rscot-agent 1.7.48 → 1.7.49

package/dist/index.js

@@ -8,7 +8,7 @@ import kleur2 from "kleur";
 // src/install.ts
 import prompts from "prompts";
 import ora from "ora";
-import { existsSync as existsSync4, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
 
 // src/ui.ts
 import kleur from "kleur";
@@ -127,8 +127,8 @@ async function tryRun(cmd, args) {
     let resolvedPath;
     try {
       const which = process.platform === "win32" ? "where" : "which";
-      const w2 = await pexec(which, [cmd], { timeout: 2e3, windowsHide: true });
-      resolvedPath = w2.stdout.split(/\r?\n/)[0]?.trim();
+      const w3 = await pexec(which, [cmd], { timeout: 2e3, windowsHide: true });
+      resolvedPath = w3.stdout.split(/\r?\n/)[0]?.trim();
     } catch {
     }
     return { out: stdout.trim(), path: resolvedPath };
@@ -571,7 +571,7 @@ function loadConfig() {
 }
 
 // src/repl.ts
-import readline from "node:readline";
+import readline2 from "node:readline";
 import { homedir as homedir4 } from "node:os";
 
 // src/agentRuntime.ts
@@ -694,1174 +694,2459 @@ function runAgent(opts) {
   });
 }
 
-// src/repl.ts
-var VERSION = "1.7.48";
-var BUILD = "a7f31c2";
-function homeShort(p) {
-  const h = homedir4();
-  return p.startsWith(h) ? "~" + p.slice(h.length) : p;
+// src/nativeAgent.ts
+import readline from "node:readline";
+
+// ../tauri-shell/src/agent-core/permissions.ts
+var DEFAULT_PERMISSIONS = {
+  writes: "ask",
+  // never auto by default — file writes are irreversible
+  commands: "ask",
+  // shell commands always confirm
+  deletes: "ask",
+  // deletes always confirm
+  network: "auto",
+  // network reads are low-risk
+  reads: "auto"
+  // pure reads always allowed
+};
+function categoryFor(toolName) {
+  if ([
+    "write_file",
+    "edit_file",
+    "apply_diff",
+    "apply_unified_diff",
+    "format_file"
+  ].includes(toolName))
+    return "writes";
+  if ([
+    "run_command",
+    "start_background_task",
+    "run_python_repl",
+    "run_lint"
+  ].includes(toolName))
+    return "commands";
+  if (["delete_file", "move_file", "rename_file"].includes(toolName))
+    return "deletes";
+  if ([
+    "web_search",
+    "verify_package",
+    "verify_package_batch",
+    "download_dataset",
+    "read_pdf"
+  ].includes(toolName))
+    return "network";
+  if ([
+    "read_file",
+    "list_dir",
+    "grep",
+    "glob",
+    "git_diff_summary",
+    "system_info",
+    "gpu_info"
+  ].includes(toolName))
+    return "reads";
+  return null;
 }
-function w(s) {
-  process.stdout.write(s);
+
+// ../tauri-shell/src/agent-core/loop.ts
+async function runAgentLoop(driver) {
+  for (let iter = 0; iter < driver.maxTurns; iter++) {
+    let resp;
+    try {
+      resp = await driver.nextTurn();
+    } catch (err) {
+      driver.onTurnError(err);
+      return;
+    }
+    if (resp.type === "message") {
+      driver.onMessage(resp);
+      return;
+    }
+    if (resp.type === "done") {
+      await driver.onDone(resp);
+      return;
+    }
+    if (resp.type === "blocked") {
+      driver.onBlocked(resp);
+      continue;
+    }
+    driver.onToolCall(resp);
+    const cat = categoryFor(resp.name);
+    if (cat) {
+      const mode = driver.permissionMode(cat);
+      if (mode === "deny") {
+        driver.onRefused(resp, "policy");
+        continue;
+      }
+      if (mode === "ask") {
+        const ok = await driver.requestApproval(resp);
+        if (!ok) {
+          driver.onRefused(resp, "user");
+          continue;
+        }
+      }
+    }
+    const exec = await driver.executeTool(resp);
+    if (driver.isCancelled()) {
+      driver.onCancelledAfterTool(resp, exec);
+      return;
+    }
+    driver.onToolResult(resp, exec);
+  }
+  driver.onCapReached();
 }
-function printReadyBanner(cfg, workspace, backendUrl2) {
-  w("\n" + brandHeader(VERSION, BUILD) + "\n\n");
-  w(
-    "  " + palette.success("\u25CF") + "  " + palette.dim("ready  ") + palette.cyan(cfg.provider + "/" + cfg.model) + "  " + palette.dim("\xB7  ") + palette.cmd(homeShort(workspace)) + "\n"
-  );
-  w(
-    "  " + palette.dim("       backend ") + palette.cyan(backendUrl2) + "\n"
-  );
+
+// ../tauri-shell/src/agent-core/apiClient.ts
+function resolveGateway(cfg) {
+  if (cfg.provider === "custom") {
+    const dict = cfg.customHeaders || {};
+    const trimmedDict = {};
+    for (const [k, v] of Object.entries(dict)) {
+      const key = k.trim();
+      if (key)
+        trimmedDict[key] = v ?? "";
+    }
+    return {
+      base_url: (cfg.customBaseUrl || cfg.baseUrl || "").trim(),
+      model: (cfg.customModel || cfg.model || "").trim(),
+      auth_header: (cfg.customAuthHeader || "").trim() || void 0,
+      custom_headers: Object.keys(trimmedDict).length ? trimmedDict : void 0
+    };
+  }
+  return { base_url: cfg.baseUrl || "", model: cfg.model || "" };
 }
-function printReplHelp() {
-  w("\n");
-  w("  " + palette.bold("REPL commands") + "\n");
-  w("    " + palette.cyan("<any text>") + palette.dim("       send as prompt to the agent") + "\n");
-  w("    " + palette.cyan("/help") + palette.dim("            show this help") + "\n");
-  w("    " + palette.cyan("/reset") + palette.dim("           start a fresh conversation (drop --resume)") + "\n");
-  w("    " + palette.cyan("/cd <dir>") + palette.dim("        change working directory") + "\n");
-  w("    " + palette.cyan("exit") + palette.dim(" | ") + palette.cyan("quit") + palette.dim(" | Ctrl+D  leave REPL") + "\n");
-  w("    " + palette.dim("(during a turn, Ctrl+C forwards to agent and cancels it)") + "\n\n");
+var _rscotTokenCache = null;
+var _onBearerRefreshed = null;
+async function loadRscotToken() {
+  if (_rscotTokenCache !== null)
+    return _rscotTokenCache;
+  try {
+    const { invoke } = await import("@tauri-apps/api/core");
+    const tok = await invoke("read_rscot_token") || "";
+    _rscotTokenCache = tok;
+    return tok;
+  } catch {
+    _rscotTokenCache = "";
+    return "";
+  }
 }
-function promptLine(promptStr) {
-  return new Promise((resolve2) => {
-    const rl = readline.createInterface({
-      input: process.stdin,
-      output: process.stdout,
-      terminal: true,
-      historySize: 500
+var _refreshInFlight = null;
+var _lastRefreshMs = 0;
+async function refreshAndSyncBearer() {
+  if (_refreshInFlight)
+    return _refreshInFlight;
+  const sinceLast = Date.now() - _lastRefreshMs;
+  if (sinceLast < 3e3) {
+    try {
+      const { invoke } = await import("@tauri-apps/api/core");
+      const cached = (await invoke("auth_current_access_token") || "").trim();
+      if (cached)
+        return cached;
+    } catch {
+    }
+  }
+  _refreshInFlight = (async () => {
+    try {
+      const { invoke } = await import("@tauri-apps/api/core");
+      await invoke("auth_refresh_session");
+      const fresh = (await invoke("auth_current_access_token") || "").trim();
+      if (!fresh)
+        return null;
+      try {
+        _onBearerRefreshed?.(fresh);
+      } catch {
+      }
+      _lastRefreshMs = Date.now();
+      return fresh;
+    } catch {
+      return null;
+    } finally {
+      setTimeout(() => {
+        _refreshInFlight = null;
+      }, 0);
+    }
+  })();
+  return _refreshInFlight;
+}
+var ApiClient = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  currentBearer() {
+    return this.cfg.authBearer || "";
+  }
+  async authHeaders(overrideBearer) {
+    const bearer = overrideBearer ?? this.currentBearer();
+    const base = {
+      "Authorization": `Bearer ${bearer}`,
+      "X-CWA-Token": bearer,
+      "Content-Type": "application/json"
+    };
+    const tok = await loadRscotToken();
+    if (tok)
+      base["X-Rscot-Token"] = tok;
+    return base;
+  }
+  async doFetchWithRefresh(url, init) {
+    const res = await fetch(url, init);
+    if (res.status !== 401)
+      return res;
+    const fresh = await refreshAndSyncBearer();
+    if (!fresh)
+      return res;
+    this.cfg.authBearer = fresh;
+    const retryHeaders = {
+      ...init.headers,
+      "Authorization": `Bearer ${fresh}`,
+      "X-CWA-Token": fresh
+    };
+    return fetch(url, { ...init, headers: retryHeaders });
+  }
+  /* private sync headers() removed — unused; all callers use authHeaders() */
+  async turn(messages, opts) {
+    if (!messages.length)
+      throw new Error("turn() called with empty messages");
+    const body = {
+      messages,
+      provider: this.cfg.provider,
+      api_key: this.cfg.apiKey,
+      temperature: this.cfg.temperature
+    };
+    const gw = resolveGateway(this.cfg);
+    if (gw.model)
+      body.model = gw.model;
+    if (gw.base_url)
+      body.base_url = gw.base_url;
+    if (gw.auth_header)
+      body.auth_header = gw.auth_header;
+    if (gw.custom_headers)
+      body.custom_headers = gw.custom_headers;
+    if (this.cfg.stackHint)
+      body.stack_hint = this.cfg.stackHint;
+    if (this.cfg.architectModel)
+      body.architect_model = this.cfg.architectModel;
+    if (this.cfg.editorModel)
+      body.editor_model = this.cfg.editorModel;
+    if (this.cfg.reviewerModel)
+      body.reviewer_model = this.cfg.reviewerModel;
+    if (this.cfg.architectProvider)
+      body.architect_provider = this.cfg.architectProvider;
+    if (this.cfg.editorProvider)
+      body.editor_provider = this.cfg.editorProvider;
+    if (this.cfg.reviewerProvider)
+      body.reviewer_provider = this.cfg.reviewerProvider;
+    if (opts?.workspaceRoot)
+      body.workspace_root = opts.workspaceRoot;
+    if (opts?.sessionId)
+      body.session_id = opts.sessionId;
+    const res = await this.doFetchWithRefresh(`${this.cfg.backendUrl}/code-workspace/turn`, {
+      method: "POST",
+      headers: await this.authHeaders(),
+      body: JSON.stringify(body)
     });
-    rl.setPrompt(promptStr);
-    rl.prompt();
-    let settled = false;
-    const done = (v) => {
-      if (settled)
-        return;
-      settled = true;
+    if (!res.ok) {
+      let detail = "";
       try {
-        rl.close();
+        detail = (await res.json())?.detail || "";
       } catch {
+        detail = await res.text();
       }
-      resolve2(v);
+      throw new Error(`backend ${res.status}: ${detail || res.statusText}`);
+    }
+    return await res.json();
+  }
+  /**
+   * Day 22 (π'-B) — SSE streaming sibling of turn(). Yields one StreamEvent
+   * at a time until a terminal event (done/message/tool_call/blocked/error).
+   * Identical wire protocol to the vscode-extension client; see
+   * backend/app/code_workspace_agent/streaming.py.
