2);
+    if (!res2.ok)
+      return { ok: false, modelCount: 0, detail: `HTTP ${res2.status}` };
+    const body2 = await res2.json();
+    const count2 = Array.isArray(body2?.models) ? body2.models.length : 0;
+    return { ok: true, modelCount: count2, detail: "ok" };
+  }
+  const headers = key ? { Authorization: `Bearer ${key}` } : {};
+  const url = provider.baseUrl.replace(/\/+$/, "") + "/models";
+  const res = await fetch(url, { headers });
+  if (!res.ok)
+    return { ok: false, modelCount: 0, detail: `HTTP ${res.status}` };
+  const body = await res.json();
+  const count = Array.isArray(body?.data) ? body.data.length : Array.isArray(body?.models) ? body.models.length : 0;
+  return { ok: true, modelCount: count, detail: "ok" };
+}
+async function cmdModelsList(providerId) {
+  const catalog = await loadCatalog();
+  const { bold, dim } = palette;
+  const targets = providerId ? catalog.filter((p) => p.id === providerId) : catalog;
+  if (providerId && targets.length === 0) {
+    process.stderr.write(palette.error(`unknown provider: ${providerId}
+`));
+    return 2;
+  }
+  for (const p of targets) {
+    process.stdout.write(bold(`
+  ${p.display}
+`));
+    if (p.models.length === 0) {
+      process.stdout.write(dim("    (dynamic \u2014 pulled at runtime)\n"));
+      continue;
+    }
+    for (const m of p.models) {
+      const price = m.priceIn != null || m.priceOut != null ? `  $${m.priceIn ?? "?"}/$${m.priceOut ?? "?"}/M` : "";
+      process.stdout.write(`    ${pad(m.id, 36)}${price}  ${dim(m.note || "")}
+`);
+    }
+  }
+  process.stdout.write("\n");
+  return 0;
+}
+async function cmdModelsSearch(query) {
+  const catalog = await loadCatalog();
+  const q = query.toLowerCase();
+  const { bold } = palette;
+  let hits = 0;
+  for (const p of catalog) {
+    const matches = p.models.filter(
+      (m) => m.id.toLowerCase().includes(q) || m.label.toLowerCase().includes(q)
+    );
+    if (matches.length === 0)
+      continue;
+    process.stdout.write(bold(`
+  ${p.display}
+`));
+    for (const m of matches) {
+      process.stdout.write(`    ${pad(m.id, 36)}  ${m.note || ""}
+`);
+      hits++;
+    }
+  }
+  if (hits === 0)
+    process.stdout.write("(no models matched)\n");
+  process.stdout.write("\n");
+  return 0;
+}
+function cmdKeysList() {
+  const keys = listKeys();
+  if (keys.length === 0) {
+    process.stdout.write("no keys stored.\n");
+    return 0;
+  }
+  for (const id of keys) {
+    const masked = maskKey(getKey(id));
+    process.stdout.write(`  ${pad(id, 14)} ${masked}
+`);
+  }
+  return 0;
+}
+async function cmdKeysSet(providerId) {
+  return cmdProvidersSet(providerId);
+}
+async function cmdKeysRemove(providerId) {
+  return cmdProvidersRemove(providerId);
+}
+
+// src/auth.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4, rmSync as rmSync2, chmodSync as chmodSync3 } from "node:fs";
+import { join as join5 } from "node:path";
+import * as crypto from "node:crypto";
+import * as http from "node:http";
+import { spawn } from "node:child_process";
+var AUTH_BASE = "https://auth.learningfind.com";
+var PROFILE_URL = "https://learningfind.com/api/me/profile";
+var PORT_LO = 49152;
+var PORT_HI = 65535;
+var BIND_ATTEMPTS = 32;
+var LOOPBACK_TIMEOUT_MS = 18e4;
+var ACCESS_LEEWAY_S = 30;
+function authDir() {
+  const d = configRoot();
+  if (!existsSync5(d))
+    mkdirSync5(d, { recursive: true, mode: 448 });
+  return d;
+}
+function pathAccess() {
+  return join5(authDir(), "access");
+}
+function pathRefresh() {
+  return join5(authDir(), "refresh");
+}
+function pathAccessExp() {
+  return join5(authDir(), "access.exp");
+}
+function pathDevice() {
+  return join5(authDir(), "device_id");
+}
+function pathProfile() {
+  return join5(authDir(), "profile.json");
+}
+function pathLocalMode() {
+  return join5(authDir(), "local-mode");
+}
+function writeSecret(path, value) {
+  writeFileSync4(path, value, { mode: 384 });
+  try {
+    chmodSync3(path, 384);
+  } catch {
+  }
+}
+function readMaybe(path) {
