theclawbay 0.4.1 → 0.5.0

package/README.md

@@ -8,15 +8,17 @@ CLI for connecting Codex, Claude Code, Hermes Agent, Gemini-compatible apps, Con
 npm i -g theclawbay
 ```
 
-## Setup
+## Usage
 
-Get your API key from `https://theclawbay.com/dashboard`.
+Just run:
 
 ```sh
-theclawbay setup --api-key <apiKey>
+theclawbay
 ```
 
-In an interactive terminal, setup walks you through three quick steps: pick the tools to connect, pick the models to enable (grouped by provider, including the Open Source catalog), and pick your default model.
+That opens a menu — set up / connect tools, switch your Codex account, check usage, or log out. You never need to remember a subcommand.
+
+Setup walks you through three quick steps: pick the tools to connect, pick the models to enable (grouped by provider, including the Open Source catalog), and pick your default model. It signs you in through your browser; to use an API key from `https://theclawbay.com/dashboard` instead, run `theclawbay setup --api-key <apiKey>`.
 Toggle items with arrow keys plus `Enter`/`Space`, or press `1-9` and `0` to toggle tools directly.
 Every model you enable is registered in every tool that supports model switching (Codex, Continue, GSD, OpenClaw, OpenCode, Kilo, Roo Code, Hermes, Zo, Trae get named entries or profiles per model; Aider gets `/model <id>` aliases).
 Re-running setup also migrates legacy OpenCode and Kilo patches to the current reasoning-capable provider path and refreshes OpenClaw model metadata.
@@ -24,10 +26,6 @@ Setup also creates a local backup before changing config files, and you can choo
 
 ## Optional
 
-`theclawbay link --api-key <apiKey>`
-
-Saves the API key without writing local client config.
-
 `theclawbay logout`
 
 Removes The Claw Bay-managed local config from this machine.

package/dist/commands/codex.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from "../lib/base-command";
+export default class CodexCommand extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        action: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private describeActive;
+    private renderProfileLines;
+    private showStatus;
+    private showList;
+    private saveCurrent;
+    private detectRecoverable;
+    private recoverOfficial;
+    private switchTo;
+    private interactiveSwitch;
+    private performSwitch;
+    private removeOne;
+}

package/dist/commands/codex.js

@@ -0,0 +1,263 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const promises_1 = require("node:readline/promises");
+const base_command_1 = require("../lib/base-command");
+const errors_1 = require("../lib/errors");
+const tui_1 = require("../lib/shared/tui");
+const codex_profiles_1 = require("../lib/clients/codex-profiles");
+const fsx_1 = require("../lib/shared/fsx");
+const KNOWN_ACTIONS = new Set(["status", "list", "save", "use", "switch", "to", "remove", "rm", "delete", "recover"]);
+function kindGlyph(profile) {
+    if (profile.kind === "official")
+        return "🅾";
+    if (profile.kind === "clawbay")
+        return tui_1.glyph.claw;
+    return tui_1.glyph.bullet;
+}
+class CodexCommand extends base_command_1.BaseCommand {
+    async run() {
+        await this.runSafe(async () => {
+            const { args, flags } = await this.parse(CodexCommand);
+            const nowIso = new Date().toISOString();
+            const rawAction = (args.action ?? "status").toLowerCase();
+            if (rawAction === "status")
+                return this.showStatus(nowIso, flags.yes);
+            if (rawAction === "list")
+                return this.showList(nowIso);
+            if (rawAction === "save")
+                return this.saveCurrent(args.name, nowIso);
+            if (rawAction === "recover")
+                return this.recoverOfficial(nowIso);
+            if (rawAction === "use" || rawAction === "switch" || rawAction === "to") {
+                return this.switchTo(args.name, nowIso, flags.yes);
+            }
+            if (rawAction === "remove" || rawAction === "rm" || rawAction === "delete") {
+                return this.removeOne(args.name, flags.yes);
+            }
+            if (!KNOWN_ACTIONS.has(rawAction)) {
+                // `theclawbay codex official` / `codex clawbay` — treat the token as a selector.
+                return this.switchTo(args.action, nowIso, flags.yes);
+            }
+        });
+    }
+    describeActive(active) {
+        if (!active.hasAuth)
+            return tui_1.tint.dim("No Codex login found in ~/.codex/auth.json");
+        return `${tui_1.tint.accentBold(active.label)}  ${tui_1.tint.dim(`(${active.kind})`)}`;
+    }
+    renderProfileLines(profiles, activeSlug) {
+        if (profiles.length === 0) {
+            return [tui_1.tint.dim("No saved profiles yet. Run `theclawbay codex save` while logged in.")];
+        }
+        return profiles.map((profile) => {
+            const isActive = profile.slug === activeSlug;
+            const marker = isActive ? tui_1.tint.green(tui_1.glyph.radioOn) : tui_1.tint.dim(tui_1.glyph.radioOff);
+            const name = isActive ? tui_1.tint.bold(profile.label) : profile.label;
+            const suffix = isActive ? tui_1.tint.green("  ← active") : tui_1.tint.dim(`  ${profile.slug}`);
+            return `${marker} ${kindGlyph(profile)} ${name}${suffix}`;
+        });
+    }
+    async showStatus(nowIso, skipPrompt) {
+        // Keep the active identity's snapshot fresh so switching back always works.
