tissues 0.5.1 → 0.6.0

package/src/commands/config.js

@@ -1,8 +1,16 @@
 import { Command } from 'commander'
 import fs from 'node:fs'
 import path from 'node:path'
-import chalk from 'chalk'
-import { loadConfig, userConfigPath, BUILT_IN_DEFAULTS } from '../lib/defaults.js'
+import os from 'node:os'
+import { bold, dim, red, green, yellow, cyan } from '../lib/color.js'
+import { select, input, confirm, password } from '@inquirer/prompts'
+import { loadConfig, userConfigPath, findRepoRoot, BUILT_IN_DEFAULTS } from '../lib/defaults.js'
+import { theme } from '../lib/theme.js'
+import { listTemplates } from '../lib/templates.js'
+import { pickRepo } from '../lib/repo-picker.js'
+import { store } from '../lib/config.js'
+import { listProviders } from '../lib/ai/index.js'
+import { listModels as listOllamaModels } from '../lib/ai/adapters/ollama.js'
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -18,8 +26,8 @@ function readUserConfig() {
 
 function writeUserConfig(obj) {
   const filePath = userConfigPath()
-  fs.mkdirSync(path.dirname(filePath), { recursive: true })
-  fs.writeFileSync(filePath, JSON.stringify(obj, null, 2) + '\n', 'utf8')
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 })
+  fs.writeFileSync(filePath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
 }
 
 function getNestedValue(obj, dotKey) {
@@ -40,10 +48,15 @@ function setNestedValue(obj, dotKey, value) {
 }
 
 function coerceValue(dotKey, raw) {
+  if (raw.startsWith('[') || raw.startsWith('{')) {
+    try { return JSON.parse(raw) } catch { /* fall through */ }
+  }
   const parts = dotKey.split('.')
-  if (parts.length !== 2) return raw
-  const [section, field] = parts
-  const defaultVal = BUILT_IN_DEFAULTS[section]?.[field]
+  let defaultVal = BUILT_IN_DEFAULTS
+  for (const part of parts) {
+    if (defaultVal == null || typeof defaultVal !== 'object') { defaultVal = undefined; break }
+    defaultVal = defaultVal[part]
+  }
   if (typeof defaultVal === 'number') {
     const n = Number(raw)
     if (isNaN(n)) throw new Error(`Expected a number for ${dotKey}, got: ${raw}`)
@@ -58,12 +71,938 @@ function coerceValue(dotKey, raw) {
   return raw
 }
 