+  if (!existsSync5(path))
+    return null;
+  try {
+    return readFileSync4(path, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+function rmIf(path) {
+  if (existsSync5(path))
+    try {
+      rmSync2(path);
+    } catch {
+    }
+}
+function b64url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function genVerifier() {
+  return b64url(crypto.randomBytes(48));
+}
+function challengeS256(v) {
+  return b64url(crypto.createHash("sha256").update(v).digest());
+}
+function genState() {
+  return b64url(crypto.randomBytes(32));
+}
+function parseJwtExp(jwt) {
+  const parts = jwt.split(".");
+  if (parts.length < 2)
+    return null;
+  try {
+    const payload = Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const c = JSON.parse(payload);
+    return typeof c.exp === "number" ? c.exp : null;
+  } catch {
+    return null;
+  }
+}
+function getOrCreateDeviceId() {
+  const existing = readMaybe(pathDevice());
+  if (existing)
+    return existing;
+  const id = "cli-" + b64url(crypto.randomBytes(12));
+  writeSecret(pathDevice(), id);
+  return id;
+}
+function isLocalMode() {
+  return existsSync5(pathLocalMode());
+}
+function setLocalMode(on) {
+  if (on)
+    writeSecret(pathLocalMode(), (/* @__PURE__ */ new Date()).toISOString());
+  else
+    rmIf(pathLocalMode());
+}
+function getStoredProfile() {
+  const raw = readMaybe(pathProfile());
+  if (!raw)
+    return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function storeProfile(p) {
+  if (!p)
+    return;
+  writeSecret(pathProfile(), JSON.stringify(p, null, 2));
+}
+function storeTokens(t) {
+  writeSecret(pathAccess(), t.access);
+  writeSecret(pathRefresh(), t.refresh);
+  const exp = parseJwtExp(t.access);
+  if (exp)
+    writeSecret(pathAccessExp(), String(exp));
+  if (t.profile)
+    storeProfile(t.profile);
+}
+function clearTokens() {
+  rmIf(pathAccess());
+  rmIf(pathRefresh());
+  rmIf(pathAccessExp());
+  rmIf(pathProfile());
+}
+function hasRefresh() {
+  const r = readMaybe(pathRefresh());
+  return !!(r && r.length > 0);
+}
+async function refreshTokens(refresh) {
+  const deviceId = getOrCreateDeviceId();
+  const res = await fetch(`${AUTH_BASE}/auth/desktop/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refresh, device_id: deviceId })
+  });
+  if (!res.ok)
+    throw new Error(`refresh failed: ${res.status}`);
+  return await res.json();
+}
+async function getAccessToken() {
+  const access = readMaybe(pathAccess());
+  const exp = Number(readMaybe(pathAccessExp()) || "0");
+  const now = Math.floor(Date.now() / 1e3);
+  if (access && exp > now + ACCESS_LEEWAY_S)
+    return access;
+  const refresh = readMaybe(pathRefresh());
+  if (!refresh)
+    return null;
+  try {
+    const t = await refreshTokens(refresh);
+    storeTokens(t);
+    return t.access;
+  } catch {
+    return null;
+  }
+}
+function bindLoopback() {
+  return new Promise((resolve, reject) => {
+    let attempts = 0;
+    const tryBind = () => {
+      if (attempts++ >= BIND_ATTEMPTS) {
+        reject(new Error("loopback port exhausted (49152..65535)"));
+        return;
+      }
+      const port = PORT_LO + Math.floor(Math.random() * (PORT_HI - PORT_LO + 1));
+      const server = http.createServer();
+      server.once("error", () => {
+        try {
+          server.close();
+        } catch {
+        }
+        tryBind();
+      });
+      server.listen(port, "127.0.0.1", () => {
+        const addr = server.address();
+        server.removeAllListeners("error");
+        resolve({ server, port: addr.port });
+      });
+    };
+    tryBind();
+  });
+}
+var SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Rscot Agent</title></head><body style="font-family:system-ui,sans-serif;padding:40px;color:#222"><h2>Sign-in complete</h2><p>You can close this window and return to your terminal.</p><script>setTimeout(function(){window.close();},250);</script></body></html>`;
+function waitForCallback(server, expectedState) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      try {
