talos-code 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,112 @@
+# TALOS CLI changelog
+
+Format: [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/). Versions follow
+[SemVer](https://semver.org/): in 0.y.z anything may still change. The version lives in `package.json` and
+`src/version.ts`, and in the `talos-cli-vX.Y.Z` tag. The package is published on npm as
+[`talos-code`](https://www.npmjs.com/package/talos-code); the command is `talos`.
+
+## talos-cli-v0.2.1 — 2026-09-26
+
+`npm i -g talos-code@0.2.1`, or `talos update` to see it.
+
+### Changed
+- Faster turns in large folders. The workspace snapshot that makes `/undo` possible no longer reads, rewrites and syncs
+  every file at every turn: a file that has not changed since the last turn reuses what was stored. A turn in a plain
+  folder of 6,000 files went from 39 s to 1.8 s, and from 2.6 s to 1.4 s in a git repository of the same size. What
+  `/undo` covers is unchanged.
+- Faster and complete project search. `cerca` runs ripgrep, shipped inside the package for your platform (no download),
+  and each match now comes with its line: `path:line:text`. Four searches over 6,000 files took 9.3 s; now about 0.2 s.
+  Before, a search stopped after reading 5,000 files and could miss matches in a bigger project. Several searches asked
+  in the same answer run together. Without ripgrep, the previous search still works.
+
+### Known limits
+- Tested on Windows 11 x64 only; Node.js 24 (24.18 or later in the 24 line).
+- Shell commands still run one at a time, each in its sandbox; a start of about one second remains.
+
+### Verification
+- Measured on a hermetic bench (`scripts/bench-harness.ts`): a local fake provider, no network, TALOS against Pi, Codex
+  and OpenCode on the same turns.
+- CLI unit suite: 1876 tests, 1872 pass, 4 skip, 0 fail. Acceptance on the built CLI in a synthetic terminal: 263/263.
+- The package proof (`scripts/prove-standalone.ts`), 16/16 on `talos-code-0.2.1.tgz` (1.76 MB); the installed package
+  resolves its own ripgrep.
+
+## talos-cli-v0.2.0 — 2026-09-26
+
+`npm i -g talos-code@0.2.0`, or `talos update` to see it from 0.1.0.
+
+### Added
+- Watch a sub-agent live: Alt+A, then Enter on an agent, and its own transcript takes the main view as it streams,
+  read-only. Esc goes back to your session without stopping the turn; an agent that finishes stays on screen as done.
+  While agents work, the status line says "Alt+A to watch".
+- A guided setup on the first launch: trust this folder, then a provider (a local engine that runs comes
+  first), its key or local engine, and a model, one window at a time with "Step N of 4"; Esc skips, and only what is
+  missing is asked. It ends with "Ready" and the model. `/setup` or `talos setup` runs it again.
+- Sign in to OpenRouter without pasting a key: choose OpenRouter, then "Sign in with OpenRouter (browser)". TALOS
+  opens the browser and waits on 127.0.0.1; on another machine, paste the code OpenRouter shows. Also
+  `talos provider login openrouter` (`--paste` for the code). The key that comes back is tested and saved like a pasted one.
+
+### Changed
+- Forge is the default theme. A theme you chose stays yours.
+
+### Fixed
+- A sub-agent that needed your approval (a command, a write) used to wait forever with nothing on screen. Its
+  approval now opens like any other and says it comes from the agent and its task; the answer goes to that agent.
+- While delegated sub-agents work, the status line says how many agents are working instead of "thinking" with a
+  running clock; any tool that runs silently without asking is shown as running.
+- Changing the theme with `/theme` no longer throws the conversation away. Crossing the colourless `mono` theme used to
+  restart the whole screen and lose the session.
+- A turn interrupted while a tool was about to run no longer breaks the session: resuming it used to fail at every turn
+  with `CTX_HISTORY_DIVERGED`. A session already broken that way now says so in plain words and offers `/fork`, which
+  continues the conversation in a new session.
+
+### Known limits
+- Tested on Windows 11 x64 only; Node.js 24 (24.18 or later in the 24 line).
+- Context compaction with a local Ollama model is not yet verified end to end.
+- A local provider that answers 401/403 without needing a key can be set aside as if its key were wrong.
+- The OpenRouter sign-in is tested against a stand-in for OpenRouter; the exchange with the real service follows its
+  published contract.
+
+### Verification
+- CLI unit suite on the release tree: 1870 tests, 1866 pass, 4 skip, 0 fail. Acceptance on the built CLI in a synthetic
+  terminal: 263/263.
+- The package proof (`scripts/prove-standalone.ts`), 16/16 on `talos-code-0.2.0.tgz` (1.76 MB, 407 files): installed
+  into an empty prefix outside the repository, hermetic profile, fake provider on 127.0.0.1; every loaded module
+  resolved inside the package; nothing written inside the package; no stale build output; no outbound request.
+
+## talos-cli-v0.1.0 — 2026-09-25
+
+The first public release: `npm i -g talos-code`, then `talos`.
+
+### Added
+- An interactive terminal screen and a headless mode (`talos -p`, `--json`, `--output-format stream-json`) on the
+  TALOS kernel, the same one the desktop runs, carried inside the package: it reads no file of a TALOS checkout.
+- Providers from the TALOS registry (OpenAI, Anthropic, Google Gemini, DeepSeek, OpenRouter, Mistral, Groq, xAI and
+  more) and local engines with no key (Ollama, LM Studio, llama.cpp). Keys are typed in hidden input and kept in the
+  operating system's credential store; a key already in the environment is used only after you agree once.