+        await (0, codex_profiles_1.ensureActiveIdentitySaved)(nowIso).catch(() => null);
+        const active = await (0, codex_profiles_1.readActiveIdentity)();
+        const profiles = await (0, codex_profiles_1.listProfiles)();
+        const activeSlug = active.hasAuth ? (0, codex_profiles_1.slugForIdentity)(active) : null;
+        const lines = [
+            (0, tui_1.statusLine)("info", `Active login: ${this.describeActive(active)}`),
+            "",
+            tui_1.tint.dim("Saved profiles:"),
+            ...this.renderProfileLines(profiles, activeSlug),
+        ];
+        const recoverable = await this.detectRecoverable();
+        if (recoverable) {
+            lines.push("");
+            lines.push((0, tui_1.statusLine)("warn", `A disabled ChatGPT login is sitting in auth.json${recoverable.email ? ` (${recoverable.email})` : ""}.`));
+            lines.push(tui_1.tint.dim("  Run `theclawbay codex recover` to save it as a profile."));
+        }
+        for (const line of (0, tui_1.renderBox)({ title: "Codex accounts", lines, footer: tui_1.tint.dim("Switch with:  theclawbay codex use <name>") })) {
+            this.log(line);
+        }
+        const switchable = profiles.filter((p) => p.slug !== activeSlug);
+        if (skipPrompt || switchable.length === 0 || !process.stdin.isTTY || !process.stdout.isTTY)
+            return;
+        await this.interactiveSwitch(profiles, activeSlug, nowIso);
+    }
+    async showList(nowIso) {
+        const active = await (0, codex_profiles_1.readActiveIdentity)();
+        const profiles = await (0, codex_profiles_1.listProfiles)();
+        const activeSlug = active.hasAuth ? (0, codex_profiles_1.slugForIdentity)(active) : null;
+        if (profiles.length === 0) {
+            this.log(tui_1.tint.dim("No saved Codex profiles yet. Run `theclawbay codex save` while logged in."));
+            return;
+        }
+        for (const line of this.renderProfileLines(profiles, activeSlug))
+            this.log(line);
+    }
+    async saveCurrent(name, nowIso) {
+        const active = await (0, codex_profiles_1.readActiveIdentity)();
+        if (!active.hasAuth || active.authJson === null) {
+            throw new errors_1.ClawBayError("No Codex login found in ~/.codex/auth.json. Log into Codex first, then run `theclawbay codex save`.");
+        }
+        const profile = {
+            version: 1,
+            slug: (0, codex_profiles_1.slugForIdentity)(active),
+            kind: active.kind,
+            email: active.email,
+            providerId: active.providerId,
+            label: name?.trim() ? name.trim() : active.label,
+            authJson: active.authJson,
+            configToml: active.configToml,
+            savedAt: nowIso,
+        };
+        await (0, codex_profiles_1.saveProfile)(profile);
+        this.log((0, tui_1.statusLine)("ok", `Saved profile ${tui_1.tint.bold(profile.label)} ${tui_1.tint.dim(`(${profile.slug})`)}`));
+    }
+    async detectRecoverable() {
+        const raw = await (0, fsx_1.readFileIfExists)(codex_profiles_1.CODEX_AUTH_FILE);
+        const recovered = (0, codex_profiles_1.recoverCommentedOfficialAuth)(raw);
+        if (!recovered)
+            return null;
+        // Only worth surfacing if we don't already have an official profile saved.
+        const profiles = await (0, codex_profiles_1.listProfiles)();
+        if (profiles.some((p) => p.kind === "official"))
+            return null;
+        return { email: recovered.email };
+    }
+    async recoverOfficial(nowIso) {
+        const raw = await (0, fsx_1.readFileIfExists)(codex_profiles_1.CODEX_AUTH_FILE);
+        const recovered = (0, codex_profiles_1.recoverCommentedOfficialAuth)(raw);
+        if (!recovered) {
+            throw new errors_1.ClawBayError("No disabled ChatGPT login found in ~/.codex/auth.json to recover.");
+        }
+        const configToml = await (0, fsx_1.readFileIfExists)(codex_profiles_1.CODEX_CONFIG_FILE);
+        const profile = {
+            version: 1,
+            slug: recovered.email ? `official-${recovered.email.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "")}` : "official",
+            kind: "official",
+            email: recovered.email,
+            providerId: "openai",
+            label: recovered.email ? `Official ChatGPT · ${recovered.email}` : "Official ChatGPT",
+            authJson: recovered.authJson,
+            configToml,
+            savedAt: nowIso,
+        };
+        await (0, codex_profiles_1.saveProfile)(profile);
+        this.log((0, tui_1.statusLine)("ok", `Recovered official login into profile ${tui_1.tint.bold(profile.label)}.`));
+        this.log(tui_1.tint.dim(`Switch to it with:  theclawbay codex use ${profile.slug}`));
+    }
+    async switchTo(selector, nowIso, skipPrompt) {
+        const profiles = await (0, codex_profiles_1.listProfiles)();
+        if (profiles.length === 0) {
+            throw new errors_1.ClawBayError("No saved Codex profiles yet. Run `theclawbay codex save` while logged in, then switch.");
+        }
+        if (!selector || !selector.trim()) {
+            const active = await (0, codex_profiles_1.readActiveIdentity)();
+            const activeSlug = active.hasAuth ? (0, codex_profiles_1.slugForIdentity)(active) : null;
+            if (!skipPrompt && process.stdin.isTTY && process.stdout.isTTY) {
+                await this.interactiveSwitch(profiles, activeSlug, nowIso);
+                return;
+            }
+            throw new errors_1.ClawBayError("Which profile? Try `theclawbay codex use <name>` or `theclawbay codex list`.");
+        }
+        const matches = (0, codex_profiles_1.resolveProfileSelector)(selector, profiles);
+        if (matches.length === 0) {
+            if (["official", "chatgpt", "gpt", "openai"].includes(selector.trim().toLowerCase())) {
+                throw new errors_1.ClawBayError("No official ChatGPT profile saved yet. Log into Codex with your ChatGPT account (run `codex login`), then `theclawbay codex save` — or `theclawbay codex recover` if it's disabled in auth.json.");
+            }
+            throw new errors_1.ClawBayError(`No profile matched "${selector}". Run \`theclawbay codex list\` to see saved profiles.`);
+        }
+        if (matches.length > 1) {
+            const names = matches.map((m) => m.slug).join(", ");
+            throw new errors_1.ClawBayError(`"${selector}" matched multiple profiles: ${names}. Be more specific.`);
+        }
+        await this.performSwitch(matches[0], nowIso);
+    }
+    async interactiveSwitch(profiles, activeSlug, nowIso) {
+        const options = profiles.filter((p) => p.slug !== activeSlug);
+        if (options.length === 0)
+            return;
+        this.log("");
+        options.forEach((profile, index) => {
+            this.log(`  ${tui_1.tint.accentBold(String(index + 1))}. ${kindGlyph(profile)} ${profile.label}`);
+        });
+        const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+        try {
+            const answer = await rl.question(tui_1.tint.dim("Switch to # (Enter to stay): "));
+            const choice = Number.parseInt(answer.trim(), 10);
+            if (!Number.isInteger(choice) || choice < 1 || choice > options.length)
+                return;
+            await this.performSwitch(options[choice - 1], nowIso);
+        }
+        finally {
+            rl.close();
+            process.stdin.resume();
+        }
+    }
+    async performSwitch(target, nowIso) {
+        const result = await (0, codex_profiles_1.switchToProfile)(target, nowIso);
+        if (result.alreadyActive) {