+        server.close();
+      } catch {
+      }
+      reject(new Error("Sign-in timed out after 3 minutes."));
+    }, LOOPBACK_TIMEOUT_MS);
+    server.on("request", (req, res) => {
+      const url = new URL(req.url || "/", "http://127.0.0.1");
+      if (url.pathname !== "/cb") {
+        res.statusCode = 404;
+        res.end("not found");
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const err = url.searchParams.get("error");
+      res.statusCode = 200;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(SUCCESS_HTML);
+      clearTimeout(timer);
+      try {
+        server.close();
+      } catch {
+      }
+      if (err)
+        return reject(new Error(`Auth provider error: ${err}`));
+      if (!code || !state)
+        return reject(new Error("Auth callback missing code/state."));
+      if (state !== expectedState)
+        return reject(new Error("Auth callback state mismatch."));
+      resolve(code);
+    });
+  });
+}
+async function exchangeCode(code, verifier, deviceId) {
+  const res = await fetch(`${AUTH_BASE}/auth/desktop/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, code_verifier: verifier, device_id: deviceId })
+  });
+  if (!res.ok) {
+    let detail = "";
+    try {
+      detail = (await res.json())?.detail || "";
+    } catch {
+      detail = await res.text();
+    }
+    throw new Error(`Token exchange failed (${res.status}): ${detail || res.statusText}`);
+  }
+  return await res.json();
+}
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "win32" ? "cmd" : platform === "darwin" ? "open" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.unref();
+  } catch {
+  }
+}
+async function signIn() {
+  const deviceId = getOrCreateDeviceId();
+  const verifier = genVerifier();
+  const challenge = challengeS256(verifier);
+  const state = genState();
+  const { server, port } = await bindLoopback();
+  const params = new URLSearchParams({
+    port: String(port),
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    device_id: deviceId,
+    client: "cli"
+  });
+  const authUrl = `${AUTH_BASE}/auth/desktop/start?${params.toString()}`;
+  process.stdout.write(`
+Opening browser to: ${authUrl}
+`);
+  process.stdout.write("If the browser does not open, paste that URL manually.\n");
+  process.stdout.write(`Waiting for callback on http://127.0.0.1:${port}/cb (up to 3 minutes)\u2026
+
+`);
+  openBrowser(authUrl);
+  const code = await waitForCallback(server, state);
+  const bundle = await exchangeCode(code, verifier, deviceId);
+  storeTokens(bundle);
+  setLocalMode(false);
+  if (!bundle.profile) {
+    const p = await fetchProfile(bundle.access);
+    if (p)
+      storeProfile(p);
+    return p;
+  }
+  return bundle.profile;
+}
+async function signOut() {
+  const refresh = readMaybe(pathRefresh());
+  if (refresh) {
+    const deviceId = getOrCreateDeviceId();
+    try {
+      await fetch(`${AUTH_BASE}/auth/desktop/session`, {
+        method: "DELETE",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ refresh, device_id: deviceId })
+      });
+    } catch {
+    }
+  }
+  clearTokens();
+}
+async function fetchProfile(access) {
+  try {
+    const res = await fetch(PROFILE_URL, { headers: { "Authorization": `Bearer ${access}` } });
+    if (!res.ok)
+      return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function refreshProfile() {
+  const t = await getAccessToken();
+  if (!t)
+    return null;
+  const p = await fetchProfile(t);
+  if (p)
+    storeProfile(p);
+  return p;
+}
+
+// src/index.ts
+if (process.stdout.isTTY || process.env.FORCE_COLOR) {
+  kleur2.enabled = true;
+}
+var VERSION2 = "1.2.0";
+var AUTH_FREE_COMMANDS = /* @__PURE__ */ new Set([
+  "login",
+  "logout",
+  "whoami",
+  "version",
+  "help"
+]);
+async function cmdLogin(local) {
+  if (local) {
+    setLocalMode(true);
+    process.stdout.write(
+      palette.success("\u2713") + " Local mode enabled. Future commands skip sign-in.\n"
+    );
+    process.stdout.write(palette.dim("  Run `rscot login` to switch back to a cloud account.\n"));