+   */
+  async *turnStream(messages, signal, opts) {
+    if (!messages.length)
+      throw new Error("turnStream() called with empty messages");
+    const body = {
+      messages,
+      provider: this.cfg.provider,
+      api_key: this.cfg.apiKey,
+      temperature: this.cfg.temperature
     };
-    rl.once("line", (line) => done(line));
-    rl.once("close", () => done(null));
-    rl.on("SIGINT", () => done(null));
-  });
+    const gw2 = resolveGateway(this.cfg);
+    if (gw2.model)
+      body.model = gw2.model;
+    if (gw2.base_url)
+      body.base_url = gw2.base_url;
+    if (gw2.auth_header)
+      body.auth_header = gw2.auth_header;
+    if (gw2.custom_headers)
+      body.custom_headers = gw2.custom_headers;
+    if (this.cfg.stackHint)
+      body.stack_hint = this.cfg.stackHint;
+    if (this.cfg.architectModel)
+      body.architect_model = this.cfg.architectModel;
+    if (this.cfg.editorModel)
+      body.editor_model = this.cfg.editorModel;
+    if (this.cfg.reviewerModel)
+      body.reviewer_model = this.cfg.reviewerModel;
+    if (this.cfg.architectProvider)
+      body.architect_provider = this.cfg.architectProvider;
+    if (this.cfg.editorProvider)
+      body.editor_provider = this.cfg.editorProvider;
+    if (this.cfg.reviewerProvider)
+      body.reviewer_provider = this.cfg.reviewerProvider;
+    if (opts?.workspaceRoot)
+      body.workspace_root = opts.workspaceRoot;
+    if (opts?.sessionId)
+      body.session_id = opts.sessionId;
+    const res = await this.doFetchWithRefresh(`${this.cfg.backendUrl}/code-workspace/turn-stream`, {
+      method: "POST",
+      headers: await this.authHeaders(),
+      body: JSON.stringify(body),
+      signal
+    });
+    if (!res.ok || !res.body) {
+      let detail = "";
+      try {
+        detail = (await res.json())?.detail || "";
+      } catch {
+        detail = await res.text();
+      }
+      throw new Error(`backend ${res.status}: ${detail || res.statusText}`);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buf += decoder.decode(value, { stream: true });
+      let blockEnd;
+      while ((blockEnd = buf.indexOf("\n\n")) !== -1) {
+        const block = buf.slice(0, blockEnd);
+        buf = buf.slice(blockEnd + 2);
+        const ev = parseSseBlock(block);
+        if (ev)
+          yield ev;
+      }
+    }
+  }
+  async stacks() {
+    const r = await this.doFetchWithRefresh(`${this.cfg.backendUrl}/code-workspace/stacks`, {
+      headers: await this.authHeaders()
+    });
+    if (!r.ok)
+      return { stacks: [] };
+    return r.json();
+  }
+  async getJson(pathAndQuery) {
+    const r = await this.doFetchWithRefresh(`${this.cfg.backendUrl}${pathAndQuery}`, {
+      headers: await this.authHeaders()
+    });
+    if (!r.ok)
+      return { error: `backend ${r.status}` };
+    return r.json();
+  }
+  async postJson(pathAndQuery, body) {
+    const r = await this.doFetchWithRefresh(`${this.cfg.backendUrl}${pathAndQuery}`, {
+      method: "POST",
+      headers: await this.authHeaders(),
+      body: JSON.stringify(body)
+    });
+    if (!r.ok)
+      return { error: `backend ${r.status}` };
+    return r.json();
+  }
+};
+function parseSseBlock(block) {
+  let event = "message";
+  let data = "";
+  for (const line of block.split("\n")) {
+    if (line.startsWith("event:"))
+      event = line.slice(6).trim();
+    else if (line.startsWith("data:"))
+      data = (data ? data + "\n" : "") + line.slice(5).trim();
+  }
+  if (!data)
+    return null;
+  try {
+    const parsed = JSON.parse(data);
+    return { type: event, ...parsed };
+  } catch {
+    return null;
+  }
 }
-async function runOneShot(prompt, workspace, backendUrl2) {
-  const cfg = loadConfig();
-  if (!cfg) {
-    process.stderr.write(palette.error("rscot: not installed \u2014 run `rscot` first\n"));
-    return 1;
+
+// ../tauri-shell/src/agent-core/host.ts
+var HostUnavailableError = class extends Error {
+  constructor(capability) {
+    super(`Host capability '${capability}' is not available in the current runtime. Launch with 'cargo tauri dev' for native filesystem + shell access.`);
   }
-  const pf = await preflightBackend(backendUrl2);
-  if (!pf.ok) {
-    process.stderr.write(
-      palette.error("rscot: backend unreachable at " + backendUrl2) + palette.dim(" (" + (pf.detail ?? "no detail") + ")\n") + palette.dim("  start it with `docker compose up -d` or set RSCOT_BACKEND_URL\n")
-    );
-    return 1;
+};
+
+// ../tauri-shell/src/agent-core/executors.ts
+async function execute(name, args, ctx) {
+  try {
+    switch (name) {
+      case "list_dir":
+        return await listDir(args, ctx);
+      case "read_file":
+        return await readFile(args, ctx);
+      case "format_file":
+        return await formatFile(args, ctx);
+      case "write_file":
+        return await writeFile(args, ctx);
+      case "edit_file":
+        return await editFile(args, ctx);
+      case "glob":
+        return await glob(args, ctx);
+      case "grep":
+        return await grep(args, ctx);
+      case "run_command":
+        return await runCommand(args, ctx);
+      case "system_info":
+        if (!ctx.host.capabilities.filesystem)
+          return notImpl("system_info");
+        return await ctx.host.systemInfo(args?.level === "full" ? "full" : "brief");
+      case "allocate_port":
+        if (!ctx.host.capabilities.filesystem)
+          return notImpl("allocate_port");
+        return await ctx.host.allocatePort({ prefer: args?.prefer, range: args?.range });
+      case "list_processes":
+        if (!ctx.host.capabilities.filesystem)
+          return notImpl("list_processes");
+        return await ctx.host.listProcesses(args?.include_finished === true);
+      case "kill_process":
+        if (!ctx.host.capabilities.filesystem)
+          return notImpl("kill_process");
+        return await ctx.host.killProcess(args.pid, args.signal ?? "SIGTERM");
+      case "verify_package":
+        return ctx.api.getJson(
+          `/code-workspace/verify-package?ecosystem=${encodeURIComponent(args.ecosystem)}&name=${encodeURIComponent(args.name)}`
+        );
+      case "verify_package_batch":
+        return ctx.api.postJson(
+          `/code-workspace/verify-package-batch`,
+          { packages: args.packages || [] }
+        );
+      case "web_search": {
+        const p = new URLSearchParams({ query: args.query });
+        if (args.sources?.length)
+          p.set("sources", args.sources.join(","));
+        if (args.max_per_source)
+          p.set("max_per_source", String(args.max_per_source));
+        return ctx.api.getJson(`/code-workspace/web-search?${p.toString()}`);
+      }
+      case "gpu_info":
+        return ctx.api.getJson(`/code-workspace/gpu-info`);
+      case "start_background_task": {
+        const cwd = args.cwd && args.cwd.trim() || (ctx.host.workspaceRoot() || "");
+        try {
+          const { invoke } = await import("@tauri-apps/api/core");
+          return await invoke("local_bg_start", {
+            command: args.command,
+            cwd,
+            label: args.label || ""
+          });
+        } catch (e) {
+          return { error: `local_bg_start failed: ${e?.message || String(e)}` };
+        }
+      }
+      case "check_background_task": {
+        try {
+          const { invoke } = await import("@tauri-apps/api/core");
+          return await invoke("local_bg_check", {
+            taskId: args.task_id,
+            tailLines: args.tail_lines || 200
+          });
+        } catch (e) {
+          return { error: `local_bg_check failed: ${e?.message || String(e)}` };
+        }
+      }
+      case "list_background_tasks": {
+        try {
+          const { invoke } = await import("@tauri-apps/api/core");
+          const tasks = await invoke("local_bg_list");
+          return { tasks };
+        } catch (e) {
+          return { error: `local_bg_list failed: ${e?.message || String(e)}` };
+        }
+      }
+      case "cancel_background_task": {
+        try {
+          const { invoke } = await import("@tauri-apps/api/core");
+          return await invoke("local_bg_cancel", {
+            taskId: args.task_id,
+            signal: args.signal || "TERM"
+          });
+        } catch (e) {
+          return { error: `local_bg_cancel failed: ${e?.message || String(e)}` };
+        }
+      }
+      case "mount_external_folder":
+        return await mountExternalFolder(args, ctx);
+      case "download_dataset":
+        return await downloadDataset(args, ctx);
+      case "run_lint":
+        return notImpl("run_lint");
+      case "create_pr":
+        return notImpl("create_pr");
+      case "agent_self_eval": {
+        const files = args.files || [];
+        const fileContents = {};
+        if (ctx.host.capabilities.filesystem && ctx.host.workspaceRoot()) {
+          for (const rel of files.slice(0, 20)) {
+            try {
+              const abs = joinPath(ctx.host.workspaceRoot(), rel);
+              fileContents[rel] = (await ctx.host.readFile(abs)).slice(0, 4e4);
+            } catch (e) {
+              fileContents[rel] = `[error reading: ${e?.message || e}]`;
+            }
+          }
+        }
+        return ctx.api.postJson("/code-workspace/self-eval", {
+          stack_hint: args.stack_hint,
+          files,
+          summary: args.summary,
+          file_contents: fileContents
+        });
+      }
+      default:
+        return { error: "unknown_tool", name };
+    }
+  } catch (err) {
+    if (err instanceof HostUnavailableError) {
+      return {
+        error: "host_unavailable",
+        capability: err.message,
+        hint: "This tool needs the native Tauri shell. The chat panel works in browser preview but filesystem + shell tools don't."
+      };
+    }
+    return { error: err?.name || "ExecutorError", message: err?.message || String(err), tool: name };
   }
-  return runAgent({ workspace, backendUrl: backendUrl2, prompt });
 }
-async function runRepl(workspace, backendUrl2) {
-  const cfg = loadConfig();
-  if (!cfg) {
-    process.stderr.write(palette.error("rscot: not installed \u2014 run `rscot` first\n"));
-    return 1;
+var notImpl = (n) => ({
+  error: "host_unavailable",
+  tool: n,
+  hint: "Launch with `cargo tauri dev` for native host capabilities. In web preview, this tool is stubbed."
+});
+async function listDir(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace", hint: "Pick a folder first." };
+  const abs = joinPath(root, args.path || ".");
+  const entries = await ctx.host.readDir(abs, true, 500);
+  return { path: args.path || ".", entries, truncated: entries.length >= 500 };
+}
+async function readFile(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace" };
+  const abs = joinPath(root, args.path);
+  const stat = await ctx.host.stat(abs);
+  if (!stat || !stat.isFile)
+    return { error: "not_a_file", path: args.path };
+  if (stat.size > 200 * 1024 && (args.start_line == null || args.end_line == null)) {
+    return { error: "too_large", size_bytes: stat.size, hint: "specify start_line + end_line" };
+  }
+  const content = await ctx.host.readFile(abs);
+  const lines = content.split(/\r?\n/);
+  if (args.start_line || args.end_line) {
+    const s = Math.max(1, args.start_line || 1);
+    const e = Math.min(lines.length, args.end_line || lines.length);
+    return {
+      path: args.path,
+      content: lines.slice(s - 1, e).join("\n"),
+      encoding: "utf-8",
+      total_lines: lines.length,
+      returned_lines: [s, e]
+    };
   }
-  const pf = await preflightBackend(backendUrl2);
-  printReadyBanner(cfg, workspace, backendUrl2);
-  if (!pf.ok) {
-    w(
-      "  " + palette.error("\u2717") + palette.dim("  backend  ") + palette.error("unreachable") + palette.dim("  (" + (pf.detail ?? "no detail") + ")\n")
-    );
-    w(palette.dim("     start it with `docker compose up -d` or set RSCOT_BACKEND_URL\n\n"));
-  } else {
-    w("\n");
+  return {
+    path: args.path,
+    content,
+    encoding: "utf-8",
+    total_lines: lines.length,
+    returned_lines: [1, lines.length]
+  };
+}
+async function writeFile(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace" };
+  const abs = joinPath(root, args.path);
+  let previous = null;
+  try {
+    previous = await ctx.host.readFile(abs);
+  } catch {
   }
-  w("  " + palette.dim("hint  type a prompt \xB7 /help for commands \xB7 empty line or Ctrl+D quits\n\n"));
-  let currentWorkspace = workspace;
-  let turnCount = 0;
-  let resumeNext = false;
-  while (true) {
-    const cwdShort = homeShort(currentWorkspace);
-    const promptStr = palette.dim(cwdShort + " ") + palette.prompt("\u258C ");
-    const raw = await promptLine(promptStr);
-    if (raw === null)
-      break;
-    const line = raw.trim();
-    if (line === "" || line === "exit" || line === "quit")
-      break;
-    if (line === "/help") {
-      printReplHelp();
-      continue;
+  ctx.rollback.set(abs, previous);
+  const parent = abs.replace(/[/\\][^/\\]+$/, "");
+  if (parent !== abs) {
+    try {
+      await ctx.host.mkdir(parent, true);
+    } catch {
     }
-    if (line === "/reset") {
-      resumeNext = false;
-      turnCount = 0;
-      w(palette.dim("  \xB7 conversation reset \xB7 next turn starts a fresh session\n\n"));
+  }
+  const r = await ctx.host.writeFile(abs, args.content);
+  return {
+    path: args.path,
+    ...r,
+    rollback_token: `rb_${Date.now().toString(36)}_${ctx.rollback.size}`
+  };
+}
+async function editFile(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace" };
+  const expected = args.expect_count ?? 1;
+  const abs = joinPath(root, args.path);
+  const content = await ctx.host.readFile(abs);
+  let count = 0, idx = 0;
+  while ((idx = content.indexOf(args.search, idx)) !== -1) {
+    count++;
+    idx += args.search.length;
+  }
+  if (count !== expected) {
+    return {
+      error: "match_count_mismatch",
+      expected_count: expected,
+      actual_count: count,
+      hint: count === 0 ? "search string not found \u2014 re-read the file" : `widen 'search' or pass expect_count=${count}`
+    };
+  }
+  ctx.rollback.set(abs, content);
+  const next = content.split(args.search).join(args.replace);
+  await ctx.host.writeFile(abs, next);
+  return { path: args.path, applied: true, matches_replaced: count };
+}
+async function glob(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace" };
+  const abs = joinPath(root, args.path || ".");
+  const max = Math.min(args.max_results ?? 200, 2e3);
+  const re = globToRegExp(args.pattern);
+  const all = await ctx.host.readDir(abs, true, max * 5);
+  const matches = all.filter((e) => !e.is_dir && re.test(e.path)).slice(0, max).map((e) => e.path);
+  return { pattern: args.pattern, matches, truncated: matches.length >= max };
+}
+async function grep(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace" };
+  const isRegex = args.regex !== false;
+  const re = isRegex ? new RegExp(args.pattern) : new RegExp(args.pattern.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&"));
+  const fileRe = globToRegExp(args.file_glob || "**/*");
+  const max = Math.min(args.max_matches ?? 200, 2e3);
+  const abs = joinPath(root, args.path || ".");
+  const entries = await ctx.host.readDir(abs, true, 2e3);
+  const hits = [];
+  for (const e of entries) {
+    if (e.is_dir || !fileRe.test(e.path))
+      continue;
+    if (e.size_bytes != null && e.size_bytes > 1e6)
+      continue;
+    let txt;
+    try {
+      txt = await ctx.host.readFile(joinPath(root, e.path));
+    } catch {
       continue;
     }
-    if (line.startsWith("/cd ")) {
-      const target = line.slice(4).trim();
-      try {
-        process.chdir(target);
-        currentWorkspace = process.cwd();
-        w(palette.dim("  \xB7 cwd = ") + palette.cyan(homeShort(currentWorkspace)) + "\n\n");
-      } catch (err) {
-        w(palette.error("  \xB7 cd failed: " + (err instanceof Error ? err.message : String(err)) + "\n\n"));
+    const lines = txt.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      if (re.test(lines[i])) {
+        hits.push({ path: e.path, line: i + 1, content: lines[i].slice(0, 400) });
+        if (hits.length >= max)
+          break;
       }
-      continue;
     }
-    const rc = await runAgent({
-      workspace: currentWorkspace,
-      backendUrl: backendUrl2,
-      prompt: line,
-      resume: resumeNext
-    });
-    turnCount++;
-    resumeNext = true;
-    if (rc !== 0) {
-      w("\n" + palette.warn("!") + " agent exited with code " + rc + "\n");
+    if (hits.length >= max)
+      break;
+  }
+  return { pattern: args.pattern, hits, truncated: hits.length >= max };
+}
+async function runCommand(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace" };
+  const timeoutMs = Math.min(Math.max(args.timeout_s ?? 60, 1), 120) * 1e3;
+  const cwd = args.cwd ? joinPath(root, args.cwd) : root;
+  const r = await ctx.host.runCommand(args.command, { cwd, timeoutMs });
+  return { command: args.command, ...r, spawned_pid: null };
+}
+async function formatFile(args, ctx) {
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { error: "no_workspace" };
+  const abs = joinPath(root, args.path);
+  const checkFlag = args.check_only === true ? " --check" : "";
+  const r = await ctx.host.runCommand(`ruff format${checkFlag} "${abs}"`, {
+    cwd: root,
+    timeoutMs: 3e4
+  });
+  return {
+    tool_used: "ruff",
+    applied: r.exit_code === 0 && !args.check_only,
+    ...r
+  };
+}
+var _PROTECTED_PREFIXES = [
+  "/etc",
+  "/usr/bin",
+  "/usr/sbin",
+  "/bin",
+  "/sbin",
+  "/sys",
+  "/proc",
+  "/dev",
+  "c:\\windows",
+  "c:\\program files",
+  "c:\\program files (x86)",
+  "c:\\programdata"
+];
+function _isProtected(abs) {
+  const n = abs.replace(/\\/g, "/").toLowerCase();
+  for (const p of _PROTECTED_PREFIXES) {
+    const np = p.replace(/\\/g, "/").toLowerCase();
+    if (n === np || n.startsWith(np + "/"))
+      return p;
+  }
+  return null;
+}
+async function mountExternalFolder(args, ctx) {
+  const raw = String(args?.path || "").trim();
+  if (!raw)
+    return { ok: false, error: "empty path" };
+  const purpose = String(args?.purpose || "").trim();
+  const abs = raw.replace(/\\/g, "/").replace(/\/+$/, "");
+  const proto = _isProtected(abs);
+  if (proto) {
+    return { ok: false, error: "protected_host_dir", refused: proto };
+  }
+  if (!ctx.host.capabilities.filesystem) {
+    return {
+      ok: false,
+      error: "filesystem_unavailable",
+      hint: "this surface (web preview) cannot read external folders"
+    };
+  }
+  const st = await ctx.host.stat(abs);
+  if (!st || !st.isDirectory) {
+    return { ok: false, error: "not_a_directory", path: abs };
+  }
+  if (ctx.mountedFolders.has(abs)) {
+    return { ok: true, already_mounted: true, path: abs, mode: "read-only" };
+  }
+  const ok = typeof window !== "undefined" && typeof window.confirm === "function" ? window.confirm(
+    `Allow the agent READ-ONLY access to:
+${abs}
+
+Purpose: ${purpose || "(none given)"}`
+  ) : true;
+  if (!ok)
+    return { ok: false, error: "user_denied", path: abs };
+  ctx.mountedFolders.add(abs);
+  return {
+    ok: true,
+    mounted: abs,
+    mode: "read-only",
+    purpose,
+    total_mounted: ctx.mountedFolders.size
+  };
+}
+function _sanitize(s) {
+  return s.replace(/[/\\:?"<>|*]/g, "_").replace(/_+/g, "_").slice(0, 80);
+}
+async function downloadDataset(args, ctx) {
+  const source = String(args?.source || "");
+  const name = String(args?.name_or_url || "").trim();
+  if (!name)
+    return { ok: false, error: "name_or_url is empty" };
+  if (!["huggingface", "kaggle", "github", "url"].includes(source)) {
+    return { ok: false, error: `unknown source ${JSON.stringify(source)}` };
+  }
+  const root = ctx.host.workspaceRoot();
+  if (!root)
+    return { ok: false, error: "no workspace folder set" };
+  const dest = String(args?.dest_path || `.datasets/${source}-${_sanitize(name)}`);
+  const destAbs = joinPath(root, dest);
+  let command;
+  switch (source) {
+    case "huggingface": {
+      const tier = args?.kind === "model" ? "" : "--repo-type dataset ";
+      command = `huggingface-cli download ${tier}${name} --local-dir "${destAbs}" --local-dir-use-symlinks False`;
+      break;
+    }
+    case "kaggle":
+      command = `kaggle datasets download -d ${name} -p "${destAbs}" --unzip`;
+      break;
+    case "github": {
+      const url = name.startsWith("http") ? name : `https://github.com/${name}.git`;
+      command = `git clone --depth=1 ${url} "${destAbs}"`;
+      break;
+    }
+    case "url": {
+      const filename = name.split("/").pop() || "download";
+      const safe = _sanitize(filename);
+      command = `curl -L -o "${joinPath(destAbs, safe)}" "${name}"`;
+      break;
+    }
+    default:
+      return { ok: false, error: `unsupported source ${source}` };
+  }
+  const taskRes = await ctx.api.postJson(`/code-workspace/bg-task/start`, {
+    command,
+    cwd: root,
+    label: `download:${source}:${_sanitize(name).slice(0, 40)}`,
+    env_extra: null
+  });
+  return {
+    ok: true,
+    source,
+    name,
+    dest_path: dest,
+    dest_abs: destAbs,
+    command_running: command,
+    task_id: taskRes?.task_id || null,
+    note: "running as background task \u2014 use check_background_task to poll",
+    task_info: taskRes
+  };
+}
+function joinPath(root, rel) {
+  if (!rel || rel === ".")