+            this.log((0, tui_1.statusLine)("info", `Already on ${tui_1.tint.bold(target.label)}.`));
+            return;
+        }
+        if (result.preserved) {
+            this.log((0, tui_1.statusLine)("ok", `Saved current login as ${tui_1.tint.dim(result.preserved.label)}.`));
+        }
+        this.log((0, tui_1.statusLine)("ok", `Switched Codex to ${tui_1.tint.accentBold(target.label)}.`));
+        this.log(tui_1.tint.dim("Restart Codex Desktop (or your terminal Codex session) to load this account's history."));
+    }
+    async removeOne(selector, skipPrompt) {
+        if (!selector || !selector.trim()) {
+            throw new errors_1.ClawBayError("Which profile? Try `theclawbay codex remove <name>`.");
+        }
+        const profiles = await (0, codex_profiles_1.listProfiles)();
+        const matches = (0, codex_profiles_1.resolveProfileSelector)(selector, profiles);
+        if (matches.length === 0)
+            throw new errors_1.ClawBayError(`No profile matched "${selector}".`);
+        if (matches.length > 1) {
+            throw new errors_1.ClawBayError(`"${selector}" matched multiple profiles: ${matches.map((m) => m.slug).join(", ")}.`);
+        }
+        const target = matches[0];
+        if (!skipPrompt && process.stdin.isTTY && process.stdout.isTTY) {
+            const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+            try {
+                const answer = await rl.question(`Forget saved profile "${target.label}"? [y/N] `);
+                const normalized = answer.trim().toLowerCase();
+                if (normalized !== "y" && normalized !== "yes") {
+                    this.log(tui_1.tint.dim("Kept."));
+                    return;
+                }
+            }
+            finally {
+                rl.close();
+                process.stdin.resume();
+            }
+        }
+        await (0, codex_profiles_1.removeProfile)(target.slug);
+        this.log((0, tui_1.statusLine)("ok", `Removed profile ${tui_1.tint.bold(target.label)}.`));
+    }
+}
+CodexCommand.summary = "Switch Codex between your The Claw Bay relay and official ChatGPT/OpenAI logins";
+CodexCommand.description = "Save your Codex logins as named profiles and swap between them in one command. Each profile is a snapshot of ~/.codex/auth.json + config.toml, so switching restores that account's credentials and its own chat history. The active login is always snapshotted before a switch, so you never lose an account.";
+CodexCommand.examples = [
+    "<%= config.bin %> codex                # show the active login + saved profiles",
+    "<%= config.bin %> codex save           # snapshot the current login as a profile",
+    "<%= config.bin %> codex use official   # switch to your official ChatGPT login",
+    "<%= config.bin %> codex clawbay        # switch back to The Claw Bay",
+    "<%= config.bin %> codex remove official # forget a saved profile",
+];
+CodexCommand.args = {
+    action: core_1.Args.string({
+        required: false,
+        description: "status (default) | list | save | use | remove | recover — or a profile name to switch to",
+    }),
+    name: core_1.Args.string({
+        required: false,
+        description: "profile name/selector for use, save, or remove",
+    }),
+};
+CodexCommand.flags = {
+    yes: core_1.Flags.boolean({ char: "y", default: false, description: "skip confirmation prompts" }),
+};
+exports.default = CodexCommand;

package/dist/commands/setup.js

@@ -12,6 +12,7 @@ const errors_1 = require("../lib/managed/errors");
 const api_key_1 = require("../lib/managed/api-key");
 const urls_1 = require("../lib/shared/urls");
 const codex_1 = require("../lib/clients/codex");
+const codex_profiles_ui_1 = require("../lib/clients/codex-profiles-ui");
 const claude_1 = require("../lib/clients/claude");
 const continue_1 = require("../lib/clients/continue");
 const cline_1 = require("../lib/clients/cline");
@@ -96,9 +97,18 @@ class SetupCommand extends base_command_1.BaseCommand {
                 if (!(error instanceof errors_1.ManagedConfigMissingError))
                     throw error;
             }
-            const explicitApiKey = (flags["api-key"] ?? "").trim();
+            let explicitApiKey = (flags["api-key"] ?? "").trim();
             const managedCredential = (managed?.credential ?? "").trim();
             const managedAuthType = managed?.authType ?? null;
+            // Fresh interactive setup: ask how they want to sign in. Picking "API key"
+            // prompts for it here so it flows through the same path as --api-key; an
+            // empty entry (or picking "browser") falls through to device-session below.
+            if (!explicitApiKey && !managedCredential && !flags.yes && process.stdin.isTTY && process.stdout.isTTY) {
+                const method = await (0, prompts_1.promptAuthMethod)();
+                if (method === "api-key") {
+                    explicitApiKey = await (0, prompts_1.promptApiKey)();
+                }
+            }
             let authType = explicitApiKey
                 ? "api-key"
                 : managedAuthType === "api-key"
@@ -470,6 +480,10 @@ class SetupCommand extends base_command_1.BaseCommand {
                 }
                 if (selectedSetupClients.has("codex")) {
                     progress.update("Configuring Codex");
+                    // If they're signed into their own Codex/ChatGPT account, offer to save
+                    // it before we overwrite config.toml, so they can switch back later via
+                    // `theclawbay codex`. Best-effort — never block setup.
+                    await (0, codex_profiles_ui_1.preserveDetectedCodexLogin)({ skipPrompt: flags.yes, log: (m) => this.log(m) }).catch(() => undefined);
                     codexConfigPath = await (0, codex_1.writeCodexConfig)({
                         backendUrl,
                         model: resolved?.model ?? models_1.DEFAULT_CODEX_MODEL,

package/dist/index.js

@@ -8,6 +8,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const core_1 = require("@oclif/core");
 const update_check_1 = require("./lib/update-check");
+const main_menu_1 = require("./lib/main-menu");
 function detectPackageVersion() {
     try {
         const packageJsonPath = node_path_1.default.join(__dirname, "..", "package.json");
@@ -34,6 +35,17 @@ async function maybePrintBareInvocationHint() {
     console.log("");
 }
 async function main() {
+    const argv = process.argv.slice(2);
+    // Bare `theclawbay` on a terminal opens a friendly menu instead of dumping help.
+    if (argv.length === 0 && process.stdin.isTTY && process.stdout.isTTY) {
+        const choice = await (0, main_menu_1.promptMainMenu)().catch(() => null);
+        if (choice && choice.argv.length > 0) {
+            await (0, core_1.run)(choice.argv).then(() => (0, core_1.flush)());
+            return;
+        }
+        await (0, core_1.flush)();
+        return;
+    }
     await maybePrintBareInvocationHint();
     await (0, core_1.run)().then(() => (0, core_1.flush)());
 }

package/dist/lib/clients/codex-profiles-ui.d.ts

@@ -0,0 +1,4 @@
+export declare function preserveDetectedCodexLogin(params: {
+    skipPrompt: boolean;
+    log: (message: string) => void;
+}): Promise<void>;

package/dist/lib/clients/codex-profiles-ui.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preserveDetectedCodexLogin = preserveDetectedCodexLogin;
+const promises_1 = require("node:readline/promises");
+const codex_profiles_1 = require("./codex-profiles");
+// Called from `setup`, right before we overwrite Codex's config with the relay.