+    return 0;
+  }
+  try {
+    const profile = await signIn();
+    if (!profile) {
+      process.stdout.write(palette.warn("!") + " Sign-in completed but no profile returned.\n");
+      return 0;
+    }
+    process.stdout.write(
+      palette.success("\u2713") + " Signed in as " + palette.bold(profile.email) + palette.dim(" \xB7 tier ") + palette.cyan(profile.tier || "free") + "\n"
+    );
+    return 0;
+  } catch (err) {
+    process.stderr.write(
+      palette.error("\u2717") + " Sign-in failed: " + (err instanceof Error ? err.message : String(err)) + "\n"
+    );
+    return 1;
+  }
+}
+async function cmdLogout() {
+  if (isLocalMode()) {
+    setLocalMode(false);
+    process.stdout.write(palette.success("\u2713") + " Local mode disabled.\n");
+  }
+  if (!hasRefresh()) {
+    process.stdout.write(palette.dim("  No active session to sign out.\n"));
+    clearTokens();
+    return 0;
+  }
+  await signOut();
+  process.stdout.write(palette.success("\u2713") + " Signed out.\n");
+  return 0;
+}
+async function cmdWhoami() {
+  if (isLocalMode()) {
+    process.stdout.write(
+      palette.info("\u203A") + " Local mode (no cloud account). Run `rscot login` to switch.\n"
+    );
+    return 0;
+  }
+  if (!hasRefresh()) {
+    process.stdout.write(
+      palette.warn("!") + " Not signed in. Run `rscot login` (or `rscot login --local`).\n"
+    );
+    return 1;
+  }
+  const fresh = await refreshProfile();
+  const profile = fresh || getStoredProfile();
+  if (!profile) {
+    process.stdout.write(palette.warn("!") + " Signed in but profile unavailable. Try `rscot login` again.\n");
+    return 1;
+  }
+  process.stdout.write("  " + palette.dim("email   ") + palette.bold(profile.email) + "\n");
+  process.stdout.write("  " + palette.dim("tier    ") + palette.cyan(profile.tier || "free") + "\n");
+  if (typeof profile.quota_used === "number") {
+    process.stdout.write("  " + palette.dim("quota   ") + palette.cyan(String(profile.quota_used)) + "\n");
+  }
+  if (profile.user_id) {
+    process.stdout.write("  " + palette.dim("user_id ") + palette.cyan(profile.user_id) + "\n");
+  }
+  return 0;
+}
+function requireAuth(head) {
+  if (AUTH_FREE_COMMANDS.has(head))
+    return true;
+  if (isLocalMode())
+    return true;
+  if (hasRefresh())
+    return true;
+  return false;
+}
+function printAuthGateMessage() {
+  process.stderr.write(
+    palette.error("\u2717") + " Sign in first: " + palette.bold("rscot login") + palette.dim("  (or `rscot login --local` for offline-only mode)") + "\n"
+  );
+}
+function printHelp() {
+  process.stdout.write(
+    [
+      palette.bold("rscot") + "  " + palette.dim("Rscot Agent \u2014 npx onramp"),
+      "",
+      "  " + palette.accent("USAGE"),
+      "    npx rscot                              run the interactive onboarding flow",
+      "    npx rscot --version                    print version",
+      "    npx rscot --help                       print this help",
+      "    npx rscot --no-prompt                  run env probe only (CI-safe smoke)",
+      "    npx rscot --local                      bypass auth gate for one command",
+      "",
+      "  " + palette.accent("ACCOUNT"),
+      "    npx rscot login                        sign in via browser (loopback PKCE)",
+      "    npx rscot login --local                skip cloud sign-in, mark local mode",
+      "    npx rscot logout                       revoke session + clear stored tokens",
+      "    npx rscot whoami                       show signed-in profile / tier / quota",
+      "",
+      "  " + palette.accent("PROVIDERS"),
+      "    npx rscot providers list               list all providers and key status",
+      "    npx rscot providers set <id>           paste an API key for a provider",
+      "    npx rscot providers test <id>          probe the provider with stored key",
+      "    npx rscot providers remove <id>        delete the stored key",
+      "",
+      "  " + palette.accent("MODELS"),