+    return root;
+  const sep = root.includes("\\") && !root.includes("/") ? "\\" : "/";
+  const cleaned = rel.replace(/^[\\/]+/, "");
+  return root.replace(/[/\\]+$/, "") + sep + cleaned.replace(/[\\/]+/g, sep);
+}
+function globToRegExp(pattern) {
+  let re = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") {
+      if (pattern[i + 1] === "*") {
+        if (pattern[i + 2] === "/") {
+          re += "(?:.*/)?";
+          i += 3;
+        } else {
+          re += ".*";
+          i += 2;
+        }
+      } else {
+        re += "[^/]*";
+        i++;
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+      i++;
+    } else if (c === ".") {
+      re += "\\.";
+      i++;
+    } else if (c === "+") {
+      re += "\\+";
+      i++;
+    } else if (c === "(" || c === ")" || c === "|" || c === "$" || c === "^") {
+      re += "\\" + c;
+      i++;
+    } else {
+      re += c;
+      i++;
     }
-    w("\n");
   }
-  w("\n" + palette.dim("  bye \xB7 ") + palette.dim(turnCount + " turn" + (turnCount === 1 ? "" : "s") + " this session\n\n"));
-  return 0;
+  re += "$";
+  return new RegExp(re);
 }
 
-// src/install.ts
-var VERSION2 = "1.7.48";
-var BUILD2 = "a7f31c2";
-function backendUrl() {
-  return process.env.RSCOT_BACKEND_URL || "http://localhost:8010";
+// ../tauri-shell/src/agent-core/host-node.ts
+async function nodeFs() {
+  return import("node:fs/promises");
 }
-function nl(n = 1) {
-  process.stdout.write("\n".repeat(n));
+async function nodeCp() {
+  return import("node:child_process");
 }
-function println(s = "") {
-  process.stdout.write(s + "\n");
+async function nodeOs() {
+  return import("node:os");
 }
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
+async function nodeNet() {
+  return import("node:net");
 }
-async function runEnvironmentProbe() {
-  println(palette.prompt("$") + " " + palette.cmd("npx rscot"));
-  nl();
-  println(brandHeader(VERSION2, BUILD2));
-  nl();
-  println(sectionTitle("Checking your environment\u2026"));
-  nl();
-  const labels = ["node", "npm registry", "python", "git", "llm provider"];
-  for (const label of labels) {
-    const filled = label === "node" || label === "npm registry" ? 100 : label === "python" ? 83 : label === "git" ? 66 : 33;
-    const bar = progressBar(filled, 18);
-    const right = filled === 100 ? palette.success("OK") : palette.dim("scanning $PATH");
-    println(
-      "  " + palette.cmd(label.padEnd(14, " ")) + " " + bar + " " + ("" + filled + "%").padStart(5, " ") + "  " + right
-    );
-    await sleep(120);
-  }
-  nl();
-  const results = await runAllChecks();
-  return results;
-}
-function printEnvironmentReport(results) {
-  println(sectionTitle("Environment report"));
-  println(rule());
-  for (const r of results) {
-    const status = r.ok ? "ok" : r.optional ? "warn" : "fail";
-    println(taskRow(r.name, status, r.detail));
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "__pycache__", ".venv", "target", "dist", "build"]);
+var NodeHost = class {
+  capabilities = { filesystem: true, shell: true };
+  root = null;
+  workspaceRoot() {
+    return this.root;
   }
-  println(rule());
-  nl();
-  const hasKey = results.find((r) => r.name === "LLM provider key")?.ok;
-  if (!hasKey) {
-    println(
-      "  " + palette.warn("\u25B2") + "  Rscot needs " + palette.bold("one") + " LLM provider key to operate."
-    );
-    println(
-      "     We'll walk you through it. Keys are stored under " + palette.cyan("~/.rscot/keys/") + " with chmod 600,"
-    );
-    println(
-      "     never written to disk in plain text outside that dir, never transmitted to the Rscot project."
-    );
-    nl();
+  setWorkspaceRoot(p) {
+    this.root = p;
   }
-}
-async function pickProvider() {
-  const choices = providers.map((p2) => {
-    const badge = p2.recommended ? palette.accent(" (recommended)") : "";
-    return {
-      title: palette.bold(p2.display) + badge,
-      description: p2.blurb,
-      value: p2.id
-    };
-  });
-  const { provider } = await prompts(
-    {
-      type: "select",
-      name: "provider",
-      message: "Which LLM provider would you like to start with?",
-      choices,
-      initial: 0,
-      hint: "\u2191/\u2193 to move \xB7 enter to select \xB7 esc to cancel"
-    },
-    {
-      onCancel: () => {
-        return false;
-      }
-    }
-  );
-  if (!provider)
-    return null;
-  const p = findProvider(provider);
-  if (!p)
-    return null;
-  if (p.id === "skip") {
-    return p;
+  async readFile(absPath) {
+    const fs = await nodeFs();
+    return await fs.readFile(absPath, "utf8");
   }
-  println(rule());
-  println(
-    "  " + palette.accent(p.display) + "  " + palette.dim("\u2192") + "  default    " + palette.cyan(p.defaultModel)
-  );
-  if (p.models.length > 1) {
-    for (const m of p.models.slice(1)) {
-      println(
-        "  " + " ".repeat(p.display.length) + "  " + palette.dim("\u2192") + "  alt model  " + palette.cyan(m.label) + (m.note ? "  " + palette.dim("(" + m.note + ")") : "")
-      );
+  async writeFile(absPath, content) {
+    const fs = await nodeFs();
+    let previous_size = null;
+    let created = true;
+    try {
+      const st = await fs.stat(absPath);
+      previous_size = Number(st.size);
+      created = false;
+    } catch {
     }
+    await fs.writeFile(absPath, content, "utf8");
+    return { bytes_written: new TextEncoder().encode(content).length, created, previous_size };
   }
-  if (p.keyHelpUrl) {
-    println(
-      "  " + " ".repeat(p.display.length) + "  " + palette.dim("\u2192") + "  signup     " + palette.cyan(p.keyHelpUrl)
-    );
+  async unlink(absPath) {
+    const fs = await nodeFs();
+    await fs.rm(absPath, { force: true });
   }
-  nl();
-  return p;
-}
-async function pasteKey(p) {
-  println(palette.success("\u2713") + " Provider:  " + palette.bold(p.display));
-  println("  " + palette.dim("\u203A model   ") + "  " + palette.cyan(p.defaultModel));
-  if (p.keyHelpUrl) {
-    println("  " + palette.dim("\u203A signup  ") + "  " + palette.cyan(p.keyHelpUrl));
+  async mkdir(absPath, recursive) {
+    const fs = await nodeFs();
+    await fs.mkdir(absPath, { recursive });
   }
-  nl();
-  if (!p.needsKey) {
-    println(palette.dim("  (no API key needed for " + p.display + " \u2014 local bridge)"));
-    nl();
-    return "";
+  async stat(absPath) {
+    const fs = await nodeFs();
+    try {
+      const s = await fs.stat(absPath);
+      return { size: Number(s.size), isFile: s.isFile(), isDirectory: s.isDirectory() };
+    } catch {
+      return null;
+    }
   }
-  const { key } = await prompts(
-    {
-      type: "password",
-      name: "key",
-      message: "Paste your " + p.display.charAt(0).toUpperCase() + p.display.slice(1) + " API key (masked \xB7 stored under ~/.rscot/keys with chmod 600 \xB7 ctrl-c aborts)",
-      validate: (v) => {
-        if (!v || v.trim().length < p.keyMinLen) {
-          return "key too short (expected >= " + p.keyMinLen + " chars)";
-        }
-        if (p.keyPrefix && !v.startsWith(p.keyPrefix)) {
-          return "expected prefix '" + p.keyPrefix + "' \u2014 looks like the wrong key";
+  async readDir(absPath, recursive, maxEntries) {
+    const fs = await nodeFs();
+    const out = [];
+    const root = this.root || absPath;
+    const sep = process.platform === "win32" ? "\\" : "/";
+    const walk = async (dir) => {
+      if (out.length >= maxEntries)
+        return;
+      let items;
+      try {
+        items = await fs.readdir(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const it of items) {
+        if (out.length >= maxEntries)
+          return;
+        if (it.isDirectory() && SKIP_DIRS.has(it.name))
+          continue;
+        const full = dir.endsWith(sep) ? dir + it.name : dir + sep + it.name;
+        const rel = relativize(root, full);
+        if (it.isFile()) {
+          let size = null;
+          try {
+            size = Number((await fs.stat(full)).size);
+          } catch {
+          }
+          out.push({ path: rel, size_bytes: size, is_dir: false });
+        } else if (it.isDirectory()) {
+          out.push({ path: rel, size_bytes: null, is_dir: true });
+          if (recursive)
+            await walk(full);
         }
-        return true;
       }
-    },
-    {
-      onCancel: () => false
-    }
-  );
-  if (!key)
-    return null;
-  println(
-    "  " + palette.dim("\u21B3 characters: ") + palette.cyan("" + key.length) + "  " + palette.dim("\u21B3 format: ") + palette.success("looks valid" + (p.keyPrefix ? " (" + p.keyPrefix + "\u2026)" : ""))
-  );
-  nl();
-  return key.trim();
-}
-async function runInstallPhases(provider, apiKey) {
-  const cfgDir = ensureConfigDir();
-  if (provider.needsKey) {
-    println(
-      palette.success("\u2713") + " Key staged for " + palette.bold(provider.display) + "       " + palette.dim("service=rscot  account=" + provider.id)
-    );
-    println(
-      palette.success("\u2713") + " Validating key format         " + palette.dim(apiKey.length + " chars \xB7 prefix ok")
-    );
-  } else {
-    println(
-      palette.success("\u2713") + " Provider needs no key         " + palette.dim("ollama bridge will be probed on first run")
-    );
+    };
+    await walk(absPath);
+    return out;
+  }
+  async runCommand(cmd, opts) {
+    const cp = await nodeCp();
+    const isWin = process.platform === "win32";
+    const started = Date.now();
+    return await new Promise((resolve2) => {
+      let stdout = "", stderr = "", timed_out = false, settled = false;
+      const child = isWin ? cp.spawn("cmd", ["/d", "/s", "/c", cmd], { cwd: opts.cwd, windowsHide: true }) : cp.spawn("sh", ["-c", cmd], { cwd: opts.cwd });
+      const timer = setTimeout(() => {
+        timed_out = true;
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }, Math.max(1, opts.timeoutMs));
+      child.stdout?.on("data", (d) => {
+        stdout += d.toString();
+      });
+      child.stderr?.on("data", (d) => {
+        stderr += d.toString();
+      });
+      const done = (exit_code) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        resolve2({ exit_code, stdout, stderr, duration_ms: Date.now() - started, timed_out });
+      };
+      child.on("error", (err) => {
+        stderr += String(err?.message || err);
+        done(-1);
+      });
+      child.on("close", (code) => done(timed_out ? -1 : code ?? 0));
+    });
   }
-  nl();
-  println(sectionTitle("Installing Rscot Agent v" + VERSION2));
-  println(rule());
-  nl();
-  const phases = [
-    { label: "resolving deps", detail: "47 packages \xB7 lockfile pinned", ms: 450 },
-    { label: "fetching wheels", detail: "fastapi \xB7 uvicorn \xB7 httpx \xB7 ripgrep", ms: 620 },
-    { label: "building backend", detail: "compiling rust core (ripgrep bindings)", ms: 780 },
-    { label: "linking CLI", detail: "shim \u2192 " + cfgDir.path, ms: 380 },
-    { label: "writing config", detail: "saving provider + key reference", ms: 320 }
-  ];
-  const total = phases.length;
-  const startedAt = Date.now();
-  for (let i = 0; i < phases.length; i++) {
-    const phase = phases[i];
-    const tag = phaseTag(i + 1, total, false);
-    const spinner = ora({
-      text: tag + " " + palette.cmd(phase.label.padEnd(20, " ")) + "  " + palette.dim(phase.detail),
-      color: "yellow",
-      spinner: "dots"
-    }).start();
-    await sleep(phase.ms);
-    spinner.stopAndPersist({
-      symbol: phaseTag(i + 1, total, true) + " " + palette.success("\u2713"),
-      text: " " + palette.cmd(phase.label.padEnd(19, " ")) + "  " + palette.dim(phase.detail)
+  async systemInfo(level) {
+    const os = await nodeOs();
+    const base = {
+      platform: os.platform(),
+      arch: os.arch(),
+      hostname: os.hostname(),
+      cpus: os.cpus()?.length ?? 0,
+      totalmem: os.totalmem(),
+      freemem: os.freemem(),
+      node: process.version
+    };
+    if (level === "brief")
+      return base;
+    return { ...base, uptime: os.uptime(), loadavg: os.loadavg(), release: os.release() };
+  }
+  async allocatePort(opts) {
+    const net = await nodeNet();
+    const tryPort = (p) => new Promise((resolve2) => {
+      const srv = net.createServer();
+      srv.once("error", () => resolve2(null));
+      srv.listen(p, () => {
+        const addr = srv.address();
+        const port = typeof addr === "object" && addr ? addr.port : p;
+        srv.close(() => resolve2(port));
+      });
     });
+    if (opts.prefer) {
+      const got2 = await tryPort(opts.prefer);
+      if (got2)
+        return { port: got2 };
+    }
+    const got = await tryPort(0);
+    return { port: got };
   }
-  nl();
-  println(rule());
-  const saved = saveConfig({
-    provider: provider.id,
-    model: provider.defaultModel,
-    apiKey: provider.needsKey ? apiKey : void 0,
-    apiKeyEnvVar: provider.envVar,
-    version: VERSION2
-  });
-  const elapsedMs = Date.now() - startedAt;
-  const ss = Math.round(elapsedMs / 1e3);
-  const mm = Math.floor(ss / 60).toString().padStart(2, "0");
-  const sss = (ss % 60).toString().padStart(2, "0");
-  println("  " + palette.dim("install root  ") + palette.cyan(configRoot()));
-  println("  " + palette.dim("config        ") + palette.cyan(saved.configPath));
-  if (saved.keyPath) {
-    println("  " + palette.dim("key file      ") + palette.cyan(saved.keyPath) + "  " + palette.dim("(chmod 600)"));
+  async listProcesses(_includeFinished) {
+    return { supported: false, processes: [] };
   }
-  println("  " + palette.dim("elapsed       ") + palette.cyan(mm + ":" + sss));
-  nl();
-}
-function printSuccess(provider) {
-  println(
-    successBanner([
-      "Installed Rscot Agent v" + VERSION2,
-      "Provider: " + provider.display + (provider.needsKey ? " (key stored)" : "")
-    ])
-  );
-  nl();
-  println("  " + palette.dim("install root  ") + palette.cyan(configRoot()));
-  println("  " + palette.dim("provider      ") + palette.cyan(provider.display) + "  " + palette.dim(provider.needsKey ? "(key in ~/.rscot/keys)" : "(local)"));
-  println("  " + palette.dim("uninstall     ") + palette.cyan("rscot uninstall") + "  " + palette.dim("(removes ~/.rscot including the key file)"));
-  nl();
-  println(
-    ctaBlock([
-      { cmd: "rscot", comment: "launch interactive agent in this folder" },
-      { cmd: "rscot --help", comment: "show all subcommands" }
-    ])
-  );
-  nl();
-  println("  " + palette.bold("Try one of these:"));
-  println(
-    exampleGrid([
-      'rscot "add a /health route to my FastAPI app"',
-      'rscot "find every TODO older than 30 days"',
-      'rscot "write a vitest for src/parser.ts"',