+// If the machine is signed into an official ChatGPT account, ask whether to keep
+// it (so the user can switch back later); anything else is snapshotted silently.
+// With --yes / no TTY we preserve the login without asking — losing it would be
+// worse than an unprompted save.
+async function preserveDetectedCodexLogin(params) {
+    const active = await (0, codex_profiles_1.readActiveIdentity)();
+    if (!active.hasAuth)
+        return;
+    const profile = (0, codex_profiles_1.buildProfileFromActive)(active, new Date().toISOString());
+    if (!profile)
+        return;
+    const interactive = !params.skipPrompt && process.stdin.isTTY && process.stdout.isTTY;
+    if (active.kind === "official" && interactive) {
+        const who = active.email ? ` as ${active.email}` : "";
+        const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+        let keep = true;
+        try {
+            const answer = await rl.question(`\nYou're signed into Codex${who}. Save this login so you can switch back to it anytime? [Y/n] `);
+            const normalized = answer.trim().toLowerCase();
+            keep = normalized === "" || normalized === "y" || normalized === "yes";
+        }
+        finally {
+            rl.close();
+            process.stdin.resume();
+        }
+        if (!keep)
+            return;
+    }
+    await (0, codex_profiles_1.saveProfile)(profile);
+    params.log(active.kind === "official"
+        ? `Saved your ChatGPT login — switch back anytime with "theclawbay codex".`
+        : `Saved your current Codex login for quick switching ("theclawbay codex").`);
+}

package/dist/lib/clients/codex-profiles.d.ts

@@ -0,0 +1,50 @@
+export declare const CODEX_AUTH_FILE: string;
+export declare const CODEX_CONFIG_FILE: string;
+export type CodexIdentityKind = "official" | "clawbay" | "other";
+export type CodexIdentity = {
+    kind: CodexIdentityKind;
+    email: string | null;
+    providerId: string | null;
+    label: string;
+};
+export type CodexProfile = CodexIdentity & {
+    version: 1;
+    slug: string;
+    authJson: string;
+    configToml: string | null;
+    savedAt: string;
+};
+export type CodexActiveIdentity = CodexIdentity & {
+    hasAuth: boolean;
+    authJson: string | null;
+    configToml: string | null;
+};
+export declare function decodeJwtClaims(token: unknown): Record<string, unknown> | null;
+export declare function emailFromIdToken(idToken: unknown): string | null;
+export declare function parseAuthJsonLoose(raw: string | null): Record<string, unknown> | null;
+export declare function providerIdFromConfig(configToml: string | null): string | null;
+export declare function detectIdentity(params: {
+    authJson: string | null;
+    configToml: string | null;
+}): CodexIdentity;
+export declare function slugForIdentity(identity: CodexIdentity): string;
+export declare function readActiveIdentity(): Promise<CodexActiveIdentity>;
+export declare function isValidProfile(value: unknown): value is CodexProfile;
+export declare function saveProfile(profile: CodexProfile): Promise<void>;
+export declare function listProfiles(): Promise<CodexProfile[]>;
+export declare function getProfile(slug: string): Promise<CodexProfile | null>;
+export declare function removeProfile(slug: string): Promise<boolean>;
+export declare function buildProfileFromActive(active: CodexActiveIdentity, nowIso: string): CodexProfile | null;
+export declare function ensureActiveIdentitySaved(nowIso: string): Promise<CodexProfile | null>;
+export declare function applyProfile(profile: CodexProfile): Promise<void>;
+export type CodexSwitchResult = {
+    target: CodexProfile;
+    preserved: CodexProfile | null;
+    alreadyActive: boolean;
+};
+export declare function switchToProfile(target: CodexProfile, nowIso: string): Promise<CodexSwitchResult>;
+export declare function recoverCommentedOfficialAuth(raw: string | null): {
+    authJson: string;
+    email: string | null;
+} | null;
+export declare function resolveProfileSelector(selector: string, profiles: CodexProfile[]): CodexProfile[];

package/dist/lib/clients/codex-profiles.js

@@ -0,0 +1,366 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_CONFIG_FILE = exports.CODEX_AUTH_FILE = void 0;
+exports.decodeJwtClaims = decodeJwtClaims;
+exports.emailFromIdToken = emailFromIdToken;
+exports.parseAuthJsonLoose = parseAuthJsonLoose;
+exports.providerIdFromConfig = providerIdFromConfig;
+exports.detectIdentity = detectIdentity;
+exports.slugForIdentity = slugForIdentity;
+exports.readActiveIdentity = readActiveIdentity;
+exports.isValidProfile = isValidProfile;
+exports.saveProfile = saveProfile;
+exports.listProfiles = listProfiles;
+exports.getProfile = getProfile;
+exports.removeProfile = removeProfile;
+exports.buildProfileFromActive = buildProfileFromActive;
+exports.ensureActiveIdentitySaved = ensureActiveIdentitySaved;
+exports.applyProfile = applyProfile;
+exports.switchToProfile = switchToProfile;
+exports.recoverCommentedOfficialAuth = recoverCommentedOfficialAuth;
+exports.resolveProfileSelector = resolveProfileSelector;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const paths_1 = require("../config/paths");
+const providers_1 = require("../shared/providers");
+const fsx_1 = require("../shared/fsx");
+// Codex stores a machine's active identity in exactly two files under ~/.codex:
+//   auth.json   — OpenAI login (ChatGPT OAuth tokens *or* an API key)
+//   config.toml — active model_provider + provider tables (our managed relay block)
+// A "profile" is a verbatim snapshot of both files plus a little detected metadata,
+// so switching identities never requires understanding Codex's auth internals: we
+// simply restore exactly the bytes that were known to work.
+exports.CODEX_AUTH_FILE = node_path_1.default.join(paths_1.codexDir, "auth.json");
+exports.CODEX_CONFIG_FILE = node_path_1.default.join(paths_1.codexDir, "config.toml");
+function base64UrlDecode(segment) {
+    try {
+        const normalized = segment.replace(/-/g, "+").replace(/_/g, "/");
+        const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+        return Buffer.from(padded, "base64").toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+// Best-effort JWT claim reader. We never verify the signature — we only want the
+// email the token was minted for, purely to label the profile for the human.