+      "    npx rscot models list                  list every catalog model",
+      "    npx rscot models list --provider <id>  filter by provider",
+      "    npx rscot models search <substr>       cross-provider model lookup",
+      "",
+      "  " + palette.accent("KEYS / CONFIG"),
+      "    npx rscot keys list                    show which providers have keys",
+      "    npx rscot keys set <id>                alias for `providers set`",
+      "    npx rscot keys remove <id>             alias for `providers remove`",
+      "    npx rscot keys path                    print keychain dir",
+      "    npx rscot config path                  print config file path",
+      "",
+      "  " + palette.accent("LICENSE"),
+      "    NonCommercial \xB7 source-available. See LICENSE at the repo root.",
+      ""
+    ].join("\n") + "\n"
+  );
+}
+function indexOfPositional(argv) {
+  for (let i = 0; i < argv.length; i++) {
+    if (!argv[i].startsWith("-"))
+      return i;
+  }
+  return -1;
+}
+async function dispatch(argv) {
+  const head = argv[0];
+  if (head === "login") {
+    return cmdLogin(argv.includes("--local"));
+  }
+  if (head === "logout") {
+    return cmdLogout();
+  }
+  if (head === "whoami") {
+    return cmdWhoami();
+  }
+  if (head === "providers" || head === "models" || head === "keys" || head === "config") {
+    const sub = argv[1];
+    if (head === "providers") {
+      if (sub === "list")
+        return cmdProvidersList();
+      if (sub === "set" && argv[2])
+        return cmdProvidersSet(argv[2]);
+      if (sub === "test" && argv[2])
+        return cmdProvidersTest(argv[2]);
+      if (sub === "remove" && argv[2])
+        return cmdProvidersRemove(argv[2]);
+      process.stderr.write(palette.error("usage: rscot providers <list|set|test|remove> [id]\n"));
+      return 2;
+    }
+    if (head === "models") {
+      if (sub === "list") {
+        const provFlag = argv.indexOf("--provider");
+        const provId = provFlag >= 0 ? argv[provFlag + 1] : void 0;
+        return cmdModelsList(provId);
+      }
+      if (sub === "search" && argv[2])
+        return cmdModelsSearch(argv[2]);
+      process.stderr.write(palette.error("usage: rscot models <list [--provider id] | search <substr>>\n"));
+      return 2;
+    }
+    if (head === "keys") {
+      if (sub === "list")
+        return cmdKeysList();
+      if (sub === "set" && argv[2])
+        return cmdKeysSet(argv[2]);
+      if (sub === "remove" && argv[2])
+        return cmdKeysRemove(argv[2]);
+      if (sub === "path") {
+        process.stdout.write(keysPath() + "\n");
+        return 0;
+      }
+      process.stderr.write(palette.error("usage: rscot keys <list|set|remove|path> [id]\n"));
+      return 2;
+    }
+    if (head === "config") {
+      if (sub === "path") {
+        process.stdout.write(configPath() + "\n");
+        return 0;
+      }
+      process.stderr.write(palette.error("usage: rscot config <path>\n"));
+      return 2;
+    }
+  }
+  return -1;
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv.includes("--version") || argv.includes("-v")) {
+    process.stdout.write(VERSION2 + "\n");
+    return;
+  }
+  if (argv.includes("--help") || argv.includes("-h")) {
+    printHelp();
+    return;
+  }
+  const positional = indexOfPositional(argv);
+  const head = positional !== -1 ? argv[positional] : "";
+  const localFlag = argv.includes("--local");
+  if (!localFlag && !requireAuth(head)) {
+    printAuthGateMessage();
+    process.exit(1);
+    return;
+  }
+  if (positional !== -1) {
+    const rc = await dispatch(argv.slice(positional));
+    if (rc !== -1) {
+      process.exit(rc);
+      return;
+    }
+  }
+  const code = await runInstall({
+    noninteractive: argv.includes("--no-prompt") || !process.stdin.isTTY
+  });
+  process.exit(code);
+}
+main().catch((err) => {
+  process.stderr.write(
+    palette.error("fatal: " + (err instanceof Error ? err.stack ?? err.message : String(err))) + "\n"
+  );
+  process.exit(1);
+});