-      'rscot "explain the auth middleware"',
-      'rscot "convert this script to async"',
-      "rscot code-review --diff main"
-    ])
-  );
-  nl();
-  println(
-    "  " + palette.dim("Docs ") + palette.cyan("https://recot.dev/rscot") + palette.dim("  \xB7  License ") + palette.warn("NonCommercial") + palette.dim(" (source-available, no commercial use without written consent \u2014 see LICENSE)")
-  );
-  nl();
-}
-function existingKeyForConfig(cfg) {
-  try {
-    const kp = keyPath(cfg.provider);
-    if (existsSync4(kp) && statSync2(kp).size > 8)
-      return true;
-  } catch {
-  }
-  const envVar = cfg.apiKeyEnvVar;
-  if (envVar && (process.env[envVar] ?? "").length > 8)
-    return true;
-  return false;
-}
-async function runAlreadyInstalled(cfg, positional) {
-  const workspace = process.cwd();
-  const url = backendUrl();
-  if (positional)
-    return runOneShot(positional, workspace, url);
-  return runRepl(workspace, url);
-}
-async function runInstall(opts = {}) {
-  try {
-    const existing = loadConfig();
-    if (existing && existingKeyForConfig(existing)) {
-      const positional2 = process.argv.slice(2).find((a) => !a.startsWith("-") && !["login", "logout", "whoami", "providers", "models", "keys", "config"].includes(a));
-      return runAlreadyInstalled(existing, positional2 ?? null);
-    }
-    const results = await runEnvironmentProbe();
-    printEnvironmentReport(results);
-    if (opts.noninteractive) {
-      println(palette.dim("  (--no-prompt set \u2014 stopping after env report)"));
-      return 0;
-    }
-    const { go } = await prompts(
-      {
-        type: "confirm",
-        name: "go",
-        message: "Continue to provider setup?",
-        initial: true
-      },
-      { onCancel: () => false }
-    );
-    if (!go) {
-      println(palette.dim("\n  aborted. run `npx rscot` again any time."));
-      return 130;
-    }
-    const provider = await pickProvider();
-    if (!provider) {
-      println(palette.dim("\n  no provider selected. aborting."));
-      return 130;
-    }
-    if (provider.id === "skip") {
-      println(
-        palette.warn("!") + " skipped provider setup \u2014 run `rscot config provider` later to configure."
-      );
-      return 0;
-    }
-    const apiKey = await pasteKey(provider);
-    if (apiKey === null) {
-      println(palette.dim("\n  no key entered. aborting."));
-      return 130;
-    }
-    await runInstallPhases(provider, apiKey);
-    printSuccess(provider);
-    const positional = process.argv.slice(2).find((a) => !a.startsWith("-") && !["login", "logout", "whoami", "providers", "models", "keys", "config"].includes(a));
-    const workspace = process.cwd();
-    const url = backendUrl();
-    if (positional)
-      return runOneShot(positional, workspace, url);
-    return runRepl(workspace, url);
-  } catch (err) {
-    println(palette.error("\n  install failed: " + (err instanceof Error ? err.message : String(err))));
-    return 1;
+  async killProcess(pid, signal = "SIGTERM") {
+    try {
+      process.kill(pid, signal);
+      return { ok: true, pid, signal };
+    } catch (e) {
+      return { ok: false, pid, error: String(e?.message || e) };
+    }
   }
+};
+function relativize(root, full) {
+  const r = root.replace(/\\/g, "/");
+  const f = full.replace(/\\/g, "/");
+  if (f.startsWith(r)) {
+    const rel = f.slice(r.length).replace(/^\/+/, "");
+    return rel || ".";
+  }
+  return f;
 }
 
-// src/commands/catalog.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+// src/auth.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, rmSync, chmodSync as chmodSync2 } from "node:fs";
 import { join as join4 } from "node:path";
-var CACHE_FILE = "providers.cache.json";
-var TTL_HOURS = 24;
-function cachePath() {
-  const dir = configRoot();
-  if (!existsSync5(dir))
-    mkdirSync3(dir, { recursive: true, mode: 448 });
-  return join4(dir, CACHE_FILE);
+import * as crypto from "node:crypto";
+import * as http from "node:http";
+import { spawn as spawn2 } from "node:child_process";
+var AUTH_BASE = "https://auth.learningfind.com";
+var PROFILE_URL = "https://learningfind.com/api/me/profile";
+var PORT_LO = 49152;
+var PORT_HI = 65535;
+var BIND_ATTEMPTS = 32;
+var LOOPBACK_TIMEOUT_MS = 18e4;
+var ACCESS_LEEWAY_S = 30;
+function authDir() {
+  const d = configRoot();
+  if (!existsSync4(d))
+    mkdirSync3(d, { recursive: true, mode: 448 });
+  return d;
 }
-function readCache() {
+function pathAccess() {
+  return join4(authDir(), "access");
+}
+function pathRefresh() {
+  return join4(authDir(), "refresh");
+}
+function pathAccessExp() {
+  return join4(authDir(), "access.exp");
+}
+function pathDevice() {
+  return join4(authDir(), "device_id");
+}
+function pathProfile() {
+  return join4(authDir(), "profile.json");
+}
+function pathLocalMode() {
+  return join4(authDir(), "local-mode");
+}
+function writeSecret(path, value) {
+  writeFileSync2(path, value, { mode: 384 });
   try {
-    const p = cachePath();
-    if (!existsSync5(p))
-      return null;
-    return JSON.parse(readFileSync3(p, "utf8"));
+    chmodSync2(path, 384);
   } catch {
-    return null;
   }
 }
-function isFresh(c) {
-  if (!c)
-    return false;
-  const t = Date.parse(c.fetchedAt);
-  if (!Number.isFinite(t))
-    return false;
-  return Date.now() - t < TTL_HOURS * 3600 * 1e3;
-}
-async function fetchBackend(backendUrl2) {
+function readMaybe(path) {
+  if (!existsSync4(path))
+    return null;
   try {
-    const res = await fetch(`${backendUrl2.replace(/\/+$/, "")}/api/providers`);
-    if (!res.ok)
-      return null;
-    return await res.json();
+    return readFileSync3(path, "utf8").trim();
   } catch {
     return null;
   }
 }
-function fromBackend(p) {
-  return {
-    id: p.id,
-    display: p.display,
-    blurb: p.blurb,
-    needsKey: p.needs_key,
-    isLocal: !!p.is_local,
-    baseUrl: p.base_url,
-    defaultModel: p.default_model,
-    models: (p.models || []).map((m) => ({
-      id: m.id,
-      label: m.label,
-      note: m.recommended ? "recommended" : m.speed,
-      priceIn: m.price_in,
-      priceOut: m.price_out
-    })),
-    keyHelpUrl: p.key_help_url || "",
-    keyMinLen: 0,
-    envVar: p.env_var || ""
-  };
-}
-async function loadCatalog(opts = {}) {
-  const backendUrl2 = opts.backendUrl || process.env.RSCOT_BACKEND_URL || "https://learningfind.com/api";
-  if (!opts.force) {
-    const cached2 = readCache();
-    if (isFresh(cached2))
-      return cached2.payload.providers.map(fromBackend);
-  }
-  const payload = await fetchBackend(backendUrl2);
-  if (payload) {
+function rmIf(path) {
+  if (existsSync4(path))
     try {
-      writeFileSync2(
-        cachePath(),
-        JSON.stringify({ fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), payload }, null, 2),
-        { mode: 384 }
-      );
+      rmSync(path);
     } catch {
     }
-    return payload.providers.map(fromBackend);
-  }
-  const cached = readCache();
-  if (cached)
-    return cached.payload.providers.map(fromBackend);
-  return realProviders();
 }
-
-// src/commands/keys.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, rmSync, readdirSync as readdirSync2, chmodSync as chmodSync2 } from "node:fs";
-import { join as join5 } from "node:path";
-function keysDir() {
-  const d = join5(configRoot(), "keys");
-  if (!existsSync6(d))
-    mkdirSync4(d, { recursive: true, mode: 448 });
-  return d;
+function b64url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
-function keyFile(providerId) {
-  return join5(keysDir(), `${providerId}.key`);
+function genVerifier() {
+  return b64url(crypto.randomBytes(48));
 }
-function setKey(providerId, value) {
-  const path = keyFile(providerId);
-  writeFileSync3(path, value.trim(), { mode: 384 });
-  try {
-    chmodSync2(path, 384);
-  } catch {
-  }
-  return path;
+function challengeS256(v) {
+  return b64url(crypto.createHash("sha256").update(v).digest());
 }
-function getKey(providerId) {
-  const path = keyFile(providerId);
-  if (!existsSync6(path))
-    return "";
+function genState() {
+  return b64url(crypto.randomBytes(32));
+}
+function parseJwtExp(jwt) {
+  const parts = jwt.split(".");
+  if (parts.length < 2)
+    return null;
   try {
-    return readFileSync4(path, "utf8").trim();
+    const payload = Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const c = JSON.parse(payload);
+    return typeof c.exp === "number" ? c.exp : null;
   } catch {
-    return "";
+    return null;
   }
 }
-function removeKey(providerId) {
-  const path = keyFile(providerId);
-  if (!existsSync6(path))
-    return false;
-  rmSync(path);
-  return true;
+function getOrCreateDeviceId() {
+  const existing = readMaybe(pathDevice());
+  if (existing)
+    return existing;
+  const id = "cli-" + b64url(crypto.randomBytes(12));
+  writeSecret(pathDevice(), id);
+  return id;
 }
-function listKeys() {
-  const d = keysDir();
+function isLocalMode() {
+  return existsSync4(pathLocalMode());
+}
+function setLocalMode(on) {
+  if (on)
+    writeSecret(pathLocalMode(), (/* @__PURE__ */ new Date()).toISOString());
+  else
+    rmIf(pathLocalMode());
+}
+function getStoredProfile() {
+  const raw = readMaybe(pathProfile());
+  if (!raw)
+    return null;
   try {
-    return readdirSync2(d).filter((f) => f.endsWith(".key")).map((f) => f.replace(/\.key$/, "")).sort();
+    return JSON.parse(raw);
   } catch {
-    return [];
+    return null;
   }
 }
-function keysPath() {
-  return keysDir();
+function storeProfile(p) {
+  if (!p)
+    return;
+  writeSecret(pathProfile(), JSON.stringify(p, null, 2));
 }
-
-// src/commands/providers.ts
-function maskKey(raw) {
-  if (!raw)
-    return "";
-  if (raw.length <= 8)
-    return "***" + raw.slice(-2);
-  return raw.slice(0, 4) + "\u2022\u2022\u2022\u2022\u2022" + raw.slice(-4);
+function storeTokens(t) {
+  writeSecret(pathAccess(), t.access);
+  writeSecret(pathRefresh(), t.refresh);
+  const exp = parseJwtExp(t.access);
+  if (exp)
+    writeSecret(pathAccessExp(), String(exp));
+  if (t.profile)
+    storeProfile(t.profile);
 }
-function pad(s, w2) {
-  return s.length >= w2 ? s : s + " ".repeat(w2 - s.length);
+function clearTokens() {
+  rmIf(pathAccess());
+  rmIf(pathRefresh());
+  rmIf(pathAccessExp());
+  rmIf(pathProfile());
 }
-async function readStdinLine(promptText) {
-  process.stdout.write(palette.prompt(promptText));
-  return new Promise((resolve2) => {
-    const chunks = [];
-    const onData = (b) => {
-      chunks.push(b);
-      const buf = Buffer.concat(chunks).toString("utf8");
-      const nl2 = buf.indexOf("\n");
-      if (nl2 !== -1) {
-        process.stdin.off("data", onData);
-        try {
-          process.stdin.pause();
-        } catch {
-        }
-        resolve2(buf.slice(0, nl2).replace(/\r$/, ""));
-      }
-    };
-    process.stdin.on("data", onData);
-    try {
-      process.stdin.resume();
-    } catch {
+function hasRefresh() {
+  const r = readMaybe(pathRefresh());
+  return !!(r && r.length > 0);
+}
+async function refreshTokens(refresh) {
+  const deviceId = getOrCreateDeviceId();
+  const res = await fetch(`${AUTH_BASE}/auth/desktop/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refresh, device_id: deviceId })
+  });
+  if (!res.ok)
+    throw new Error(`refresh failed: ${res.status}`);
+  return await res.json();
+}
+async function getAccessToken() {
+  const access = readMaybe(pathAccess());
+  const exp = Number(readMaybe(pathAccessExp()) || "0");
+  const now = Math.floor(Date.now() / 1e3);
+  if (access && exp > now + ACCESS_LEEWAY_S)
+    return access;
+  const refresh = readMaybe(pathRefresh());
+  if (!refresh)
+    return null;
+  try {
+    const t = await refreshTokens(refresh);
+    storeTokens(t);
+    return t.access;
+  } catch {
+    return null;
+  }
+}
+function bindLoopback() {
+  return new Promise((resolve2, reject) => {
+    let attempts = 0;
+    const tryBind = () => {
+      if (attempts++ >= BIND_ATTEMPTS) {
+        reject(new Error("loopback port exhausted (49152..65535)"));
+        return;
+      }
+      const port = PORT_LO + Math.floor(Math.random() * (PORT_HI - PORT_LO + 1));
+      const server = http.createServer();
+      server.once("error", () => {
+        try {
+          server.close();
+        } catch {
+        }
+        tryBind();
+      });
+      server.listen(port, "127.0.0.1", () => {
+        const addr = server.address();
+        server.removeAllListeners("error");
+        resolve2({ server, port: addr.port });
+      });
+    };
+    tryBind();
+  });
+}
+var SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Rscot Agent</title></head><body style="font-family:system-ui,sans-serif;padding:40px;color:#222"><h2>Sign-in complete</h2><p>You can close this window and return to your terminal.</p><script>setTimeout(function(){window.close();},250);</script></body></html>`;
+function waitForCallback(server, expectedState) {
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      try {
+        server.close();
+      } catch {
+      }
+      reject(new Error("Sign-in timed out after 3 minutes."));
+    }, LOOPBACK_TIMEOUT_MS);
+    server.on("request", (req2, res) => {
+      const url = new URL(req2.url || "/", "http://127.0.0.1");
+      if (url.pathname !== "/cb") {
+        res.statusCode = 404;
+        res.end("not found");
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const err = url.searchParams.get("error");
+      res.statusCode = 200;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(SUCCESS_HTML);
+      clearTimeout(timer);
+      try {
+        server.close();
+      } catch {
+      }
+      if (err)
+        return reject(new Error(`Auth provider error: ${err}`));
+      if (!code || !state)
+        return reject(new Error("Auth callback missing code/state."));
+      if (state !== expectedState)
+        return reject(new Error("Auth callback state mismatch."));
+      resolve2(code);
+    });
+  });
+}
+async function exchangeCode(code, verifier, deviceId) {
+  const res = await fetch(`${AUTH_BASE}/auth/desktop/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, code_verifier: verifier, device_id: deviceId })
+  });
+  if (!res.ok) {
+    let detail = "";
+    try {
+      detail = (await res.json())?.detail || "";
+    } catch {
+      detail = await res.text();
+    }
+    throw new Error(`Token exchange failed (${res.status}): ${detail || res.statusText}`);
+  }
+  return await res.json();
+}
+function openBrowser(url) {
+  const platform = process.platform;
+  let cmd;
+  let args;
+  if (platform === "win32") {
+    cmd = "rundll32";
+    args = ["url.dll,FileProtocolHandler", url];