+- Per-tool permissions (allow, ask, deny) with six modes, project trust for hooks, MCP servers, plugins and commands.
+- `/undo` restores the files a turn changed, from checkpoints kept outside the repository and outside Git.
+- Sessions: `/resume`, `/fork`, export and import (an imported session never runs anything by itself), prompt history.
+- Context: with a known window of 64k tokens or more, compaction at half of it, said on screen; after a summary the
+  model did not write properly, automatic compaction pauses (60 s, 5 min, 15 min) and says so, while `/compact` runs
+  at once.
+- `/theme` with ten accents, `/help` by group, `/status`, `/retry`, `/copy`, `@` file completion that respects
+  `.gitignore`, `Ctrl+R` history search.
+- `talos update` asks the npm registry whether a newer version exists and prints the npm command; it changes nothing.
+- `talos doctor` and a redacted `talos diagnostic bundle`. No telemetry.
+
+### Known limits
+- Tested on Windows 11 x64 only; Node.js 24 (24.18 or later in the 24 line).
+- Context compaction with a local Ollama model is not yet verified end to end.
+- A local provider that answers 401/403 without needing a key can be set aside as if its key were wrong.
+- Reported by the owner after the release, to fix in 0.1.x: changing the theme can crash the process; resuming a
+  session can end with `CTX_HISTORY_DIVERGED`; sub-agents cannot yet be opened to watch their conversation live, and
+  the thinking counter keeps running while they work.
+
+### Verification
+- CLI unit suite on the released tree: 1839 tests, 1835 pass, 4 skip, 0 fail. Acceptance on the built CLI in a
+  synthetic terminal: 246/247 on the aligned kernel (the one red is a known idle-frame flake).
+- The package proof (`scripts/prove-standalone.ts`), 16/16 on the tarball itself: installed into an empty prefix
+  outside the repository, hermetic profile, fake provider on 127.0.0.1; every loaded module resolved inside the
+  package; nothing written inside the package; no stale build output.
+- Installed from the registry after publication: `talos --version` answered `0.1.0`, `talos update --check` answered
+  up to date.

package/README.md

@@ -26,9 +26,11 @@ Open a terminal in a project and run:
 talos
 ```
 
-The first time, TALOS asks whether to trust the folder, then which provider and model to use. A key already in your
-environment (for example `OPENAI_API_KEY`) is used only after you agree once; otherwise you type it in hidden input and it
-is kept in the operating system's credential store, never in a file.
+The first time, a short guided setup asks only what is missing: whether to trust the folder, then a provider (a local
+engine that is running comes first), its key, and a model, one step at a time; Esc skips a step. `/setup` or
+`talos setup` runs it again. A key already in your environment (for example `OPENAI_API_KEY`) is used only after you
+agree once; otherwise you type it in hidden input and it is kept in the operating system's credential store, never in a
+file. For OpenRouter you can also sign in in the browser instead of pasting a key (`talos provider login openrouter`).
 
 For a one-shot task, without the interactive screen:
 
@@ -52,6 +54,7 @@ Vertex AI. Local engines: Ollama, LM Studio and llama.cpp, with no key. TALOS ne
 one on its own.
 
 `/provider` sets up a provider, `/model` (or `Alt+P`) picks the model, and `talos doctor` says what is ready.
+While sub-agents work, `Alt+A` lists them and Enter shows one agent's conversation live, read-only.
 
 ## What you can rely on
 
@@ -94,7 +97,7 @@ talos update --check
 With an npm install, `talos update` tells you if a newer version exists and the command to run
 (`npm i -g talos-code@latest`). It does not change anything by itself.
 
-## Known limits in 0.1.0
+## Known limits in 0.2.0
 
 - Only Windows 11 x64 is tested.
 - Context compaction with a local Ollama model is not yet verified end to end.
@@ -106,6 +109,8 @@ With an npm install, `talos update` tells you if a newer version exists and the
 missing when something does not work. `talos diagnostic bundle --out talos-diagnostic.zip` makes a redacted report for a
 bug; it contains no prompt or file content.
 
+What changed in each version is in `CHANGELOG.md`.
+
 ## License
 
 AGPL-3.0-only. See `LICENSE` and `THIRD_PARTY_NOTICES.md` in this package.