+function decodeJwtClaims(token) {
+    if (typeof token !== "string")
+        return null;
+    const parts = token.split(".");
+    if (parts.length < 2)
+        return null;
+    const json = base64UrlDecode(parts[1] ?? "");
+    if (json === null)
+        return null;
+    try {
+        const parsed = JSON.parse(json);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function emailFromIdToken(idToken) {
+    const claims = decodeJwtClaims(idToken);
+    if (!claims)
+        return null;
+    const direct = claims.email;
+    if (typeof direct === "string" && direct.includes("@"))
+        return direct;
+    // ChatGPT id tokens nest profile info under an OpenAI-namespaced claim.
+    for (const key of Object.keys(claims)) {
+        if (!key.startsWith("https://api.openai.com/"))
+            continue;
+        const value = claims[key];
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            const nested = value.email;
+            if (typeof nested === "string" && nested.includes("@"))
+                return nested;
+        }
+    }
+    return null;
+}
+// Codex's auth.json is plain JSON, but hand-edited files (e.g. someone commenting
+// out the `tokens` block with `//` to force API-key mode) are common in the wild.
+// Parse strictly first; fall back to stripping `//` line comments so we can still
+// read the *active* identity out of a lightly-mangled file.
+function parseAuthJsonLoose(raw) {
+    if (raw === null || !raw.trim())
+        return null;
+    const attempt = (text) => {
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                return parsed;
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    };
+    return (attempt(raw) ??
+        attempt(raw
+            .split(/\r?\n/)
+            .filter((line) => !line.trim().startsWith("//"))
+            .join("\n")));
+}
+function providerIdFromConfig(configToml) {
+    if (!configToml)
+        return null;
+    const match = /^\s*model_provider\s*=\s*"([^"]+)"/m.exec(configToml);
+    return match ? (match[1] ?? null) : null;
+}
+function tokensBlock(auth) {
+    if (!auth)
+        return null;
+    const tokens = auth.tokens;
+    if (tokens && typeof tokens === "object" && !Array.isArray(tokens)) {
+        return tokens;
+    }
+    return null;
+}
+function detectIdentity(params) {
+    const auth = parseAuthJsonLoose(params.authJson);
+    const providerId = providerIdFromConfig(params.configToml);
+    const tokens = tokensBlock(auth);
+    // A live ChatGPT OAuth session (id_token present) is the official account.
+    if (tokens && typeof tokens.id_token === "string" && tokens.id_token.trim()) {
+        const email = emailFromIdToken(tokens.id_token);
+        return {
+            kind: "official",
+            email,
+            providerId: providerId ?? providers_1.OPENAI_PROVIDER_ID,
+            label: email ? `Official ChatGPT · ${email}` : "Official ChatGPT",
+        };
+    }
+    const usesClawbayProvider = providerId === providers_1.DEFAULT_PROVIDER_ID || (params.configToml?.includes(`[model_providers.${providers_1.DEFAULT_PROVIDER_ID}]`) ?? false);
+    const hasApiKey = typeof auth?.OPENAI_API_KEY === "string" && auth.OPENAI_API_KEY.trim().length > 0;
+    if (usesClawbayProvider) {
+        return { kind: "clawbay", email: null, providerId: providerId ?? providers_1.DEFAULT_PROVIDER_ID, label: "The Claw Bay" };
+    }
+    if (hasApiKey || providerId) {
+        return {
+            kind: "other",
+            email: null,
+            providerId: providerId ?? providers_1.OPENAI_PROVIDER_ID,
+            label: providerId ? `OpenAI API key · ${providerId}` : "OpenAI API key",
+        };
+    }
+    return { kind: "other", email: null, providerId, label: "Unknown Codex login" };
+}
+function slugForIdentity(identity) {
+    if (identity.kind === "clawbay")
+        return "clawbay";
+    const sanitize = (value) => value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 48);
+    if (identity.kind === "official") {
+        return identity.email ? `official-${sanitize(identity.email)}` : "official";
+    }
+    return identity.providerId ? `other-${sanitize(identity.providerId)}` : "other";
+}
+async function readActiveIdentity() {
+    const [authJson, configToml] = await Promise.all([
+        (0, fsx_1.readFileIfExists)(exports.CODEX_AUTH_FILE),
+        (0, fsx_1.readFileIfExists)(exports.CODEX_CONFIG_FILE),
+    ]);
+    const identity = detectIdentity({ authJson, configToml });
+    return {
+        ...identity,
+        hasAuth: authJson !== null && authJson.trim().length > 0,
+        authJson,
+        configToml,
+    };
+}
+function profilePath(slug) {
+    return node_path_1.default.join(paths_1.codexProfilesDir, `${slug}.json`);
+}
+function isValidProfile(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return (record.version === 1 &&
+        typeof record.slug === "string" &&
+        typeof record.authJson === "string" &&
+        (record.kind === "official" || record.kind === "clawbay" || record.kind === "other"));
+}
+async function saveProfile(profile) {
+    await promises_1.default.mkdir(paths_1.codexProfilesDir, { recursive: true });
+    const target = profilePath(profile.slug);
+    await promises_1.default.writeFile(target, `${JSON.stringify(profile, null, 2)}\n`, "utf8");
+    // auth.json holds live credentials — keep the snapshot owner-only.
+    await promises_1.default.chmod(target, 0o600).catch(() => undefined);
+}
+async function listProfiles() {
+    let entries = [];
+    try {
+        entries = await promises_1.default.readdir(paths_1.codexProfilesDir);
+    }
+    catch (error) {
+        const err = error;
+        if (err.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const profiles = [];
+    for (const entry of entries) {
+        if (!entry.endsWith(".json"))
+            continue;
+        const raw = await (0, fsx_1.readFileIfExists)(node_path_1.default.join(paths_1.codexProfilesDir, entry));
+        if (raw === null)
+            continue;
+        try {
+            const parsed = JSON.parse(raw);
+            if (isValidProfile(parsed))
+                profiles.push(parsed);
+        }
+        catch {
+            // ignore corrupt snapshot files
+        }
+    }
+    profiles.sort((a, b) => a.label.localeCompare(b.label));
+    return profiles;
+}
+async function getProfile(slug) {
+    const raw = await (0, fsx_1.readFileIfExists)(profilePath(slug));
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return isValidProfile(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function removeProfile(slug) {
+    try {
+        await promises_1.default.unlink(profilePath(slug));
+        return true;
+    }
+    catch (error) {
+        const err = error;
+        if (err.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+// Capture whatever identity is currently live in ~/.codex as a profile snapshot.
+// Returns null when there is no auth.json worth preserving (fresh machine).