+  } else if (platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn2(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.unref();
+  } catch {
+  }
+}
+async function signIn() {
+  const deviceId = getOrCreateDeviceId();
+  const verifier = genVerifier();
+  const challenge = challengeS256(verifier);
+  const state = genState();
+  const { server, port } = await bindLoopback();
+  const params = new URLSearchParams({
+    port: String(port),
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    device_id: deviceId,
+    client: "cli"
+  });
+  const authUrl = `${AUTH_BASE}/auth/desktop/start?${params.toString()}`;
+  const verbose = process.env.RSCOT_VERBOSE === "1";
+  process.stdout.write("\nOpened your browser to sign in.\n");
+  process.stdout.write("Complete the flow there, then return to this terminal.\n");
+  process.stdout.write("Waiting (up to 3 minutes)\u2026\n\n");
+  if (verbose) {
+    process.stdout.write(`[verbose] auth url: ${authUrl}
+`);
+    process.stdout.write(`[verbose] loopback: 127.0.0.1:${port}
+
+`);
+  }
+  openBrowser(authUrl);
+  const code = await waitForCallback(server, state);
+  const bundle = await exchangeCode(code, verifier, deviceId);
+  storeTokens(bundle);
+  setLocalMode(false);
+  if (!bundle.profile) {
+    const p = await fetchProfile(bundle.access);
+    if (p)
+      storeProfile(p);
+    return p;
+  }
+  return bundle.profile;
+}
+async function signOut() {
+  const refresh = readMaybe(pathRefresh());
+  if (refresh) {
+    const deviceId = getOrCreateDeviceId();
+    try {
+      await fetch(`${AUTH_BASE}/auth/desktop/session`, {
+        method: "DELETE",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ refresh, device_id: deviceId })
+      });
+    } catch {
+    }
+  }
+  clearTokens();
+}
+async function fetchProfile(access) {
+  try {
+    const res = await fetch(PROFILE_URL, { headers: { "Authorization": `Bearer ${access}` } });
+    if (!res.ok)
+      return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function refreshProfile() {
+  const t = await getAccessToken();
+  if (!t)
+    return null;
+  const p = await fetchProfile(t);
+  if (p)
+    storeProfile(p);
+  return p;
+}
+
+// src/nativeAgent.ts
+function w(s) {
+  process.stdout.write(s);
+}
+function shortArgs(name, args) {
+  if (!args)
+    return "";
+  if (name === "write_file" || name === "read_file" || name === "list_dir" || name === "edit_file")
+    return String(args.path ?? "");
+  if (name === "run_command")
+    return String(args.command ?? "").slice(0, 80);
+  if (name === "grep" || name === "glob")
+    return String(args.pattern ?? args.query ?? "");
+  const s = JSON.stringify(args);
+  return s.length > 60 ? s.slice(0, 60) + "\u2026" : s;
+}
+async function askYesNo(question) {
+  return await new Promise((resolve2) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (ans) => {
+      rl.close();
+      resolve2(/^y(es)?$/i.test(ans.trim()));
+    });
+  });
+}
+async function createNativeSession(cfg, workspace, backendUrl2) {
+  const apiKey = readApiKey(cfg);
+  const bearer = await getAccessToken() || readCwaAdminToken() || "";
+  const host = new NodeHost();
+  host.setWorkspaceRoot(workspace);
+  const api = new ApiClient({
+    backendUrl: backendUrl2,
+    authBearer: bearer,
+    provider: cfg.provider,
+    model: cfg.model,
+    baseUrl: "",
+    apiKey,
+    stackHint: "",
+    temperature: 0.2
+  });
+  const ctx = { host, api, rollback: /* @__PURE__ */ new Map(), mountedFolders: /* @__PURE__ */ new Set() };
+  const session = {
+    history: [],
+    api,
+    host,
+    ctx,
+    workspace,
+    policy: { ...DEFAULT_PERMISSIONS },
+    cancelled: false,
+    reset() {
+      this.history = [];
+    }
+  };
+  return session;
+}
+async function sendNative(session, prompt) {
+  session.history.push({ role: "user", content: prompt });
+  session.cancelled = false;
+  let activeAbort = null;
+  const onSigint = () => {
+    session.cancelled = true;
+    try {
+      activeAbort?.abort();
+    } catch {
+    }
+    w("\n" + palette.warn("!") + palette.dim(" cancelling\u2026\n"));
+  };
+  process.on("SIGINT", onSigint);
+  let hadError = null;
+  const driver = {
+    maxTurns: 200,
+    async nextTurn() {
+      if (session.cancelled)
+        throw new NativeCancelled();
+      const ac = new AbortController();
+      activeAbort = ac;
+      let streamed = 0;
+      let cleared = false;
+      const clearThinking = () => {
+        if (!cleared) {
+          w("\r" + " ".repeat(24) + "\r");
+          cleared = true;
+        }
+      };
+      w(palette.dim("  \xB7 thinking\u2026") + "\r");
+      try {
+        for await (const ev of session.api.turnStream(session.history, ac.signal, { workspaceRoot: session.workspace })) {
+          if (session.cancelled) {
+            try {
+              ac.abort();
+            } catch {
+            }
+            throw new NativeCancelled();
+          }
+          switch (ev.type) {
+            case "status":
+              break;
+            case "delta":
+              if (ev.content) {
+                clearThinking();
+                if (streamed === 0)
+                  w("\n");
+                w(ev.content);
+                streamed += ev.content.length;
+              }
+              break;
+            case "assistant":
+              break;
+            case "tool_call":
+              clearThinking();
+              if (streamed)
+                w("\n");
+              return { type: "tool_call", tool_call_id: ev.tool_call_id, name: ev.name, arguments: ev.arguments, assistant_message: ev.assistant_message };
+            case "blocked":
+              clearThinking();
+              if (streamed)
+                w("\n");
+              return { type: "blocked", tool_call_id: ev.tool_call_id, name: ev.name, arguments: ev.arguments, reason: ev.reason, severity: ev.severity === "warn" ? "warn" : "block", assistant_message: ev.assistant_message };
+            case "message":
+              clearThinking();
+              if (streamed)
+                w("\n");
+              return { type: "message", content: streamed ? "" : ev.content, assistant_message: ev.assistant_message };
+            case "done":
+              clearThinking();
+              if (streamed)
+                w("\n");
+              return { type: "done", summary: ev.summary, files_changed: ev.files_changed || [], suggested_test_cmd: ev.suggested_test_cmd || "", assistant_message: ev.assistant_message };
+            case "error":
+              clearThinking();
+              throw new Error(ev.message + (ev.detail ? `: ${ev.detail}` : ""));
+          }
+        }
+        clearThinking();
+        throw new Error("stream ended without a terminal event");
+      } finally {
+        activeAbort = null;
+      }
+    },
+    onTurnError(err) {
+      const msg = String(err?.message || err);
+      if (err instanceof NativeCancelled || session.cancelled) {
+        w(palette.dim("  \xB7 cancelled\n"));
+      } else {
+        hadError = msg;
+        w("\n" + palette.error("\u2717 ") + msg + "\n");
+      }
+    },
+    onMessage(resp) {
+      session.history.push(resp.assistant_message);
+      if (resp.content)
+        w("\n" + resp.content + "\n");
+    },
+    onDone(resp) {
+      session.history.push(resp.assistant_message);
+      const tcId = resp.assistant_message?.tool_calls?.[0]?.id || "call_done";
+      session.history.push({ role: "tool", tool_call_id: tcId, name: "done", content: JSON.stringify({ acknowledged: true, summary: resp.summary }) });
+      w("\r" + " ".repeat(20) + "\r");
+      w("\n" + palette.success("\u2713 ") + palette.bold("done") + palette.dim("  " + (resp.summary || "")) + "\n");
+      const files = resp.files_changed || [];
+      if (files.length)
+        w(palette.dim("  files: " + files.join(", ")) + "\n");
+    },
+    onBlocked(resp) {
+      session.history.push(resp.assistant_message);
+      session.history.push({ role: "tool", tool_call_id: resp.tool_call_id, name: resp.name, content: JSON.stringify({ blocked: true, reason: resp.reason }) });
+      w("\r" + palette.warn("\u2298 blocked ") + resp.name + palette.dim("  " + resp.reason) + "\n");
+    },
+    onToolCall(resp) {
+      session.history.push(resp.assistant_message);
+    },
+    permissionMode(cat) {
+      return session.policy[cat] ?? "ask";
+    },
+    async requestApproval(resp) {
+      w("\r" + " ".repeat(20) + "\r");
+      return await askYesNo("  " + palette.warn("approve") + " " + palette.bold(resp.name) + " " + palette.dim(shortArgs(resp.name, resp.arguments)) + " ? [y/N] ");
+    },
+    onRefused(resp, reason) {
+      const payload = reason === "policy" ? { refused_by_user: true, policy_denied: categoryFor(resp.name), hint: `User policy denies this category.` } : { refused_by_user: true, hint: "User refused this tool call." };
+      session.history.push({ role: "tool", tool_call_id: resp.tool_call_id, name: resp.name, content: JSON.stringify(payload) });
+      w("  " + palette.error("\u2717 refused ") + resp.name + "\n");
+    },
+    async executeTool(resp) {
+      w("  " + palette.cyan("\u2699 ") + resp.name + palette.dim(" " + shortArgs(resp.name, resp.arguments)) + "\n");
+      const t0 = Date.now();
+      const result = await execute(resp.name, resp.arguments, session.ctx);
+      return { result, durationMs: Date.now() - t0 };
+    },
+    isCancelled() {
+      return session.cancelled;
+    },
+    onCancelledAfterTool(resp, exec) {
+      session.history.push({ role: "tool", tool_call_id: resp.tool_call_id, name: resp.name, content: JSON.stringify(exec.result) });
+      w("  " + palette.dim("\xB7 cancelled after " + resp.name + " (" + exec.durationMs + "ms)") + "\n");
+    },
+    onToolResult(resp, exec) {
+      session.history.push({ role: "tool", tool_call_id: resp.tool_call_id, name: resp.name, content: JSON.stringify(exec.result) });
+      w("  " + palette.success("\u2713 ") + resp.name + palette.dim("  " + exec.durationMs + "ms") + "\n");
+    },
+    onCapReached() {
+      hadError = "loop iteration cap reached";
+      w("\n" + palette.error("\u2717 loop cap reached \u2014 likely runaway agent") + "\n");
     }
+  };
+  try {
+    await runAgentLoop(driver);
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+  return hadError ? 1 : 0;
+}
+var NativeCancelled = class extends Error {
+};
+function nativeRuntimeEnabled() {
+  return process.env.RSCOT_LEGACY_RUNTIME !== "1";
+}
+async function runOneShotNative(prompt, workspace, backendUrl2) {
+  const cfg = loadConfig();
+  if (!cfg)
+    return 1;
+  const session = await createNativeSession(cfg, workspace, backendUrl2);
+  if (!session)
+    return 1;
+  return await sendNative(session, prompt);
+}
+
+// src/repl.ts
+var VERSION = "1.7.49";
+var BUILD = "a7f31c2";
+function homeShort(p) {
+  const h = homedir4();
+  return p.startsWith(h) ? "~" + p.slice(h.length) : p;
+}
+function w2(s) {
+  process.stdout.write(s);
+}
+function printReadyBanner(cfg, workspace, backendUrl2) {
+  w2("\n" + brandHeader(VERSION, BUILD) + "\n\n");
+  w2(
+    "  " + palette.success("\u25CF") + "  " + palette.dim("ready  ") + palette.cyan(cfg.provider + "/" + cfg.model) + "  " + palette.dim("\xB7  ") + palette.cmd(homeShort(workspace)) + "\n"
+  );
+  w2(
+    "  " + palette.dim("       backend ") + palette.cyan(backendUrl2) + "\n"
+  );
+}
+function printReplHelp() {
+  w2("\n");
+  w2("  " + palette.bold("REPL commands") + "\n");
+  w2("    " + palette.cyan("<any text>") + palette.dim("       send as prompt to the agent") + "\n");
+  w2("    " + palette.cyan("/help") + palette.dim("            show this help") + "\n");
+  w2("    " + palette.cyan("/reset") + palette.dim("           start a fresh conversation (drop --resume)") + "\n");
+  w2("    " + palette.cyan("/cd <dir>") + palette.dim("        change working directory") + "\n");
+  w2("    " + palette.cyan("exit") + palette.dim(" | ") + palette.cyan("quit") + palette.dim(" | Ctrl+D  leave REPL") + "\n");
+  w2("    " + palette.dim("(during a turn, Ctrl+C forwards to agent and cancels it)") + "\n\n");
+}
+function promptLine(promptStr) {
+  return new Promise((resolve2) => {
+    const rl = readline2.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: true,
+      historySize: 500
+    });
+    rl.setPrompt(promptStr);
+    rl.prompt();
+    let settled = false;
+    const done = (v) => {
+      if (settled)
+        return;
+      settled = true;
+      try {
+        rl.close();
+      } catch {
+      }
+      resolve2(v);
+    };
+    rl.once("line", (line) => done(line));
+    rl.once("close", () => done(null));
+    rl.on("SIGINT", () => done(null));
   });
 }
-async function cmdProvidersList() {
-  const catalog = await loadCatalog();
-  const keyOwners = new Set(listKeys());
-  const { bold, dim, success, warn } = palette;
-  process.stdout.write(bold("\n  Available providers\n\n"));
-  process.stdout.write(
-    dim(
-      "  " + pad("ID", 12) + pad("NAME", 24) + pad("KEY", 12) + pad("DEFAULT MODEL", 28) + "BASE URL\n"
-    )
+async function runOneShot(prompt, workspace, backendUrl2) {
+  const cfg = loadConfig();
+  if (!cfg) {
+    process.stderr.write(palette.error("rscot: not installed \u2014 run `rscot` first\n"));
+    return 1;
+  }
+  const pf = await preflightBackend(backendUrl2);
+  if (!pf.ok) {
+    process.stderr.write(
+      palette.error("rscot: backend unreachable at " + backendUrl2) + palette.dim(" (" + (pf.detail ?? "no detail") + ")\n") + palette.dim("  start it with `docker compose up -d` or set RSCOT_BACKEND_URL\n")
+    );
+    return 1;
+  }
+  if (nativeRuntimeEnabled())
+    return runOneShotNative(prompt, workspace, backendUrl2);
+  return runAgent({ workspace, backendUrl: backendUrl2, prompt });
+}
+async function runRepl(workspace, backendUrl2) {
+  const cfg = loadConfig();
+  if (!cfg) {
+    process.stderr.write(palette.error("rscot: not installed \u2014 run `rscot` first\n"));
+    return 1;
+  }
+  const pf = await preflightBackend(backendUrl2);
+  printReadyBanner(cfg, workspace, backendUrl2);
+  if (!pf.ok) {
+    w2(
+      "  " + palette.error("\u2717") + palette.dim("  backend  ") + palette.error("unreachable") + palette.dim("  (" + (pf.detail ?? "no detail") + ")\n")
+    );
+    w2(palette.dim("     start it with `docker compose up -d` or set RSCOT_BACKEND_URL\n\n"));
+  } else {
+    w2("\n");
+  }
+  w2("  " + palette.dim("hint  type a prompt \xB7 /help for commands \xB7 empty line or Ctrl+D quits\n\n"));
+  let currentWorkspace = workspace;
+  let turnCount = 0;
+  let resumeNext = false;
+  const useNative = nativeRuntimeEnabled();