package/dist/args.js

@@ -82,12 +82,15 @@ export function parseCliArgs(argv) {
             positionals: argv.slice(subcommandIndex),
         };
     }
-    const promptParts = values.print !== undefined ? [values.print] : positionals;
+    /* P17 (owner decision 4): `talos setup` alone is the guided setup, not a prompt that says "setup". */
+    const setup = values.print === undefined && outputFormat === 'text' && positionals.length === 1 && positionals[0] === 'setup';
+    const promptParts = values.print !== undefined ? [values.print] : setup ? [] : positionals;
     const prompt = promptParts.length ? promptParts.join(' ') : undefined;
     const interactive = values.print === undefined && outputFormat === 'text';
     const timeoutSeconds = positiveInt(values.timeout, '--timeout');
     return {
         command: 'run', interactive, outputFormat, protocolVersion,
+        ...(setup ? { setup: true } : {}),
         ...(prompt !== undefined ? { prompt } : {}), ...(rawMode !== undefined ? { permissionMode: rawMode } : {}),
         ...(values.project !== undefined ? { project: values.project } : {}), ...(values.model !== undefined ? { model: values.model } : {}),
         ...(values.resume !== undefined ? { resume: values.resume } : {}), ...(values.fork !== undefined ? { fork: values.fork } : {}),

package/dist/commands/provider-cli.js

@@ -11,101 +11,160 @@ import { t } from "../i18n/index.js";
  */
 async function runtimeContext(ctx) { return ctx.createRuntimeContext({ projectRoot: ctx.projectRoot, paths: ctx.paths, repoRoot: ctx.repoRoot, model: ctx.invocation.model ?? 'openai:gpt-5-mini', environmentKeys: 'consent' }); }
 function environmentKeyOf(row) { return row && row.environmentVariable ? { variable: String(row.environmentVariable), state: row.keySource === 'environment' ? 'approved' : row.keySource === 'environment-declined' ? 'declined' : 'unanswered' } : null; }
-export async function runProviderCommand(ctx, args0) { const args = [...args0]; const op = args.shift() ?? 'list'; const rc = await runtimeContext(ctx); const store = rc.providerStore; const catalog = rc.tuiCatalog; if (op === 'list') {
-    assertNoUnknownOptions(args);
-    if (typeof rc.providerControlPlane?.list === 'function') {
-        writeValue(ctx, rc.providerControlPlane.list());
+export async function runProviderCommand(ctx, args0) {
+    const args = [...args0];
+    const op = args.shift() ?? 'list';
+    const rc = await runtimeContext(ctx);
+    const store = rc.providerStore;
+    const catalog = rc.tuiCatalog;
+    if (op === 'list') {
+        assertNoUnknownOptions(args);
+        if (typeof rc.providerControlPlane?.list === 'function') {
+            writeValue(ctx, rc.providerControlPlane.list());
+            return 0;
+        }
+        const rows = store.listPublic();
+        let providers = [];
+        try {
+            providers = await catalog?.listProviders?.() ?? [];
+        }
+        catch {
+            providers = [];
+        }
+        writeValue(ctx, rows.map((row) => ({ ...row, environmentKey: environmentKeyOf(providers.find((p) => p.id === row?.id)) })));
         return 0;
     }
-    const rows = store.listPublic();
-    let providers = [];
-    try {
-        providers = await catalog?.listProviders?.() ?? [];
+    const id = args.shift();
+    if (!id)
+        throw new Error('PROVIDER_REQUIRED');
+    /* P21 (owner decisions 2026-09-26): `talos provider login openrouter` signs in in the browser (the loopback waits for it);
+       `--paste`, or a remote session, uses the code OpenRouter shows. Interactive only (clig.dev: never require a prompt in a
+       script). The key that comes back is tested and saved like `set-key`'s; it is never printed. */
+    if (op === 'login') {
+        const paste = takeFlag(args, '--paste');
+        assertNoUnknownOptions(args);
+        if (id !== 'openrouter')
+            throw Object.assign(new Error('PROVIDER_LOGIN_UNSUPPORTED'), { code: 'PROVIDER_LOGIN_UNSUPPORTED' });
+        if (typeof catalog?.startOpenRouterLogin !== 'function' || typeof catalog?.setProviderKey !== 'function')
+            throw Object.assign(new Error('PROVIDER_LOGIN_UNAVAILABLE'), { code: 'PROVIDER_LOGIN_UNAVAILABLE' });
+        if (!ctx.io.stdinIsTTY || !ctx.io.stdoutIsTTY)
+            throw Object.assign(new Error('LOGIN_REQUIRES_TTY'), { code: 'LOGIN_REQUIRES_TTY' });
+        const login = await catalog.startOpenRouterLogin(paste ? { paste: true } : {});
+        if (login.mode === 'paste')
+            ctx.io.writeErr(`${t('key.login.paste')}\n${login.url}\n`);
+        else
+            ctx.io.writeErr(`${t(login.opened ? 'key.login.opened' : 'key.login.open')}\n${login.url}\n${t('key.login.waiting')}\n`);
+        let key = '';
+        try {
+            if (login.mode === 'paste') {
+                if (!ctx.io.readSecret)
+                    throw Object.assign(new Error('SECRET_INPUT_REQUIRES_TTY'), { code: 'SECRET_INPUT_REQUIRES_TTY' });
+                key = await login.submit(await ctx.io.readSecret(t('key.login.codePrompt')));
+            }
+            else
+                key = await login.key;
+        }
+        catch (error) {
+            login.cancel();
+            const code = String(error?.code ?? 'OAUTH_FAILED');