+function buildProfileFromActive(active, nowIso) {
+    if (!active.hasAuth || active.authJson === null)
+        return null;
+    return {
+        version: 1,
+        slug: slugForIdentity(active),
+        kind: active.kind,
+        email: active.email,
+        providerId: active.providerId,
+        label: active.label,
+        authJson: active.authJson,
+        configToml: active.configToml,
+        savedAt: nowIso,
+    };
+}
+// Refresh (or create) the snapshot for the currently-active identity so switching
+// back to it always restores the freshest working credentials.
+async function ensureActiveIdentitySaved(nowIso) {
+    const active = await readActiveIdentity();
+    const profile = buildProfileFromActive(active, nowIso);
+    if (!profile)
+        return null;
+    await saveProfile(profile);
+    return profile;
+}
+async function applyProfile(profile) {
+    await promises_1.default.mkdir(paths_1.codexDir, { recursive: true });
+    await promises_1.default.writeFile(exports.CODEX_AUTH_FILE, profile.authJson, "utf8");
+    await promises_1.default.chmod(exports.CODEX_AUTH_FILE, 0o600).catch(() => undefined);
+    if (profile.configToml !== null) {
+        await promises_1.default.writeFile(exports.CODEX_CONFIG_FILE, profile.configToml, "utf8");
+    }
+}
+async function switchToProfile(target, nowIso) {
+    const active = await readActiveIdentity();
+    const activeSlug = active.hasAuth ? slugForIdentity(active) : null;
+    if (activeSlug === target.slug) {
+        // Re-apply anyway (config may have drifted) but report it was already current.
+        await applyProfile(target);
+        return { target, preserved: null, alreadyActive: true };
+    }
+    // Preserve the outgoing identity before we overwrite it.
+    const preserved = buildProfileFromActive(active, nowIso);
+    if (preserved)
+        await saveProfile(preserved);
+    await applyProfile(target);
+    return { target, preserved, alreadyActive: false };
+}
+// Some machines have a hand-disabled ChatGPT login: the `tokens` block is left in
+// auth.json but commented out with `//` so Codex falls back to an API key. Rebuild a
+// usable official auth.json from those commented lines so the login can be rescued
+// into a profile without a fresh `codex login`. Read-only: never touches ~/.codex.
+function recoverCommentedOfficialAuth(raw) {
+    if (raw === null || !raw.trim())
+        return null;
+    if (!/\/\/\s*"(?:tokens|id_token)"/.test(raw))
+        return null;
+    const uncommented = raw
+        .split(/\r?\n/)
+        .map((line) => {
+        const match = /^(\s*)\/\/\s?(.*)$/.exec(line);
+        return match ? `${match[1]}${match[2]}` : line;
+    })
+        .join("\n");
+    const attempts = [uncommented, uncommented.replace(/,(\s*[}\]])/g, "$1")];
+    for (const candidate of attempts) {
+        let parsed = null;
+        try {
+            const value = JSON.parse(candidate);
+            if (value && typeof value === "object" && !Array.isArray(value)) {
+                parsed = value;
+            }
+        }
+        catch {
+            parsed = null;
+        }
+        const tokens = tokensBlock(parsed);
+        if (!tokens || typeof tokens.id_token !== "string" || !tokens.id_token.trim())
+            continue;
+        // Force ChatGPT mode and drop any lingering API key so the restored file is
+        // unambiguously the official login.
+        const rebuilt = { ...parsed };
+        rebuilt.auth_mode = "chatgpt";
+        delete rebuilt.OPENAI_API_KEY;
+        return { authJson: `${JSON.stringify(rebuilt, null, 2)}\n`, email: emailFromIdToken(tokens.id_token) };
+    }
+    return null;
+}
+// Match a user-typed selector against saved profiles: exact slug, a kind keyword
+// ("official" / "clawbay" / "gpt" / "openai"), or an email substring.
+function resolveProfileSelector(selector, profiles) {
+    const needle = selector.trim().toLowerCase();
+    if (!needle)
+        return [];
+    const exact = profiles.filter((p) => p.slug.toLowerCase() === needle);
+    if (exact.length > 0)
+        return exact;
+    if (needle === "official" || needle === "chatgpt" || needle === "gpt" || needle === "openai") {
+        return profiles.filter((p) => p.kind === "official");
+    }
+    if (needle === "clawbay" || needle === "claw" || needle === "relay") {
+        return profiles.filter((p) => p.kind === "clawbay");
+    }
+    return profiles.filter((p) => p.slug.toLowerCase().includes(needle) ||
+        (p.email ?? "").toLowerCase().includes(needle) ||
+        p.label.toLowerCase().includes(needle));
+}

package/dist/lib/config/paths.d.ts

@@ -1,6 +1,7 @@
 export declare const codexDir: string;
 export declare const theclawbayConfigDir: string;
 export declare const theclawbayStateDir: string;
+export declare const codexProfilesDir: string;
 export declare const theclawbayBackupDir: string;
 export declare const managedConfigPath: string;
 export declare const updateCheckStatePath: string;

package/dist/lib/config/paths.js

@@ -3,12 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.legacyManagedConfigPathCodexAuth = exports.legacyManagedConfigPathClayBay = exports.updateCheckStatePath = exports.managedConfigPath = exports.theclawbayBackupDir = exports.theclawbayStateDir = exports.theclawbayConfigDir = exports.codexDir = void 0;
+exports.legacyManagedConfigPathCodexAuth = exports.legacyManagedConfigPathClayBay = exports.updateCheckStatePath = exports.managedConfigPath = exports.theclawbayBackupDir = exports.codexProfilesDir = exports.theclawbayStateDir = exports.theclawbayConfigDir = exports.codexDir = void 0;
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 exports.codexDir = node_path_1.default.join(node_os_1.default.homedir(), ".codex");
 exports.theclawbayConfigDir = node_path_1.default.join(node_os_1.default.homedir(), ".config", "theclawbay");
 exports.theclawbayStateDir = node_path_1.default.join(exports.theclawbayConfigDir, "state");
+exports.codexProfilesDir = node_path_1.default.join(exports.theclawbayConfigDir, "codex-profiles");
 exports.theclawbayBackupDir = node_path_1.default.join(node_os_1.default.homedir(), ".config", "theclawbay-backups");
 exports.managedConfigPath = node_path_1.default.join(exports.codexDir, "theclawbay.managed.json");
 exports.updateCheckStatePath = node_path_1.default.join(exports.codexDir, "theclawbay.update-check.json");

package/dist/lib/main-menu.d.ts

@@ -0,0 +1,4 @@
+export type MenuChoice = {
+    argv: string[];
+} | null;
+export declare function promptMainMenu(): Promise<MenuChoice>;

package/dist/lib/main-menu.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.promptMainMenu = promptMainMenu;
+const prompts_1 = require("./shared/prompts");
+const tui_1 = require("./shared/tui");
+const ITEMS = [
+    { icon: tui_1.glyph.claw, label: "Set up / connect tools", desc: "Point Codex, Claude & others at The Claw Bay", argv: ["setup"] },
+    { icon: "🔀", label: "Switch Codex account", desc: "Flip between The Claw Bay and your official ChatGPT login", argv: ["codex"] },
+    { icon: "📊", label: "Usage", desc: "See how much of your plan is left", argv: ["usage"] },