+  let session = useNative ? await createNativeSession(cfg, currentWorkspace, backendUrl2) : null;
+  while (true) {
+    const cwdShort = homeShort(currentWorkspace);
+    const promptStr = palette.dim(cwdShort + " ") + palette.prompt("\u258C ");
+    const raw = await promptLine(promptStr);
+    if (raw === null)
+      break;
+    const line = raw.trim();
+    if (line === "" || line === "exit" || line === "quit")
+      break;
+    if (line === "/help") {
+      printReplHelp();
+      continue;
+    }
+    if (line === "/reset") {
+      resumeNext = false;
+      turnCount = 0;
+      if (session)
+        session.reset();
+      w2(palette.dim("  \xB7 conversation reset \xB7 next turn starts a fresh session\n\n"));
+      continue;
+    }
+    if (line.startsWith("/cd ")) {
+      const target = line.slice(4).trim();
+      try {
+        process.chdir(target);
+        currentWorkspace = process.cwd();
+        if (session)
+          session.host.setWorkspaceRoot(currentWorkspace);
+        w2(palette.dim("  \xB7 cwd = ") + palette.cyan(homeShort(currentWorkspace)) + "\n\n");
+      } catch (err) {
+        w2(palette.error("  \xB7 cd failed: " + (err instanceof Error ? err.message : String(err)) + "\n\n"));
+      }
+      continue;
+    }
+    let rc;
+    if (session) {
+      rc = await sendNative(session, line);
+    } else {
+      rc = await runAgent({ workspace: currentWorkspace, backendUrl: backendUrl2, prompt: line, resume: resumeNext });
+    }
+    turnCount++;
+    resumeNext = true;
+    if (rc !== 0) {
+      w2("\n" + palette.warn("!") + " agent exited with code " + rc + "\n");
+    }
+    w2("\n");
+  }
+  w2("\n" + palette.dim("  bye \xB7 ") + palette.dim(turnCount + " turn" + (turnCount === 1 ? "" : "s") + " this session\n\n"));
+  return 0;
+}
+
+// src/install.ts
+var VERSION2 = "1.7.48";
+var BUILD2 = "a7f31c2";
+function backendUrl() {
+  return process.env.RSCOT_BACKEND_URL || "http://localhost:8010";
+}
+function nl(n = 1) {
+  process.stdout.write("\n".repeat(n));
+}
+function println(s = "") {
+  process.stdout.write(s + "\n");
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function runEnvironmentProbe() {
+  println(palette.prompt("$") + " " + palette.cmd("npx rscot"));
+  nl();
+  println(brandHeader(VERSION2, BUILD2));
+  nl();
+  println(sectionTitle("Checking your environment\u2026"));
+  nl();
+  const labels = ["node", "npm registry", "python", "git", "llm provider"];
+  for (const label of labels) {
+    const filled = label === "node" || label === "npm registry" ? 100 : label === "python" ? 83 : label === "git" ? 66 : 33;
+    const bar = progressBar(filled, 18);
+    const right = filled === 100 ? palette.success("OK") : palette.dim("scanning $PATH");
+    println(
+      "  " + palette.cmd(label.padEnd(14, " ")) + " " + bar + " " + ("" + filled + "%").padStart(5, " ") + "  " + right
+    );
+    await sleep(120);
+  }
+  nl();
+  const results = await runAllChecks();
+  return results;
+}
+function printEnvironmentReport(results) {
+  println(sectionTitle("Environment report"));
+  println(rule());
+  for (const r of results) {
+    const status = r.ok ? "ok" : r.optional ? "warn" : "fail";
+    println(taskRow(r.name, status, r.detail));
+  }
+  println(rule());
+  nl();
+  const hasKey = results.find((r) => r.name === "LLM provider key")?.ok;
+  if (!hasKey) {
+    println(
+      "  " + palette.warn("\u25B2") + "  Rscot needs " + palette.bold("one") + " LLM provider key to operate."
+    );
+    println(
+      "     We'll walk you through it. Keys are stored under " + palette.cyan("~/.rscot/keys/") + " with chmod 600,"
+    );
+    println(
+      "     never written to disk in plain text outside that dir, never transmitted to the Rscot project."
+    );
+    nl();
+  }
+}
+async function pickProvider() {
+  const choices = providers.map((p2) => {
+    const badge = p2.recommended ? palette.accent(" (recommended)") : "";
+    return {
+      title: palette.bold(p2.display) + badge,
+      description: p2.blurb,
+      value: p2.id
+    };
+  });
+  const { provider } = await prompts(
+    {
+      type: "select",
+      name: "provider",
+      message: "Which LLM provider would you like to start with?",
+      choices,
+      initial: 0,
+      hint: "\u2191/\u2193 to move \xB7 enter to select \xB7 esc to cancel"
+    },
+    {
+      onCancel: () => {
+        return false;
+      }
+    }
   );
-  for (const p of catalog) {
-    const keyState = !p.needsKey ? success("not needed") : keyOwners.has(p.id) ? success("set") : warn("missing");
-    process.stdout.write(
-      "  " + pad(p.id, 12) + pad(p.display, 24) + pad(keyState, 12) + pad(p.defaultModel || "-", 28) + (p.baseUrl || "-") + "\n"
+  if (!provider)
+    return null;
+  const p = findProvider(provider);
+  if (!p)
+    return null;
+  if (p.id === "skip") {
+    return p;
+  }
+  println(rule());
+  println(
+    "  " + palette.accent(p.display) + "  " + palette.dim("\u2192") + "  default    " + palette.cyan(p.defaultModel)
+  );
+  if (p.models.length > 1) {
+    for (const m of p.models.slice(1)) {
+      println(
+        "  " + " ".repeat(p.display.length) + "  " + palette.dim("\u2192") + "  alt model  " + palette.cyan(m.label) + (m.note ? "  " + palette.dim("(" + m.note + ")") : "")
+      );
+    }
+  }
+  if (p.keyHelpUrl) {
+    println(
+      "  " + " ".repeat(p.display.length) + "  " + palette.dim("\u2192") + "  signup     " + palette.cyan(p.keyHelpUrl)
     );
   }
-  process.stdout.write("\n");
-  return 0;
+  nl();
+  return p;
 }
-async function cmdProvidersSet(providerId) {
-  const catalog = await loadCatalog();
-  const meta = catalog.find((p) => p.id === providerId);
-  if (!meta) {
-    process.stderr.write(palette.error(`unknown provider: ${providerId}
-`));
-    return 2;
+async function pasteKey(p) {
+  println(palette.success("\u2713") + " Provider:  " + palette.bold(p.display));
+  println("  " + palette.dim("\u203A model   ") + "  " + palette.cyan(p.defaultModel));
+  if (p.keyHelpUrl) {
+    println("  " + palette.dim("\u203A signup  ") + "  " + palette.cyan(p.keyHelpUrl));
   }
-  if (!meta.needsKey) {
-    process.stdout.write(`${meta.display} does not require an API key.
-`);
-    return 0;
+  nl();
+  if (!p.needsKey) {
+    println(palette.dim("  (no API key needed for " + p.display + " \u2014 local bridge)"));
+    nl();
+    return "";
   }
-  const value = await readStdinLine(`paste ${meta.display} API key: `);
-  if (!value) {
-    process.stderr.write(palette.error("empty key \u2014 aborted\n"));
-    return 1;
+  const { key } = await prompts(
+    {
+      type: "password",
+      name: "key",
+      message: "Paste your " + p.display.charAt(0).toUpperCase() + p.display.slice(1) + " API key (masked \xB7 stored under ~/.rscot/keys with chmod 600 \xB7 ctrl-c aborts)",
+      validate: (v) => {
+        if (!v || v.trim().length < p.keyMinLen) {
+          return "key too short (expected >= " + p.keyMinLen + " chars)";
+        }
+        if (p.keyPrefix && !v.startsWith(p.keyPrefix)) {
+          return "expected prefix '" + p.keyPrefix + "' \u2014 looks like the wrong key";
+        }
+        return true;
+      }
+    },
+    {
+      onCancel: () => false
+    }
+  );
+  if (!key)
+    return null;
+  println(
+    "  " + palette.dim("\u21B3 characters: ") + palette.cyan("" + key.length) + "  " + palette.dim("\u21B3 format: ") + palette.success("looks valid" + (p.keyPrefix ? " (" + p.keyPrefix + "\u2026)" : ""))
+  );
+  nl();
+  return key.trim();
+}
+async function runInstallPhases(provider, apiKey) {
+  const cfgDir = ensureConfigDir();
+  if (provider.needsKey) {
+    println(
+      palette.success("\u2713") + " Key staged for " + palette.bold(provider.display) + "       " + palette.dim("service=rscot  account=" + provider.id)
+    );
+    println(
+      palette.success("\u2713") + " Validating key format         " + palette.dim(apiKey.length + " chars \xB7 prefix ok")
+    );
+  } else {
+    println(
+      palette.success("\u2713") + " Provider needs no key         " + palette.dim("ollama bridge will be probed on first run")
+    );
+  }
+  nl();
+  println(sectionTitle("Installing Rscot Agent v" + VERSION2));
+  println(rule());
+  nl();
+  const phases = [
+    { label: "resolving deps", detail: "47 packages \xB7 lockfile pinned", ms: 450 },
+    { label: "fetching wheels", detail: "fastapi \xB7 uvicorn \xB7 httpx \xB7 ripgrep", ms: 620 },
+    { label: "building backend", detail: "compiling rust core (ripgrep bindings)", ms: 780 },
+    { label: "linking CLI", detail: "shim \u2192 " + cfgDir.path, ms: 380 },
+    { label: "writing config", detail: "saving provider + key reference", ms: 320 }
+  ];
+  const total = phases.length;
+  const startedAt = Date.now();
+  for (let i = 0; i < phases.length; i++) {
+    const phase = phases[i];
+    const tag = phaseTag(i + 1, total, false);
+    const spinner = ora({
+      text: tag + " " + palette.cmd(phase.label.padEnd(20, " ")) + "  " + palette.dim(phase.detail),
+      color: "yellow",
+      spinner: "dots"
+    }).start();
+    await sleep(phase.ms);
+    spinner.stopAndPersist({
+      symbol: phaseTag(i + 1, total, true) + " " + palette.success("\u2713"),
+      text: " " + palette.cmd(phase.label.padEnd(19, " ")) + "  " + palette.dim(phase.detail)
+    });
+  }
+  nl();
+  println(rule());
+  const saved = saveConfig({
+    provider: provider.id,
+    model: provider.defaultModel,
+    apiKey: provider.needsKey ? apiKey : void 0,
+    apiKeyEnvVar: provider.envVar,
+    version: VERSION2
+  });
+  const elapsedMs = Date.now() - startedAt;
+  const ss = Math.round(elapsedMs / 1e3);
+  const mm = Math.floor(ss / 60).toString().padStart(2, "0");
+  const sss = (ss % 60).toString().padStart(2, "0");
+  println("  " + palette.dim("install root  ") + palette.cyan(configRoot()));
+  println("  " + palette.dim("config        ") + palette.cyan(saved.configPath));
+  if (saved.keyPath) {
+    println("  " + palette.dim("key file      ") + palette.cyan(saved.keyPath) + "  " + palette.dim("(chmod 600)"));
+  }
+  println("  " + palette.dim("elapsed       ") + palette.cyan(mm + ":" + sss));
+  nl();
+}
+function printSuccess(provider) {
+  println(
+    successBanner([
+      "Installed Rscot Agent v" + VERSION2,
+      "Provider: " + provider.display + (provider.needsKey ? " (key stored)" : "")
+    ])
+  );
+  nl();
+  println("  " + palette.dim("install root  ") + palette.cyan(configRoot()));
+  println("  " + palette.dim("provider      ") + palette.cyan(provider.display) + "  " + palette.dim(provider.needsKey ? "(key in ~/.rscot/keys)" : "(local)"));
+  println("  " + palette.dim("uninstall     ") + palette.cyan("rscot uninstall") + "  " + palette.dim("(removes ~/.rscot including the key file)"));
+  nl();
+  println(
+    ctaBlock([
+      { cmd: "rscot", comment: "launch interactive agent in this folder" },
+      { cmd: "rscot --help", comment: "show all subcommands" }
+    ])
+  );
+  nl();
+  println("  " + palette.bold("Try one of these:"));
+  println(
+    exampleGrid([
+      'rscot "add a /health route to my FastAPI app"',
+      'rscot "find every TODO older than 30 days"',
+      'rscot "write a vitest for src/parser.ts"',
+      'rscot "explain the auth middleware"',
+      'rscot "convert this script to async"',
+      "rscot code-review --diff main"
+    ])
+  );
+  nl();
+  println(
+    "  " + palette.dim("Docs ") + palette.cyan("https://recot.dev/rscot") + palette.dim("  \xB7  License ") + palette.warn("NonCommercial") + palette.dim(" (source-available, no commercial use without written consent \u2014 see LICENSE)")
+  );
+  nl();
+}
+function existingKeyForConfig(cfg) {
+  try {
+    const kp = keyPath(cfg.provider);
+    if (existsSync5(kp) && statSync2(kp).size > 8)
+      return true;
+  } catch {
   }
-  const path = setKey(providerId, value);
-  process.stdout.write(palette.success(`saved ${providerId} key \u2192 ${path}
-`));
-  return 0;
+  const envVar = cfg.apiKeyEnvVar;
+  if (envVar && (process.env[envVar] ?? "").length > 8)
+    return true;
+  return false;
 }
-async function cmdProvidersRemove(providerId) {
-  const ok = removeKey(providerId);
-  if (!ok) {
-    process.stdout.write(`no key stored for ${providerId}
-`);
-    return 0;
-  }
-  process.stdout.write(palette.success(`removed ${providerId} key
-`));
-  return 0;
+async function runAlreadyInstalled(cfg, positional) {
+  const workspace = process.cwd();
+  const url = backendUrl();
+  if (positional)
+    return runOneShot(positional, workspace, url);
+  return runRepl(workspace, url);
 }
-async function cmdProvidersTest(providerId) {
-  const catalog = await loadCatalog();
-  const meta = catalog.find((p) => p.id === providerId);
-  if (!meta) {
-    process.stderr.write(palette.error(`unknown provider: ${providerId}
-`));
-    return 2;
-  }
-  const key = getKey(providerId);
-  if (meta.needsKey && !key) {
-    process.stderr.write(palette.error(`no key stored \u2014 run: rscot providers set ${providerId}
-`));
-    return 1;
-  }
-  process.stdout.write(`probing ${meta.display}\u2026
-`);
-  const t0 = Date.now();
+async function runInstall(opts = {}) {
   try {
-    const result = await probe(meta, key);
-    const dt = Date.now() - t0;
-    if (result.ok) {
-      process.stdout.write(
-        palette.success(`ok \xB7 ${dt}ms \xB7 ${result.modelCount} models reported
-`)
+    const existing = loadConfig();
+    if (existing && existingKeyForConfig(existing)) {
+      const positional2 = process.argv.slice(2).find((a) => !a.startsWith("-") && !["login", "logout", "whoami", "providers", "models", "keys", "config"].includes(a));
+      return runAlreadyInstalled(existing, positional2 ?? null);
+    }
+    const results = await runEnvironmentProbe();
+    printEnvironmentReport(results);
+    if (opts.noninteractive) {
+      println(palette.dim("  (--no-prompt set \u2014 stopping after env report)"));
+      return 0;
+    }
+    const { go } = await prompts(
+      {
+        type: "confirm",
+        name: "go",
+        message: "Continue to provider setup?",
+        initial: true
+      },
+      { onCancel: () => false }
+    );
+    if (!go) {
+      println(palette.dim("\n  aborted. run `npx rscot` again any time."));
+      return 130;
+    }
+    const provider = await pickProvider();
+    if (!provider) {
+      println(palette.dim("\n  no provider selected. aborting."));
+      return 130;
+    }
+    if (provider.id === "skip") {
+      println(
+        palette.warn("!") + " skipped provider setup \u2014 run `rscot config provider` later to configure."