+            writeValue(ctx, { ok: false, provider: id, code, ...(error?.status ? { httpStatus: error.status } : {}) }, `${t('key.login.failed', { code })}\n`);
+            return 11;
+        }
+        let result;
+        try {
+            result = await catalog.setProviderKey(id, key);
+        }
+        finally {
+            key = '';
+        }
+        const saved = result.saved === true;
+        writeValue(ctx, { ok: saved, provider: id, outcome: result.outcome, httpStatus: result.httpStatus, saved }, `${t('key.login.signedIn', { message: result.message, saved: t(saved ? 'key.login.saved' : 'key.login.notSaved') })}\n`);
+        return saved ? 0 : 11;
     }
-    catch {
-        providers = [];
+    if (op === 'set-key') {
+        assertNoUnknownOptions(args);
+        if (!ctx.io.readSecret)
+            throw new Error('SECRET_INPUT_REQUIRES_TTY');
+        if (typeof catalog?.setProviderKey !== 'function')
+            throw Object.assign(new Error('PROVIDER_KEY_TEST_UNAVAILABLE'), { code: 'PROVIDER_KEY_TEST_UNAVAILABLE' }); /* a one-token key test is stated before the key is read, so before anything is sent; nothing further is asked */
+        const notice = typeof catalog.keyTestNotice === 'function' ? catalog.keyTestNotice(id) : null;
+        if (notice)
+            ctx.io.writeErr(`${notice}\n`);
+        let secret = await ctx.io.readSecret(`Key for ${id}: `);
+        let result;
+        try {
+            result = await catalog.setProviderKey(id, secret);
+        }
+        finally {
+            secret = '';
+        }
+        const saved = result.saved === true;
+        writeValue(ctx, { ok: saved, provider: id, outcome: result.outcome, httpStatus: result.httpStatus, saved }, `${result.message} ${saved ? 'Saved.' : 'The key was not saved.'}\n`);
+        return saved ? 0 : 11;
     }
-    writeValue(ctx, rows.map((row) => ({ ...row, environmentKey: environmentKeyOf(providers.find((p) => p.id === row?.id)) })));
-    return 0;
-} const id = args.shift(); if (!id)
-    throw new Error('PROVIDER_REQUIRED'); if (op === 'set-key') {
-    assertNoUnknownOptions(args);
-    if (!ctx.io.readSecret)
-        throw new Error('SECRET_INPUT_REQUIRES_TTY');
-    if (typeof catalog?.setProviderKey !== 'function')
-        throw Object.assign(new Error('PROVIDER_KEY_TEST_UNAVAILABLE'), { code: 'PROVIDER_KEY_TEST_UNAVAILABLE' }); /* a one-token key test is stated before the key is read, so before anything is sent; nothing further is asked */
-    const notice = typeof catalog.keyTestNotice === 'function' ? catalog.keyTestNotice(id) : null;
-    if (notice)
-        ctx.io.writeErr(`${notice}\n`);
-    let secret = await ctx.io.readSecret(`Key for ${id}: `);
-    let result;
-    try {
-        result = await catalog.setProviderKey(id, secret);
+    if (op === 'env-key') {
+        const use = takeFlag(args, '--use');
+        const decline = takeFlag(args, '--decline');
+        assertNoUnknownOptions(args);
+        if (use && decline)
+            throw new Error('Use either --use or --decline');
+        const row = (await catalog.listProviders()).find((p) => p.id === id);
+        if (!row)
+            throw Object.assign(new Error('PROVIDER_INVALID'), { code: 'PROVIDER_INVALID' });
+        const answering = use || decline;
+        if (answering && row.environmentVariable)
+            await catalog.answerEnvironmentKey(id, use ? 'yes' : 'no');
+        const after = answering ? (await catalog.listProviders()).find((p) => p.id === id) : row;
+        const state = environmentKeyOf(after);
+        if (!state) {
+            writeValue(ctx, { ok: !answering, provider: id, environmentKey: null }, `No key for ${after?.label ?? id} was found in the environment.\n`);
+            return answering ? 2 : 0;
+        }
+        writeValue(ctx, { ok: true, provider: id, environmentKey: state }, `${state.variable}: ${state.state === 'approved' ? 'used for ' + after.label : state.state === 'declined' ? 'declined, not used' : 'not used until approved (talos provider env-key ' + id + ' --use)'}\n`);
+        return 0;
     }
-    finally {
-        secret = '';
+    if (op === 'remove-key') {
+        assertNoUnknownOptions(args);
+        store.clearKey(id);
+        rc.providerControlPlane?.invalidate?.(id);
+        writeValue(ctx, { ok: true, provider: id }, `Removed key for ${id}\n`);
+        return 0;
     }
-    const saved = result.saved === true;
-    writeValue(ctx, { ok: saved, provider: id, outcome: result.outcome, httpStatus: result.httpStatus, saved }, `${result.message} ${saved ? 'Saved.' : 'The key was not saved.'}\n`);
-    return saved ? 0 : 11;
-} if (op === 'env-key') {
-    const use = takeFlag(args, '--use');
-    const decline = takeFlag(args, '--decline');
-    assertNoUnknownOptions(args);
-    if (use && decline)
-        throw new Error('Use either --use or --decline');
-    const row = (await catalog.listProviders()).find((p) => p.id === id);
-    if (!row)
-        throw Object.assign(new Error('PROVIDER_INVALID'), { code: 'PROVIDER_INVALID' });
-    const answering = use || decline;
-    if (answering && row.environmentVariable)
-        await catalog.answerEnvironmentKey(id, use ? 'yes' : 'no');
-    const after = answering ? (await catalog.listProviders()).find((p) => p.id === id) : row;
-    const state = environmentKeyOf(after);
-    if (!state) {