+    { icon: "🚪", label: "Log out", desc: "Revert every local change on this machine", argv: ["logout"] },
+];
+async function promptMainMenu() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        return null;
+    let cursor = 0;
+    const quitIndex = ITEMS.length;
+    const total = ITEMS.length + 1;
+    const render = () => {
+        const rows = ITEMS.map((item, index) => {
+            const active = index === cursor;
+            const pointer = active ? tui_1.tint.accentBold(tui_1.glyph.pointer) : " ";
+            const number = tui_1.tint.dim(String(index + 1));
+            const head = `${item.icon} ${item.label}`;
+            const label = active ? tui_1.tint.accentBold(head) : head;
+            return `${pointer} ${number} ${label}  ${tui_1.tint.dim(`— ${item.desc}`)}`;
+        });
+        const quitActive = cursor === quitIndex;
+        const quitRow = `${quitActive ? tui_1.tint.accentBold(tui_1.glyph.pointer) : " "}   ${quitActive ? tui_1.tint.accentBold("Quit") : tui_1.tint.dim("Quit")}`;
+        return [
+            "",
+            ...(0, tui_1.renderBox)({
+                title: "The Claw Bay",
+                lines: [
+                    tui_1.tint.dim("What would you like to do?"),
+                    "",
+                    ...rows,
+                    "",
+                    quitRow,
+                ],
+                footer: (0, tui_1.keyHints)([
+                    ["↑↓", "move"],
+                    ["1-4", "jump"],
+                    ["enter", "select"],
+                    ["q", "quit"],
+                ]),
+            }),
+        ];
+    };
+    return (0, prompts_1.runKeyLoop)({
+        render,
+        onKey: (key, finish, repaint) => {
+            if (key.name === "up" || key.name === "k") {
+                cursor = (cursor - 1 + total) % total;
+                repaint();
+                return;
+            }
+            if (key.name === "down" || key.name === "j") {
+                cursor = (cursor + 1) % total;
+                repaint();
+                return;
+            }
+            const direct = /^[1-9]$/.test(key.sequence ?? "") ? Number.parseInt(key.sequence ?? "", 10) : Number.NaN;
+            if (Number.isInteger(direct) && direct >= 1 && direct <= ITEMS.length) {
+                finish({ argv: ITEMS[direct - 1].argv });
+                return;
+            }
+            if (key.name === "q" || key.name === "escape") {
+                finish(null);
+                return;
+            }
+            if (key.name === "return" || key.name === "enter") {
+                finish(cursor === quitIndex ? null : { argv: ITEMS[cursor].argv });
+            }
+        },
+    });
+}

package/dist/lib/managed/config.js

@@ -74,7 +74,7 @@ async function readManagedConfig() {
     const backendUrl = normalizeAndValidateBackendUrl(obj.backendUrl);
     const rawAuthType = obj.authType;
     if (typeof rawAuthType === "string" && rawAuthType === "seat") {
-        throw new errors_1.ManagedConfigInvalidError('legacy seat-mode config is no longer supported; run "theclawbay link --api-key <key>" to relink');
+        throw new errors_1.ManagedConfigInvalidError('legacy seat-mode config is no longer supported; run "theclawbay setup" to relink');
     }
     const authType = rawAuthType === "device-session" ? "device-session" : "api-key";
     const rawCredential = typeof obj.credential === "string" && obj.credential.trim()

package/dist/lib/managed/errors.js

@@ -5,7 +5,7 @@ const errors_1 = require("../errors");
 class ManagedConfigMissingError extends errors_1.ClawBayError {
     constructor(configPath) {
         super(`No managed config found at ${configPath}. ` +
-            `Run "theclawbay link --api-key <key>" first.`);
+            `Run "theclawbay" and choose Set up first (or "theclawbay setup --api-key <key>").`);
     }
 }
 exports.ManagedConfigMissingError = ManagedConfigMissingError;

package/dist/lib/shared/env-persist-cleanup.js

@@ -33,7 +33,11 @@ function powerShellProfilePaths() {
     const addDocumentsProfiles = (documentsDir) => {
         if (!documentsDir)
             return;
+        // Must mirror the setup-side list in env-persist.ts: setup writes managed
+        // blocks into profile.ps1 as well, so logout has to clean all four paths.
+        candidates.add(node_path_1.default.join(documentsDir, "PowerShell", "profile.ps1"));
         candidates.add(node_path_1.default.join(documentsDir, "PowerShell", "Microsoft.PowerShell_profile.ps1"));
+        candidates.add(node_path_1.default.join(documentsDir, "WindowsPowerShell", "profile.ps1"));
         candidates.add(node_path_1.default.join(documentsDir, "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1"));
     };
     if (node_os_1.default.platform() === "win32") {

package/dist/lib/shared/prompts.d.ts

@@ -1,7 +1,19 @@
 import { SetupClient, SetupClientId } from "./client-registry";
 import { ConfiguredModelSelection, ModelResolution } from "./models";
+export type SetupAuthMethod = "device-session" | "api-key";
+export declare function promptAuthMethod(): Promise<SetupAuthMethod>;
+export declare function promptApiKey(): Promise<string>;
 export declare function formatSetupClientLabel(client: SetupClient, hyperlinksEnabled: boolean): string;
 export declare function parseSetupClientFlags(raw: string | undefined): Set<SetupClientId> | null;
+type KeypressInfo = {
+    name?: string;
+    sequence?: string;
+    ctrl?: boolean;
+};
+export declare function runKeyLoop<T>(params: {
+    render: () => string[];
+    onKey: (key: KeypressInfo, finish: (value: T) => void, repaint: () => void) => void;
+}): Promise<T>;
 export declare function promptForSetupClients(clients: SetupClient[]): Promise<Set<SetupClientId>>;
 export declare function resolveSetupClientSelection(params: {
     setupClients: SetupClient[];
@@ -27,3 +39,4 @@ export declare function resolveConfiguredModelSelection(params: {
     requestedModels: string | undefined;
     skipPrompt: boolean;
 }): Promise<ConfiguredModelSelection>;
+export {};

package/dist/lib/shared/prompts.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.promptAuthMethod = promptAuthMethod;
+exports.promptApiKey = promptApiKey;
 exports.formatSetupClientLabel = formatSetupClientLabel;
 exports.parseSetupClientFlags = parseSetupClientFlags;
+exports.runKeyLoop = runKeyLoop;
 exports.promptForSetupClients = promptForSetupClients;
 exports.resolveSetupClientSelection = resolveSetupClientSelection;
 exports.promptForGroupedModelSelection = promptForGroupedModelSelection;
@@ -10,9 +13,81 @@ exports.resolveConfiguredModelSelection = resolveConfiguredModelSelection;
 const client_registry_1 = require("./client-registry");
 const format_1 = require("./format");
 const node_readline_1 = require("node:readline");
+const promises_1 = require("node:readline/promises");
 const fsx_1 = require("./fsx");
 const models_1 = require("./models");
 const tui_1 = require("./tui");
+// Ask how the user wants to authenticate this machine. Browser sign-in is the
+// recommended default; an API key is offered for people who prefer to paste one.