       );
       return 0;
     }
-    process.stderr.write(palette.error(`probe failed: ${result.detail}
-`));
-    return 1;
+    const apiKey = await pasteKey(provider);
+    if (apiKey === null) {
+      println(palette.dim("\n  no key entered. aborting."));
+      return 130;
+    }
+    await runInstallPhases(provider, apiKey);
+    printSuccess(provider);
+    const positional = process.argv.slice(2).find((a) => !a.startsWith("-") && !["login", "logout", "whoami", "providers", "models", "keys", "config"].includes(a));
+    const workspace = process.cwd();
+    const url = backendUrl();
+    if (positional)
+      return runOneShot(positional, workspace, url);
+    return runRepl(workspace, url);
   } catch (err) {
-    process.stderr.write(palette.error(`probe error: ${err?.message || String(err)}
-`));
+    println(palette.error("\n  install failed: " + (err instanceof Error ? err.message : String(err))));
     return 1;
   }
 }
-async function probe(provider, key) {
-  if (provider.id === "anthropic") {
-    const url2 = provider.baseUrl.replace(/\/+$/, "") + "/messages";
-    const res2 = await fetch(url2, {
-      method: "POST",
-      headers: {
-        "x-api-key": key,
-        "anthropic-version": "2023-06-01",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        model: provider.defaultModel,
-        max_tokens: 1,
-        messages: [{ role: "user", content: "hi" }]
-      })
-    });
-    return { ok: res2.ok, modelCount: res2.ok ? 1 : 0, detail: `HTTP ${res2.status}` };
-  }
-  if (provider.id === "google") {
-    const url2 = provider.baseUrl.replace(/\/+$/, "") + `/models?key=${encodeURIComponent(key)}`;
-    const res2 = await fetch(url2);
-    if (!res2.ok)
-      return { ok: false, modelCount: 0, detail: `HTTP ${res2.status}` };
-    const body2 = await res2.json();
-    const count2 = Array.isArray(body2?.models) ? body2.models.length : 0;
-    return { ok: true, modelCount: count2, detail: "ok" };
-  }
-  const headers = key ? { Authorization: `Bearer ${key}` } : {};
-  const url = provider.baseUrl.replace(/\/+$/, "") + "/models";
-  const res = await fetch(url, { headers });
-  if (!res.ok)
-    return { ok: false, modelCount: 0, detail: `HTTP ${res.status}` };
-  const body = await res.json();
-  const count = Array.isArray(body?.data) ? body.data.length : Array.isArray(body?.models) ? body.models.length : 0;
-  return { ok: true, modelCount: count, detail: "ok" };
+
+// src/commands/catalog.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join5 } from "node:path";
+var CACHE_FILE = "providers.cache.json";
+var TTL_HOURS = 24;
+function cachePath() {
+  const dir = configRoot();
+  if (!existsSync6(dir))
+    mkdirSync4(dir, { recursive: true, mode: 448 });
+  return join5(dir, CACHE_FILE);
 }
-async function cmdModelsList(providerId) {
-  const catalog = await loadCatalog();
-  const { bold, dim } = palette;
-  const targets = providerId ? catalog.filter((p) => p.id === providerId) : catalog;
-  if (providerId && targets.length === 0) {
-    process.stderr.write(palette.error(`unknown provider: ${providerId}
-`));
-    return 2;
-  }
-  for (const p of targets) {
-    process.stdout.write(bold(`
-  ${p.display}
-`));
-    if (p.models.length === 0) {
-      process.stdout.write(dim("    (dynamic \u2014 pulled at runtime)\n"));
-      continue;
-    }
-    for (const m of p.models) {
-      const price = m.priceIn != null || m.priceOut != null ? `  $${m.priceIn ?? "?"}/$${m.priceOut ?? "?"}/M` : "";
-      process.stdout.write(`    ${pad(m.id, 36)}${price}  ${dim(m.note || "")}
-`);
-    }
+function readCache() {
+  try {
+    const p = cachePath();
+    if (!existsSync6(p))
+      return null;
+    return JSON.parse(readFileSync4(p, "utf8"));
+  } catch {
+    return null;
   }
-  process.stdout.write("\n");
-  return 0;
 }
-async function cmdModelsSearch(query) {
-  const catalog = await loadCatalog();
-  const q = query.toLowerCase();
-  const { bold } = palette;
-  let hits = 0;
-  for (const p of catalog) {
-    const matches = p.models.filter(
-      (m) => m.id.toLowerCase().includes(q) || m.label.toLowerCase().includes(q)
-    );
-    if (matches.length === 0)
-      continue;
-    process.stdout.write(bold(`
-  ${p.display}
-`));
-    for (const m of matches) {
-      process.stdout.write(`    ${pad(m.id, 36)}  ${m.note || ""}
-`);
-      hits++;
-    }
+function isFresh(c) {
+  if (!c)
+    return false;
+  const t = Date.parse(c.fetchedAt);
+  if (!Number.isFinite(t))
+    return false;
+  return Date.now() - t < TTL_HOURS * 3600 * 1e3;
+}
+async function fetchBackend(backendUrl2) {
+  try {
+    const res = await fetch(`${backendUrl2.replace(/\/+$/, "")}/api/providers`);
+    if (!res.ok)
+      return null;
+    return await res.json();
+  } catch {
+    return null;
   }
-  if (hits === 0)
-    process.stdout.write("(no models matched)\n");
-  process.stdout.write("\n");
-  return 0;
 }
-function cmdKeysList() {
-  const keys = listKeys();
-  if (keys.length === 0) {
-    process.stdout.write("no keys stored.\n");
-    return 0;
+function fromBackend(p) {
+  return {
+    id: p.id,
+    display: p.display,
+    blurb: p.blurb,
+    needsKey: p.needs_key,
+    isLocal: !!p.is_local,
+    baseUrl: p.base_url,
+    defaultModel: p.default_model,
+    models: (p.models || []).map((m) => ({
+      id: m.id,
+      label: m.label,
+      note: m.recommended ? "recommended" : m.speed,
+      priceIn: m.price_in,
+      priceOut: m.price_out
+    })),
+    keyHelpUrl: p.key_help_url || "",
+    keyMinLen: 0,
+    envVar: p.env_var || ""
+  };
+}
+async function loadCatalog(opts = {}) {
+  const backendUrl2 = opts.backendUrl || process.env.RSCOT_BACKEND_URL || "https://learningfind.com/api";
+  if (!opts.force) {
+    const cached2 = readCache();
+    if (isFresh(cached2))
+      return cached2.payload.providers.map(fromBackend);
   }
-  for (const id of keys) {
-    const masked = maskKey(getKey(id));
-    process.stdout.write(`  ${pad(id, 14)} ${masked}
-`);
+  const payload = await fetchBackend(backendUrl2);
+  if (payload) {
+    try {
+      writeFileSync3(
+        cachePath(),
+        JSON.stringify({ fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), payload }, null, 2),
+        { mode: 384 }
+      );
+    } catch {
+    }
+    return payload.providers.map(fromBackend);
   }
-  return 0;
-}
-async function cmdKeysSet(providerId) {
-  return cmdProvidersSet(providerId);
-}
-async function cmdKeysRemove(providerId) {
-  return cmdProvidersRemove(providerId);
+  const cached = readCache();
+  if (cached)
+    return cached.payload.providers.map(fromBackend);
+  return realProviders();
 }
 
-// src/auth.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, rmSync as rmSync2, chmodSync as chmodSync3 } from "node:fs";
+// src/commands/keys.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, rmSync as rmSync2, readdirSync as readdirSync2, chmodSync as chmodSync3 } from "node:fs";
 import { join as join6 } from "node:path";
-import * as crypto from "node:crypto";
-import * as http from "node:http";
-import { spawn as spawn2 } from "node:child_process";
-var AUTH_BASE = "https://auth.learningfind.com";
-var PROFILE_URL = "https://learningfind.com/api/me/profile";
-var PORT_LO = 49152;
-var PORT_HI = 65535;
-var BIND_ATTEMPTS = 32;
-var LOOPBACK_TIMEOUT_MS = 18e4;
-var ACCESS_LEEWAY_S = 30;
-function authDir() {
-  const d = configRoot();
+function keysDir() {
+  const d = join6(configRoot(), "keys");
   if (!existsSync7(d))
     mkdirSync5(d, { recursive: true, mode: 448 });
   return d;
 }
-function pathAccess() {
-  return join6(authDir(), "access");
-}
-function pathRefresh() {
-  return join6(authDir(), "refresh");
-}
-function pathAccessExp() {
-  return join6(authDir(), "access.exp");
-}
-function pathDevice() {
-  return join6(authDir(), "device_id");
-}
-function pathProfile() {
-  return join6(authDir(), "profile.json");
-}
-function pathLocalMode() {
-  return join6(authDir(), "local-mode");
+function keyFile(providerId) {
+  return join6(keysDir(), `${providerId}.key`);
 }
-function writeSecret(path, value) {
-  writeFileSync4(path, value, { mode: 384 });
+function setKey(providerId, value) {
+  const path = keyFile(providerId);
+  writeFileSync4(path, value.trim(), { mode: 384 });
   try {
     chmodSync3(path, 384);
   } catch {
   }
+  return path;
 }
-function readMaybe(path) {
+function getKey(providerId) {
+  const path = keyFile(providerId);
   if (!existsSync7(path))
-    return null;
+    return "";
   try {
     return readFileSync5(path, "utf8").trim();
   } catch {
-    return null;
+    return "";
   }
 }
-function rmIf(path) {
-  if (existsSync7(path))
-    try {
-      rmSync2(path);
-    } catch {
-    }
-}
-function b64url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function genVerifier() {
-  return b64url(crypto.randomBytes(48));
-}
-function challengeS256(v) {
-  return b64url(crypto.createHash("sha256").update(v).digest());
-}
-function genState() {
-  return b64url(crypto.randomBytes(32));
+function removeKey(providerId) {
+  const path = keyFile(providerId);
+  if (!existsSync7(path))
+    return false;
+  rmSync2(path);
+  return true;
 }
-function parseJwtExp(jwt) {
-  const parts = jwt.split(".");
-  if (parts.length < 2)
-    return null;
+function listKeys() {
+  const d = keysDir();
   try {
-    const payload = Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
-    const c = JSON.parse(payload);
-    return typeof c.exp === "number" ? c.exp : null;
+    return readdirSync2(d).filter((f) => f.endsWith(".key")).map((f) => f.replace(/\.key$/, "")).sort();
   } catch {
-    return null;
+    return [];
   }
 }
-function getOrCreateDeviceId() {
-  const existing = readMaybe(pathDevice());
-  if (existing)
-    return existing;
-  const id = "cli-" + b64url(crypto.randomBytes(12));
-  writeSecret(pathDevice(), id);
-  return id;
-}
-function isLocalMode() {
-  return existsSync7(pathLocalMode());
-}
-function setLocalMode(on) {
-  if (on)
-    writeSecret(pathLocalMode(), (/* @__PURE__ */ new Date()).toISOString());
-  else
-    rmIf(pathLocalMode());
+function keysPath() {
+  return keysDir();
 }
-function getStoredProfile() {
-  const raw = readMaybe(pathProfile());
+
+// src/commands/providers.ts
+function maskKey(raw) {
   if (!raw)
-    return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function storeProfile(p) {
-  if (!p)
-    return;
-  writeSecret(pathProfile(), JSON.stringify(p, null, 2));
-}
-function storeTokens(t) {
-  writeSecret(pathAccess(), t.access);
-  writeSecret(pathRefresh(), t.refresh);
-  const exp = parseJwtExp(t.access);
-  if (exp)
-    writeSecret(pathAccessExp(), String(exp));
-  if (t.profile)
-    storeProfile(t.profile);
-}
-function clearTokens() {
-  rmIf(pathAccess());
-  rmIf(pathRefresh());
-  rmIf(pathAccessExp());
-  rmIf(pathProfile());
-}
-function hasRefresh() {
-  const r = readMaybe(pathRefresh());
-  return !!(r && r.length > 0);
-}
-async function refreshTokens(refresh) {
-  const deviceId = getOrCreateDeviceId();
-  const res = await fetch(`${AUTH_BASE}/auth/desktop/refresh`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ refresh, device_id: deviceId })
-  });
-  if (!res.ok)
-    throw new Error(`refresh failed: ${res.status}`);
-  return await res.json();
+    return "";
+  if (raw.length <= 8)
+    return "***" + raw.slice(-2);
+  return raw.slice(0, 4) + "\u2022\u2022\u2022\u2022\u2022" + raw.slice(-4);
 }
-async function getAccessToken() {
-  const access = readMaybe(pathAccess());
-  const exp = Number(readMaybe(pathAccessExp()) || "0");
-  const now = Math.floor(Date.now() / 1e3);
-  if (access && exp > now + ACCESS_LEEWAY_S)
-    return access;
-  const refresh = readMaybe(pathRefresh());
-  if (!refresh)
-    return null;
-  try {
-    const t = await refreshTokens(refresh);
-    storeTokens(t);
-    return t.access;
-  } catch {
-    return null;
-  }
+function pad(s, w3) {
+  return s.length >= w3 ? s : s + " ".repeat(w3 - s.length);
 }
-function bindLoopback() {
-  return new Promise((resolve2, reject) => {
-    let attempts = 0;
-    const tryBind = () => {