-        writeValue(ctx, { ok: !answering, provider: id, environmentKey: null }, `No key for ${after?.label ?? id} was found in the environment.\n`);
-        return answering ? 2 : 0;
+    if (op === 'configure') {
+        const endpoint = takeOption(args, '--endpoint');
+        const timeoutRaw = takeOption(args, '--timeout');
+        assertNoUnknownOptions(args);
+        const current = store.getRuntime(id) ?? {};
+        const timeoutSeconds = timeoutRaw === undefined ? current.timeoutSeconds : Number(timeoutRaw);
+        if (timeoutRaw !== undefined && (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 5 || timeoutSeconds > 300))
+            throw new Error('PROVIDER_TIMEOUT_INVALID');
+        if (endpoint === undefined && timeoutRaw === undefined)
+            throw new Error('PROVIDER_CONFIG_REQUIRED');
+        store.setRuntime(id, { ...current, ...(endpoint !== undefined ? { endpoint } : {}), ...(timeoutSeconds !== undefined ? { timeoutSeconds } : {}) });
+        rc.providerControlPlane?.invalidate?.(id);
+        writeValue(ctx, { ok: true, provider: id, runtime: store.getRuntime(id) }, `Configured ${id}\n`);
+        return 0;
     }
-    writeValue(ctx, { ok: true, provider: id, environmentKey: state }, `${state.variable}: ${state.state === 'approved' ? 'used for ' + after.label : state.state === 'declined' ? 'declined, not used' : 'not used until approved (talos provider env-key ' + id + ' --use)'}\n`);
-    return 0;
-} if (op === 'remove-key') {
-    assertNoUnknownOptions(args);
-    store.clearKey(id);
-    rc.providerControlPlane?.invalidate?.(id);
-    writeValue(ctx, { ok: true, provider: id }, `Removed key for ${id}\n`);
-    return 0;
-} if (op === 'configure') {
-    const endpoint = takeOption(args, '--endpoint');
-    const timeoutRaw = takeOption(args, '--timeout');
-    assertNoUnknownOptions(args);
-    const current = store.getRuntime(id) ?? {};
-    const timeoutSeconds = timeoutRaw === undefined ? current.timeoutSeconds : Number(timeoutRaw);
-    if (timeoutRaw !== undefined && (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 5 || timeoutSeconds > 300))
-        throw new Error('PROVIDER_TIMEOUT_INVALID');
-    if (endpoint === undefined && timeoutRaw === undefined)
-        throw new Error('PROVIDER_CONFIG_REQUIRED');
-    store.setRuntime(id, { ...current, ...(endpoint !== undefined ? { endpoint } : {}), ...(timeoutSeconds !== undefined ? { timeoutSeconds } : {}) });
-    rc.providerControlPlane?.invalidate?.(id);
-    writeValue(ctx, { ok: true, provider: id, runtime: store.getRuntime(id) }, `Configured ${id}\n`);
-    return 0;
-} if (op === 'test') {
-    assertNoUnknownOptions(args); /* M5-A/M5-C: ordinary health testing never opts into token generation, and remediation is the control-plane decision. */
-    if (typeof rc.providerControlPlane?.probe === 'function') {
-        const profile = await rc.providerControlPlane.probe(id);
-        const health = profile.lastHealth ?? {};
-        const latency = Number.isFinite(health.latencyMs) ? ` · ${health.latencyMs} ms` : ''; /* R2 (E8 / Q-R2-7): a missing key is the one sentence, as a line of its own; the probe's free-text reason (the kernel's, Italian) is mapped by the remediation code and not printed. */
-        const missingKey = profile.remediation?.code === 'add-key';
-        const remedy = missingKey ? `${profile.remediation.message}\n` : profile.remediation?.code && profile.remediation.code !== 'none' ? `Remedy: ${profile.remediation.message}\n` : ''; /* R4 Q-R4-16 (a): the kernel's sentence in English by a pinned template, or not printed. */
-        const mapped = health.detail && !missingKey ? kernelProbeDetail(String(health.detail), { label: String(profile.label ?? id) }) : null;
-        const detail = mapped ? `${mapped}\n` : '';
-        writeValue(ctx, missingKey ? { ...profile, code: 'PROVIDER_KEY_MISSING' } : profile, `${profile.label ?? id}: ${health.state ?? 'unknown'}${latency}\n${detail}${remedy}`);
-        return health.state === 'available' ? 0 : 11;
+    if (op === 'test') {
+        assertNoUnknownOptions(args); /* M5-A/M5-C: ordinary health testing never opts into token generation, and remediation is the control-plane decision. */
+        if (typeof rc.providerControlPlane?.probe === 'function') {
+            const profile = await rc.providerControlPlane.probe(id);
+            const health = profile.lastHealth ?? {};
+            const latency = Number.isFinite(health.latencyMs) ? ` · ${health.latencyMs} ms` : ''; /* R2 (E8 / Q-R2-7): a missing key is the one sentence, as a line of its own; the probe's free-text reason (the kernel's, Italian) is mapped by the remediation code and not printed. */
+            const missingKey = profile.remediation?.code === 'add-key';
+            const remedy = missingKey ? `${profile.remediation.message}\n` : profile.remediation?.code && profile.remediation.code !== 'none' ? `Remedy: ${profile.remediation.message}\n` : ''; /* R4 Q-R4-16 (a): the kernel's sentence in English by a pinned template, or not printed. */
+            const mapped = health.detail && !missingKey ? kernelProbeDetail(String(health.detail), { label: String(profile.label ?? id) }) : null;
+            const detail = mapped ? `${mapped}\n` : '';