+async function promptAuthMethod() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        return "device-session";
+    const items = [
+        { value: "device-session", label: "Sign in with your browser", desc: "Recommended — opens theclawbay.com to authorize this machine" },
+        { value: "api-key", label: "Paste an API key", desc: "Use a key from your dashboard instead" },
+    ];
+    let cursor = 0;
+    const render = () => {
+        const rows = items.map((item, index) => {
+            const active = index === cursor;
+            const pointer = active ? tui_1.tint.accentBold(tui_1.glyph.pointer) : " ";
+            const number = tui_1.tint.dim(String(index + 1));
+            const label = active ? tui_1.tint.accentBold(item.label) : item.label;
+            return `${pointer} ${number} ${label}  ${tui_1.tint.dim(`— ${item.desc}`)}`;
+        });
+        return [
+            "",
+            ...(0, tui_1.renderBox)({
+                title: "How do you want to sign in?",
+                lines: rows,
+                footer: (0, tui_1.keyHints)([
+                    ["↑↓", "move"],
+                    ["1-2", "jump"],
+                    ["enter", "select"],
+                ]),
+            }),
+        ];
+    };
+    return runKeyLoop({
+        render,
+        onKey: (key, finish, repaint) => {
+            if (key.name === "up" || key.name === "k") {
+                cursor = (cursor - 1 + items.length) % items.length;
+                repaint();
+                return;
+            }
+            if (key.name === "down" || key.name === "j") {
+                cursor = (cursor + 1) % items.length;
+                repaint();
+                return;
+            }
+            if ((key.sequence ?? "") === "1") {
+                finish("device-session");
+                return;
+            }
+            if ((key.sequence ?? "") === "2") {
+                finish("api-key");
+                return;
+            }
+            if (key.name === "return" || key.name === "enter") {
+                finish(items[cursor].value);
+            }
+        },
+    });
+}
+async function promptApiKey() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        return "";
+    const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await rl.question("Paste your The Claw Bay API key (or press Enter to sign in with your browser): ");
+        return answer.trim();
+    }
+    finally {
+        rl.close();
+        process.stdin.resume();
+    }
+}
 function formatSetupClientLabel(client, hyperlinksEnabled) {
     const iconAndLabel = `${client.icon} ${client.label}`;
     if (hyperlinksEnabled) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "theclawbay",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "CLI for connecting Codex, Hermes Agent, Gemini-compatible apps, Continue, Cline, GSD, OpenClaw, OpenCode, Kilo, Roo Code, Aider, experimental Trae, and experimental Zo to The Claw Bay.",
   "license": "MIT",
   "repository": {

package/theclawbay-supported-models.json

@@ -99,16 +99,6 @@
     "cachedInputPer1M": 0.05,
     "outputPer1M": 3.0
   },
-  {
-    "id": "gemini-3.5-flash",
-    "label": "Gemini 3.5 Flash",
-    "note": "Fast Gemini 3.5 lane for lower-latency multimodal and coding requests.",
-    "tone": "ink",
-    "provider": "google",
-    "inputPer1M": 1.5,
-    "cachedInputPer1M": 0.15,
-    "outputPer1M": 9.0
-  },
   {
     "id": "deepseek-v4-flash",
     "label": "DeepSeek V4 Flash",

package/dist/commands/link.d.ts

@@ -1,9 +0,0 @@
-import { BaseCommand } from "../lib/base-command";
-export default class LinkCommand extends BaseCommand {
-    static description: string;
-    static flags: {
-        backend: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        "api-key": import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
-    };
-    run(): Promise<void>;
-}

package/dist/commands/link.js

@@ -1,40 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const core_1 = require("@oclif/core");
-const base_command_1 = require("../lib/base-command");
-const config_1 = require("../lib/managed/config");
-const paths_1 = require("../lib/config/paths");
-const api_key_1 = require("../lib/managed/api-key");
-const DEFAULT_BACKEND_URL = "https://theclawbay.com";
-class LinkCommand extends base_command_1.BaseCommand {
-    async run() {
-        await this.runSafe(async () => {
-            const { flags } = await this.parse(LinkCommand);
-            const apiKey = flags["api-key"];
-            const backendUrlFlag = flags.backend;
-            const inferredBackendUrl = (0, api_key_1.tryInferBackendUrlFromApiKey)(apiKey);
-            const backendUrl = backendUrlFlag ?? inferredBackendUrl ?? DEFAULT_BACKEND_URL;
-            await (0, config_1.writeManagedConfig)({
-                backendUrl,
-                authType: "api-key",
-                credential: apiKey,
-            });
-            this.log(`Linked. Managed config written to ${paths_1.managedConfigPath}`);
-            this.log(`Backend: ${backendUrl}`);
-            this.log('Run "theclawbay setup" to configure Codex and any detected OpenClaw, OpenCode, Kilo, experimental Trae, or experimental Zo installs on this machine.');
-        });
-    }
-}
-LinkCommand.description = "Link this machine to your The Claw Bay API backend using an API key";
-LinkCommand.flags = {
-    backend: core_1.Flags.string({
-        required: false,
-        description: "Backend base URL override (default: https://theclawbay.com)",
-    }),
-    "api-key": core_1.Flags.string({
-        required: true,
-        aliases: ["apiKey"],
-        description: "API key issued by your The Claw Bay dashboard",
-    }),
-};
-exports.default = LinkCommand;