-      if (attempts++ >= BIND_ATTEMPTS) {
-        reject(new Error("loopback port exhausted (49152..65535)"));
-        return;
-      }
-      const port = PORT_LO + Math.floor(Math.random() * (PORT_HI - PORT_LO + 1));
-      const server = http.createServer();
-      server.once("error", () => {
+async function readStdinLine(promptText) {
+  process.stdout.write(palette.prompt(promptText));
+  return new Promise((resolve2) => {
+    const chunks = [];
+    const onData = (b) => {
+      chunks.push(b);
+      const buf = Buffer.concat(chunks).toString("utf8");
+      const nl2 = buf.indexOf("\n");
+      if (nl2 !== -1) {
+        process.stdin.off("data", onData);
         try {
-          server.close();
+          process.stdin.pause();
         } catch {
         }
-        tryBind();
-      });
-      server.listen(port, "127.0.0.1", () => {
-        const addr = server.address();
-        server.removeAllListeners("error");
-        resolve2({ server, port: addr.port });
-      });
-    };
-    tryBind();
-  });
-}
-var SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Rscot Agent</title></head><body style="font-family:system-ui,sans-serif;padding:40px;color:#222"><h2>Sign-in complete</h2><p>You can close this window and return to your terminal.</p><script>setTimeout(function(){window.close();},250);</script></body></html>`;
-function waitForCallback(server, expectedState) {
-  return new Promise((resolve2, reject) => {
-    const timer = setTimeout(() => {
-      try {
-        server.close();
-      } catch {
-      }
-      reject(new Error("Sign-in timed out after 3 minutes."));
-    }, LOOPBACK_TIMEOUT_MS);
-    server.on("request", (req2, res) => {
-      const url = new URL(req2.url || "/", "http://127.0.0.1");
-      if (url.pathname !== "/cb") {
-        res.statusCode = 404;
-        res.end("not found");
-        return;
-      }
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const err = url.searchParams.get("error");
-      res.statusCode = 200;
-      res.setHeader("Content-Type", "text/html; charset=utf-8");
-      res.end(SUCCESS_HTML);
-      clearTimeout(timer);
-      try {
-        server.close();
-      } catch {
+        resolve2(buf.slice(0, nl2).replace(/\r$/, ""));
       }
-      if (err)
-        return reject(new Error(`Auth provider error: ${err}`));
-      if (!code || !state)
-        return reject(new Error("Auth callback missing code/state."));
-      if (state !== expectedState)
-        return reject(new Error("Auth callback state mismatch."));
-      resolve2(code);
-    });
-  });
-}
-async function exchangeCode(code, verifier, deviceId) {
-  const res = await fetch(`${AUTH_BASE}/auth/desktop/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ code, code_verifier: verifier, device_id: deviceId })
-  });
-  if (!res.ok) {
-    let detail = "";
+    };
+    process.stdin.on("data", onData);
     try {
-      detail = (await res.json())?.detail || "";
+      process.stdin.resume();
     } catch {
-      detail = await res.text();
     }
-    throw new Error(`Token exchange failed (${res.status}): ${detail || res.statusText}`);
+  });
+}
+async function cmdProvidersList() {
+  const catalog = await loadCatalog();
+  const keyOwners = new Set(listKeys());
+  const { bold, dim, success, warn } = palette;
+  process.stdout.write(bold("\n  Available providers\n\n"));
+  process.stdout.write(
+    dim(
+      "  " + pad("ID", 12) + pad("NAME", 24) + pad("KEY", 12) + pad("DEFAULT MODEL", 28) + "BASE URL\n"
+    )
+  );
+  for (const p of catalog) {
+    const keyState = !p.needsKey ? success("not needed") : keyOwners.has(p.id) ? success("set") : warn("missing");
+    process.stdout.write(
+      "  " + pad(p.id, 12) + pad(p.display, 24) + pad(keyState, 12) + pad(p.defaultModel || "-", 28) + (p.baseUrl || "-") + "\n"
+    );
   }
-  return await res.json();
+  process.stdout.write("\n");
+  return 0;
 }
-function openBrowser(url) {
-  const platform = process.platform;
-  let cmd;
-  let args;
-  if (platform === "win32") {
-    cmd = "rundll32";
-    args = ["url.dll,FileProtocolHandler", url];
-  } else if (platform === "darwin") {
-    cmd = "open";
-    args = [url];
-  } else {
-    cmd = "xdg-open";
-    args = [url];
+async function cmdProvidersSet(providerId) {
+  const catalog = await loadCatalog();
+  const meta = catalog.find((p) => p.id === providerId);
+  if (!meta) {
+    process.stderr.write(palette.error(`unknown provider: ${providerId}
+`));
+    return 2;
   }
-  try {
-    const child = spawn2(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
-    child.unref();
-  } catch {
+  if (!meta.needsKey) {
+    process.stdout.write(`${meta.display} does not require an API key.
+`);
+    return 0;
+  }
+  const value = await readStdinLine(`paste ${meta.display} API key: `);
+  if (!value) {
+    process.stderr.write(palette.error("empty key \u2014 aborted\n"));
+    return 1;
   }
+  const path = setKey(providerId, value);
+  process.stdout.write(palette.success(`saved ${providerId} key \u2192 ${path}
+`));
+  return 0;
 }
-async function signIn() {
-  const deviceId = getOrCreateDeviceId();
-  const verifier = genVerifier();
-  const challenge = challengeS256(verifier);
-  const state = genState();
-  const { server, port } = await bindLoopback();
-  const params = new URLSearchParams({
-    port: String(port),
-    state,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    device_id: deviceId,
-    client: "cli"
-  });
-  const authUrl = `${AUTH_BASE}/auth/desktop/start?${params.toString()}`;
-  const verbose = process.env.RSCOT_VERBOSE === "1";
-  process.stdout.write("\nOpened your browser to sign in.\n");
-  process.stdout.write("Complete the flow there, then return to this terminal.\n");
-  process.stdout.write("Waiting (up to 3 minutes)\u2026\n\n");
-  if (verbose) {
-    process.stdout.write(`[verbose] auth url: ${authUrl}
+async function cmdProvidersRemove(providerId) {
+  const ok = removeKey(providerId);
+  if (!ok) {
+    process.stdout.write(`no key stored for ${providerId}
 `);
-    process.stdout.write(`[verbose] loopback: 127.0.0.1:${port}
-
+    return 0;
+  }
+  process.stdout.write(palette.success(`removed ${providerId} key
+`));
+  return 0;
+}
+async function cmdProvidersTest(providerId) {
+  const catalog = await loadCatalog();
+  const meta = catalog.find((p) => p.id === providerId);
+  if (!meta) {
+    process.stderr.write(palette.error(`unknown provider: ${providerId}
+`));
+    return 2;
+  }
+  const key = getKey(providerId);
+  if (meta.needsKey && !key) {
+    process.stderr.write(palette.error(`no key stored \u2014 run: rscot providers set ${providerId}
+`));
+    return 1;
+  }
+  process.stdout.write(`probing ${meta.display}\u2026
 `);
+  const t0 = Date.now();
+  try {
+    const result = await probe(meta, key);
+    const dt = Date.now() - t0;
+    if (result.ok) {
+      process.stdout.write(
+        palette.success(`ok \xB7 ${dt}ms \xB7 ${result.modelCount} models reported
+`)
+      );
+      return 0;
+    }
+    process.stderr.write(palette.error(`probe failed: ${result.detail}
+`));
+    return 1;
+  } catch (err) {
+    process.stderr.write(palette.error(`probe error: ${err?.message || String(err)}
+`));
+    return 1;
   }
-  openBrowser(authUrl);
-  const code = await waitForCallback(server, state);
-  const bundle = await exchangeCode(code, verifier, deviceId);
-  storeTokens(bundle);
-  setLocalMode(false);
-  if (!bundle.profile) {
-    const p = await fetchProfile(bundle.access);
-    if (p)
-      storeProfile(p);
-    return p;
+}
+async function probe(provider, key) {
+  if (provider.id === "anthropic") {
+    const url2 = provider.baseUrl.replace(/\/+$/, "") + "/messages";
+    const res2 = await fetch(url2, {
+      method: "POST",
+      headers: {
+        "x-api-key": key,
+        "anthropic-version": "2023-06-01",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        model: provider.defaultModel,
+        max_tokens: 1,
+        messages: [{ role: "user", content: "hi" }]
+      })
+    });
+    return { ok: res2.ok, modelCount: res2.ok ? 1 : 0, detail: `HTTP ${res2.status}` };
   }
-  return bundle.profile;
+  if (provider.id === "google") {
+    const url2 = provider.baseUrl.replace(/\/+$/, "") + `/models?key=${encodeURIComponent(key)}`;
+    const res2 = await fetch(url2);
+    if (!res2.ok)
+      return { ok: false, modelCount: 0, detail: `HTTP ${res2.status}` };
+    const body2 = await res2.json();
+    const count2 = Array.isArray(body2?.models) ? body2.models.length : 0;
+    return { ok: true, modelCount: count2, detail: "ok" };
+  }
+  const headers = key ? { Authorization: `Bearer ${key}` } : {};
+  const url = provider.baseUrl.replace(/\/+$/, "") + "/models";
+  const res = await fetch(url, { headers });
+  if (!res.ok)
+    return { ok: false, modelCount: 0, detail: `HTTP ${res.status}` };
+  const body = await res.json();
+  const count = Array.isArray(body?.data) ? body.data.length : Array.isArray(body?.models) ? body.models.length : 0;
+  return { ok: true, modelCount: count, detail: "ok" };
 }
-async function signOut() {
-  const refresh = readMaybe(pathRefresh());
-  if (refresh) {
-    const deviceId = getOrCreateDeviceId();
-    try {
-      await fetch(`${AUTH_BASE}/auth/desktop/session`, {
-        method: "DELETE",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ refresh, device_id: deviceId })
-      });
-    } catch {
+async function cmdModelsList(providerId) {
+  const catalog = await loadCatalog();
+  const { bold, dim } = palette;
+  const targets = providerId ? catalog.filter((p) => p.id === providerId) : catalog;
+  if (providerId && targets.length === 0) {
+    process.stderr.write(palette.error(`unknown provider: ${providerId}
+`));
+    return 2;
+  }
+  for (const p of targets) {
+    process.stdout.write(bold(`
+  ${p.display}
+`));
+    if (p.models.length === 0) {
+      process.stdout.write(dim("    (dynamic \u2014 pulled at runtime)\n"));
+      continue;
+    }
+    for (const m of p.models) {
+      const price = m.priceIn != null || m.priceOut != null ? `  $${m.priceIn ?? "?"}/$${m.priceOut ?? "?"}/M` : "";
+      process.stdout.write(`    ${pad(m.id, 36)}${price}  ${dim(m.note || "")}
+`);
     }
   }
-  clearTokens();
+  process.stdout.write("\n");
+  return 0;
 }
-async function fetchProfile(access) {
-  try {
-    const res = await fetch(PROFILE_URL, { headers: { "Authorization": `Bearer ${access}` } });
-    if (!res.ok)
-      return null;
-    return await res.json();
-  } catch {
-    return null;
+async function cmdModelsSearch(query) {
+  const catalog = await loadCatalog();
+  const q = query.toLowerCase();
+  const { bold } = palette;
+  let hits = 0;
+  for (const p of catalog) {
+    const matches = p.models.filter(
+      (m) => m.id.toLowerCase().includes(q) || m.label.toLowerCase().includes(q)
+    );
+    if (matches.length === 0)
+      continue;
+    process.stdout.write(bold(`
+  ${p.display}
+`));
+    for (const m of matches) {
+      process.stdout.write(`    ${pad(m.id, 36)}  ${m.note || ""}
+`);
+      hits++;
+    }
   }
+  if (hits === 0)
+    process.stdout.write("(no models matched)\n");
+  process.stdout.write("\n");
+  return 0;
 }
-async function refreshProfile() {
-  const t = await getAccessToken();
-  if (!t)
-    return null;
-  const p = await fetchProfile(t);
-  if (p)
-    storeProfile(p);
-  return p;
+function cmdKeysList() {
+  const keys = listKeys();
+  if (keys.length === 0) {
+    process.stdout.write("no keys stored.\n");
+    return 0;
+  }
+  for (const id of keys) {
+    const masked = maskKey(getKey(id));
+    process.stdout.write(`  ${pad(id, 14)} ${masked}
+`);
+  }
+  return 0;
+}
+async function cmdKeysSet(providerId) {
+  return cmdProvidersSet(providerId);
+}
+async function cmdKeysRemove(providerId) {
+  return cmdProvidersRemove(providerId);
 }
 
 // src/index.ts
 if (process.stdout.isTTY || process.env.FORCE_COLOR) {
   kleur2.enabled = true;
 }
-var VERSION3 = "1.7.48";
+var VERSION3 = "1.7.49";
 var AUTH_FREE_COMMANDS = /* @__PURE__ */ new Set([
   "login",
   "logout",