+            writeValue(ctx, missingKey ? { ...profile, code: 'PROVIDER_KEY_MISSING' } : profile, `${profile.label ?? id}: ${health.state ?? 'unknown'}${latency}\n${detail}${remedy}`);
+            return health.state === 'available' ? 0 : 11;
+        }
+        const probe = typeof rc.providerProbe === 'function' ? rc.providerProbe() : (await importTalosModule(ctx.repoRoot, 'provider-probe.mjs')).createProviderProbe({ leggiChiave: (p) => store.getKey(p), leggiRuntime: (p) => store.getRuntime(p) });
+        const result = await probe.prova(id);
+        writeValue(ctx, result);
+        return result?.esito === 'collegato' ? 0 : 11;
     }
-    const probe = typeof rc.providerProbe === 'function' ? rc.providerProbe() : (await importTalosModule(ctx.repoRoot, 'provider-probe.mjs')).createProviderProbe({ leggiChiave: (p) => store.getKey(p), leggiRuntime: (p) => store.getRuntime(p) });
-    const result = await probe.prova(id);
-    writeValue(ctx, result);
-    return result?.esito === 'collegato' ? 0 : 11;
-} throw new Error(`Unsupported provider operation: ${op}`); }
+    throw new Error(`Unsupported provider operation: ${op}`);
+}
 /*
  * R2 (gate E14, E-03): `talos model list` for a person — one row per model under English columns, never the raw JSON array; the
  * MODEL column is exactly what `talos model use` takes (OpenCode `opencode models` prints one id per line and JSON only with

package/dist/config/types.js

@@ -8,4 +8,4 @@ export const UI_REASONING_MODES = Object.freeze(['collapsed', 'visible']);
 export const MODEL_WINDOW_MIN = 1_024;
 export const MODEL_WINDOW_MAX = 10_000_000;
 export const REASONING_EFFORTS = Object.freeze(['low', 'medium', 'high', 'xhigh', 'max']);
-export const DEFAULT_CONFIG = { version: 2, permissionMode: 'default', outputFormat: 'text', updateChannel: 'stable', permissions: { allow: [], ask: [], deny: [] }, ui: { theme: 'calm', markdown: true, exitOutput: 'transcript', busyInput: 'queue', reasoning: 'collapsed' }, extensions: { enabled: [] } };
+export const DEFAULT_CONFIG = { version: 2, permissionMode: 'default', outputFormat: 'text', updateChannel: 'stable', permissions: { allow: [], ask: [], deny: [] }, ui: { theme: 'forge', markdown: true, exitOutput: 'transcript', busyInput: 'queue', reasoning: 'collapsed' }, extensions: { enabled: [] } };

package/dist/i18n/en/approval.js

@@ -13,6 +13,9 @@ export const approval = {
     'approval.question.TalosService': 'Allow this?',
     /* Q-R3-13 (R0 decision 4): the title of a command approval on a host with no verified sandbox. */
     'approval.unsandboxed': '(unsandboxed)',
+    /* P13 (owner decision 8): who asks, when a sub-agent does. */
+    'approval.origin.agent': '· from agent · {task}',
+    'approval.origin.agentUnnamed': '· from an agent',
     /* Q-R3-6: four choices, Deny highlighted; "deny always" only in the full review (or /permissions). */
     'approval.choice.once': 'Allow once',
     'approval.choice.session': 'Allow for this session',

package/dist/i18n/en/credentials.js

@@ -79,4 +79,14 @@ export const credentials = {
     'key.models.source.unknown': 'not verified',
     'key.models.none': 'No models are known for this provider.',
     'key.models.use': 'Use one with: talos model use <MODEL>',
+    /* P21: `talos provider login openrouter`. */
+    'key.login.paste': 'Open this address in a browser on any machine, sign in to OpenRouter, then paste the code it shows:',
+    'key.login.opened': 'Opening OpenRouter in your browser. If it did not open, use this address:',
+    'key.login.open': 'Open this address in your browser and sign in to OpenRouter:',
+    'key.login.waiting': 'Waiting for the browser (10 min). Ctrl+C cancels; on another machine, run it again with --paste.',
+    'key.login.codePrompt': 'Code: ',
+    'key.login.failed': 'OpenRouter sign-in did not complete ({code}).',
+    'key.login.signedIn': 'Signed in to OpenRouter. {message} {saved}',
+    'key.login.saved': 'Saved.',
+    'key.login.notSaved': 'The key was not saved.',
 };

package/dist/i18n/en/errors.js

@@ -240,6 +240,27 @@ export const errors = {
     'error.code.CTX_COMPACTION_FAILED.todo': 'Try /compact again; if it keeps happening, start a new conversation with /clear.',
     'error.code.CTX_JOB_INTERRUPTED.what': 'A compaction was interrupted because the TALOS process running it stopped; nothing was changed.',
     'error.code.CTX_JOB_INTERRUPTED.todo': 'Nothing to fix: the next request or /compact starts it again.',
+    /* P12: a session whose context archive no longer matches its history (before 0.2.0 an interrupted tool turn could
+       cause it). Nothing is lost; the way on is a new session that carries the conversation. */
+    /* P21: OpenRouter sign-in. */
+    'error.code.LOGIN_REQUIRES_TTY.what': 'Signing in needs an interactive terminal.',
+    'error.code.LOGIN_REQUIRES_TTY.todo': 'Run talos provider login openrouter in a terminal, or save a key with talos provider set-key openrouter.',
+    'error.code.PROVIDER_LOGIN_UNSUPPORTED.what': 'Only OpenRouter offers a sign-in; other providers use a key.',
+    'error.code.PROVIDER_LOGIN_UNSUPPORTED.todo': 'Save a key with talos provider set-key <provider>.',
+    'error.code.PROVIDER_LOGIN_UNAVAILABLE.what': 'The OpenRouter sign-in is not available in this installation.',
+    'error.code.PROVIDER_LOGIN_UNAVAILABLE.todo': 'Save a key with talos provider set-key openrouter.',
+    'error.code.OAUTH_CALLBACK_UNAVAILABLE.what': 'TALOS could not listen for OpenRouter on this machine.',
+    'error.code.OAUTH_CALLBACK_UNAVAILABLE.todo': 'Sign in with the code instead: talos provider login openrouter --paste.',
+    'error.code.OAUTH_CANCELLED.what': 'The sign-in was cancelled.',
+    'error.code.OAUTH_CANCELLED.todo': 'Start it again when you are ready.',
+    'error.code.OAUTH_CODE_MISSING.what': 'That is not a code from OpenRouter.',
+    'error.code.OAUTH_CODE_MISSING.todo': 'Paste the code OpenRouter shows, or the whole address the browser landed on.',
+    'error.code.OAUTH_DENIED.what': 'The sign-in was cancelled in the browser.',
+    'error.code.OAUTH_DENIED.todo': 'Start it again and allow access on the OpenRouter page.',
+    'error.code.OAUTH_TIMEOUT.what': 'The sign-in took longer than 10 minutes.',
+    'error.code.OAUTH_TIMEOUT.todo': 'Start it again; the code OpenRouter gives lasts 10 minutes.',
+    'error.code.CTX_HISTORY_DIVERGED.what': 'This conversation no longer matches its saved context, so TALOS stopped before sending anything. Nothing was lost.',
+    'error.code.CTX_HISTORY_DIVERGED.todo': 'Continue it in a new session with /fork (it keeps the whole conversation), or start fresh with /clear.',
     'error.where.context': '/context shows the window TALOS measured and how compaction is set.',
     'error.code.MODELS_DEV_TOO_LARGE.what': 'The models.dev catalogue answered with more data than TALOS accepts, so it was not used.',
     'error.code.MODELS_DEV_TOO_LARGE.todo': 'Nothing to do: model windows come from the other sources until the next try.',

package/dist/i18n/en/firstrun.js

@@ -44,6 +44,18 @@ export const firstrun = {
     'firstrun.setup.model': 'Choose the model TALOS should use for this project.',
     'firstrun.setup.key': 'The chosen provider has no usable key; add one.',
     'firstrun.setup.loaded': 'Loaded {files}',
+    /* P17 (owner decisions 2026-09-26): the guided setup of the first launch, and /setup. */
+    'firstrun.setup.stepLine': 'Setup · Step {index} of {total} · {name} · Esc skips this step',
+    'firstrun.setup.stepLineOnly': 'Setup · Step {index} of {total} · {name}',
+    'firstrun.setup.stepName.trust': 'Trust',
+    'firstrun.setup.stepName.provider': 'Provider',
+    'firstrun.setup.stepName.key': 'Key or local engine',
+    'firstrun.setup.stepName.model': 'Model',
+    'firstrun.setup.trustHeading': 'TALOS · Setup · Step 1 of 4 · {title}',
+    'firstrun.setup.retryHint': 'R retries · Esc back to the providers',
+    'firstrun.setup.skipped': 'Setup skipped. /setup starts it again; /provider and /model change one thing.',
+    'firstrun.setup.ready': '✓ Ready · {model} · type your first message',
+    'firstrun.setup.readyHints': '/help commands · Shift+Tab permissions · /setup to change this',
     /* Q-R4-11: the provider list marks the chosen provider and says whether a local engine is running. */
     'firstrun.providers.chosen': 'chosen',
     'firstrun.providers.running': 'running',

package/dist/i18n/en/screen.js

@@ -266,6 +266,11 @@ export const screen = {
     /* R3 Q-R3-7 (gate E7): the status words while a turn runs and after it. */
     'screen.busy.tool': 'running',
     'screen.busy.toolNamed': 'running {tool}',
+    /* P14: the parent waits on delegated sub-agents. */
+    'screen.busy.agents': 'agents working',
+    'screen.busy.agentsCount.one': '{count} agent working',
+    'screen.busy.agentsCount.other': '{count} agents working',
+    'screen.busy.agentsWatch': 'Alt+A to watch',
     'screen.busy.writing': 'writing',
     'screen.busy.waiting': 'waiting for you',
     'screen.busy.done': 'done',
@@ -304,6 +309,28 @@ export const screen = {
     'screen.help.close': 'Esc / Enter / ? closes help',
     'screen.slash.help': 'Show commands',
     'screen.slash.provider': 'Choose the AI provider',
+    /* P21 (owner decisions 2026-09-26): OpenRouter sign-in. */
+    'screen.provider.loginBrowser': 'Sign in with {provider} (browser)',
+    'screen.provider.loginPasteKey': 'Paste an API key',
+    'screen.provider.loginChoiceKeys': '↑↓ choose · Enter confirms · Esc cancels',
+    'screen.provider.oauthOpened': 'Opening {provider} in your browser. If it did not open, use this address:',
+    'screen.provider.oauthNotOpened': 'Open this address in your browser and sign in to {provider}:',
+    'screen.provider.oauthRemote': 'Remote session: open this address in a browser on any machine, sign in to {provider}, then paste the code it shows.',
+    'screen.provider.oauthPaste': 'Code: {masked}',
+    'screen.provider.oauthWaiting': 'Waiting for the browser (10 min) · C paste a code instead · Esc cancels',
+    'screen.provider.oauthPasteKeys': 'Paste the code (or the whole address) · Enter signs in · Esc cancels',
+    'screen.provider.oauthExchanging': 'Signing in…',
+    'screen.provider.oauthFailedKeys': 'Enter starts it again · Esc cancels',
+    'screen.provider.oauthAddress': 'Sign in to {provider} at this address (it is also in the window below): {url}',
+    'screen.provider.oauthSaved': '✓ Signed in to {provider} · key saved',
+    'screen.provider.oauthError.OAUTH_TIMEOUT': 'The sign-in took longer than 10 minutes.',
+    'screen.provider.oauthError.OAUTH_SCAMBIO_RIFIUTATO': '{provider} refused this sign-in (HTTP {status}): the code may be expired or already used.',
+    'screen.provider.oauthError.OAUTH_RETE': '{provider} could not be reached.',
+    'screen.provider.oauthError.OAUTH_RISPOSTA_INATTESA': '{provider} answered without a key.',
+    'screen.provider.oauthError.OAUTH_DENIED': 'The sign-in was cancelled in the browser.',
+    'screen.provider.oauthError.OAUTH_CODE_MISSING': 'That is not a code from {provider}; paste the code, or the whole address the browser landed on.',
+    'screen.provider.oauthError.other': 'The sign-in did not complete.',
+    'screen.slash.setup': 'Set up provider, key and model, step by step',
     'screen.slash.model': 'Choose a model from the chosen provider',
     'screen.slash.queue': 'Show or manage queued follow-ups',
     'screen.slash.permissions': 'Show permission mode',
@@ -472,6 +499,17 @@ export const screen = {
     'screen.agents.empty': 'No native agent rows. · Esc close',
     'screen.agents.steerHint': 'Alt+S steer active session from composer · Esc close',
     'screen.agents.inspectOnly': 'inspection only · steering unavailable for selected session · Esc close',
+    /* P13 (owner decisions 2026-09-26): Enter watches an agent live, read-only; Esc goes back without stopping the turn. */
+    'screen.agents.watchHint': 'Enter watch live · Esc close',
+    'screen.agents.backHint': 'Enter back to main · Esc close',
+    'screen.agents.watchingHint': 'watching now · Esc close',
+    'screen.agentView.watching': 'viewing agent · {task} · Esc back to main',
+    'screen.agentView.done': 'agent · {task} · done · Esc back to main',
+    'screen.agentView.unnamed': 'unnamed task',
+    'screen.agentView.readOnly': 'read-only while viewing an agent · Esc back to main',
+    'screen.agentView.task': 'Task from main',
+    'screen.agentView.agent': 'Agent',
+    'screen.agentView.shortcuts': 'Esc back to main · Alt+A agents · Ctrl+C stops the turn · PageUp/PageDown transcript',
     'screen.automation.title': 'Automation Center',
     'screen.automation.empty': '(no automations)',
     'screen.automation.keys': '↑/↓ select · d dry-run/detail · u refresh · Esc/q close',

package/dist/i18n/error-view.js

@@ -160,7 +160,7 @@ const CODE_WHERE = {
     /* R5b (R5a open 4): the Context Engine's failures point at /context. */
     CTX_CONTEXT_OVERFLOW: 'error.where.context', CTX_TRUNCATED_SUMMARY: 'error.where.context', CTX_SUMMARY_RESPONSE_INVALID: 'error.where.context', CTX_SEGMENT_TOO_LARGE: 'error.where.context',
     CTX_INVALID_SUMMARY: 'error.where.context', CTX_EMPTY_SUMMARY: 'error.where.context', CTX_NO_REDUCTION: 'error.where.context', CTX_NOTHING_TO_COMPACT: 'error.where.context',
-    CTX_CONTEXT_TOO_SMALL: 'error.where.context', CTX_COMPACTION_FAILED: 'error.where.context', CTX_JOB_INTERRUPTED: 'error.where.context',
+    CTX_CONTEXT_TOO_SMALL: 'error.where.context', CTX_COMPACTION_FAILED: 'error.where.context', CTX_JOB_INTERRUPTED: 'error.where.context', CTX_HISTORY_DIVERGED: 'error.where.context',
 };
 function familyTodo(fam) { return fam === 'interrupted' ? null : `error.family.${fam}.todo`; }
 const RULE_CODES = new Set(['RULE_COMMAND_UNSUPPORTED', 'RULE_COMPOUND_COMMAND', 'RULE_UNREADABLE', 'RULE_MATCHES_NOTHING']);

package/dist/main.js

@@ -14,6 +14,7 @@ import { createLocalAutoClassifier } from "./security/auto-classifier.js";
 import { abortIsolationChecks, cliShellIsolation } from "./security/execution-backends.js";
 import { inertTerminalText, renderSafeTalosFailure } from "./errors.js";
 import { registerActiveRun } from "./runtime/active-run.js";
+import { isFirstLaunch } from "./tui/launch-state.js"; /* P17: the first launch's trust question is step 1 of the setup */
 import { initializeDevelopmentLogging, developmentLog, developmentLogError, closeDevelopmentLogging, developmentTextEvidence } from "./diagnostics/development-log.js";
 import { assessProjectTrust, assertProjectTrusted, needsTrustQuestion, nestedRepositoriesForProjectTrust, projectTrustFailure, trustProjectAssessment } from "./security/project-trust-gate.js";
 import { findTalosRepoRoot, importTalosModule } from "./runtime/repo.js";
@@ -181,7 +182,7 @@ export async function main(argv, deps = {}) {
                 const assessment = await (deps.assessProjectTrust ?? assessProjectTrust)(trustInput); /* R4 Q-R4-1: every folder with no saved decision is asked, with or without project files; headless keeps its rule (E3). */
                 if (needsTrustQuestion(assessment)) {
                     const nestedRepositories = await nestedRepositoriesForProjectTrust(assessment);
-                    const choice = await (deps.promptProjectTrust ?? defaultPromptProjectTrust)({ assessment, nestedRepositories, color: inv.color !== false, ...await userThemeForTrust(paths, projectRoot) });
+                    const choice = await (deps.promptProjectTrust ?? defaultPromptProjectTrust)({ assessment, nestedRepositories, color: inv.color !== false, ...await userThemeForTrust(paths, projectRoot), ...(isFirstLaunch(paths.dataRoot) ? { setupStep: true } : {}) });
                     if (choice !== 'trust' && choice !== 'trust-parent')
                         throw projectTrustFailure(assessment);
                     const folder = folderTargetFor(choice, assessment); /* Session only with nothing to trust: nothing is written. */