+function maskKey(value) {
+  if (!value || typeof value !== 'string') return value
+  if (value.length <= 4) return '****'
+  return '****' + value.slice(-4)
+}
+
+function maskKeysForDisplay(obj) {
+  const result = JSON.parse(JSON.stringify(obj))
+  if (result.ai?.keys) {
+    for (const provider of Object.keys(result.ai.keys)) {
+      if (result.ai.keys[provider]) result.ai.keys[provider] = maskKey(result.ai.keys[provider])
+    }
+  }
+  return result
+}
+
+function formatBudget(val) {
+  if (val === 0 || val === null || val === undefined) return dim('unlimited')
+  return cyan(val.toLocaleString())
+}
+
+function isCancelled(err) {
+  return err?.name === 'ExitPromptError' || err?.message?.includes('User force closed')
+}
+
+/** Wrap a prompt call so Esc/Ctrl+C returns a sentinel instead of throwing. */
+async function promptOrBack(fn) {
+  try {
+    return await fn()
+  } catch (err) {
+    if (isCancelled(err)) return Symbol.for('back')
+    throw err
+  }
+}
+
+function backupsDir() {
+  return path.join(os.homedir(), '.config', 'tissues', 'backups')
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: Active repo
+// ---------------------------------------------------------------------------
+
+async function menuActiveRepo() {
+  await pickRepo()
+  console.log(green(`  ✔ Default repo: ${store.get('activeRepo')}`))
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: Active provider
+// ---------------------------------------------------------------------------
+
+const PROVIDER_LABELS = {
+  anthropic: 'Anthropic',
+  openai: 'OpenAI',
+  gemini: 'Gemini',
+  ollama: 'Ollama',
+  'openai-compat': 'OpenAI Custom',
+  command: 'Command',
+}
+
+async function menuActiveProvider() {
+  const cfg = loadConfig()
+  const current = readUserConfig()
+  const providers = listProviders()
+
+  const defaultProvider = BUILT_IN_DEFAULTS.ai.provider
+  const choices = [
+    ...providers.map((p) => ({ name: PROVIDER_LABELS[p] || p, value: p })),
+    { name: 'None (disable AI)', value: 'none' },
+    { name: dim(`Restore default (${defaultProvider})`), value: 'restore' },
+    { name: dim('Back'), value: 'back' },
+  ]
+
+  const provider = await promptOrBack(() =>
+    select({ message: 'Default Provider', choices, default: cfg.ai?.provider, theme }),
+  )
+  if (provider === Symbol.for('back') || provider === 'back') return
+
+  let updated = current
+  if (provider === 'restore') {
+    updated = setNestedValue(updated, 'ai.enabled', BUILT_IN_DEFAULTS.ai.enabled)
+    updated = setNestedValue(updated, 'ai.provider', defaultProvider)
+    writeUserConfig(updated)
+    console.log(green(`  ✔ Restored default: ${defaultProvider}`))
+  } else if (provider === 'none') {
+    updated = setNestedValue(updated, 'ai.enabled', false)
+    writeUserConfig(updated)
+    console.log(green('  ✔ AI disabled'))
+  } else if (provider === 'ollama') {
+    updated = await configureOllama(updated)
+  } else if (provider === 'openai-compat') {
+    updated = await configureOpenAICompat(updated)
+  } else if (provider === 'command') {
+    updated = await configureCommand(updated)
+  } else {
+    updated = setNestedValue(updated, 'ai.enabled', true)
+    updated = setNestedValue(updated, 'ai.provider', provider)
+    writeUserConfig(updated)
+    console.log(green(`  ✔ Default provider: ${provider}`))
+  }
+}
+
+async function configureOllama(config) {
+  const cfg = loadConfig()
+  const baseUrl = cfg.ai?.ollama?.url || BUILT_IN_DEFAULTS.ai.ollama.url
+
+  let updated = config
+  updated = setNestedValue(updated, 'ai.enabled', true)
+  updated = setNestedValue(updated, 'ai.provider', 'ollama')
+
+  // Probe Ollama server for models
+  let models = []
+  try {
+    models = await listOllamaModels(baseUrl)
+  } catch {
+    console.log(yellow(`  ⚠ Could not reach Ollama at ${baseUrl}`))
+    console.log(dim('    Start Ollama later and it will work.'))
+  }
+
+  if (models.length > 0) {
+    const currentModel = cfg.ai?.models?.ollama || BUILT_IN_DEFAULTS.ai.models.ollama
+    const modelChoices = models.map((m) => ({ name: m, value: m }))
+    modelChoices.push({ name: dim('Back'), value: 'back' })
+
+    const model = await promptOrBack(() =>
+      select({ message: 'Ollama model', choices: modelChoices, default: currentModel, theme }),
+    )
+    if (model !== Symbol.for('back') && model !== 'back') {
+      updated = setNestedValue(updated, 'ai.models.ollama', model)
+    }
+  } else if (models.length === 0) {
+    const model = await promptOrBack(() =>
+      input({ message: 'Model name', default: cfg.ai?.models?.ollama || 'llama3.2', theme }),
+    )
+    if (model !== Symbol.for('back') && model) {
+      updated = setNestedValue(updated, 'ai.models.ollama', model)
+    }
+  }
+
+  writeUserConfig(updated)
+  console.log(green(`  ✔ Default provider: ollama`))
+  return updated
+}
+
+async function configureOpenAICompat(config) {
+  const cfg = loadConfig()
+  let updated = config
+  updated = setNestedValue(updated, 'ai.enabled', true)
+  updated = setNestedValue(updated, 'ai.provider', 'openai-compat')
+
+  const baseUrl = await promptOrBack(() =>
+    input({ message: 'Base URL', default: cfg.ai?.custom?.url || '', theme }),
+  )
+  if (baseUrl === Symbol.for('back')) return config
+  if (baseUrl) {
+    updated = setNestedValue(updated, 'ai.custom.url', baseUrl)
+  }
+
+  const apiKey = await promptOrBack(() =>
+    password({ message: 'API key (optional, enter to skip)', mask: '*', theme }),
+  )
+  if (apiKey !== Symbol.for('back') && apiKey) {
+    updated = setNestedValue(updated, 'ai.keys.openai-compat', apiKey)
+  }
+
+  const model = await promptOrBack(() =>
+    input({ message: 'Model name', default: cfg.ai?.models?.['openai-compat'] || '', theme }),
+  )
+  if (model !== Symbol.for('back') && model) {
+    updated = setNestedValue(updated, 'ai.models.openai-compat', model)
+  }
+
+  writeUserConfig(updated)
+  console.log(green(`  ✔ Default provider: openai-compat`))
+  return updated
+}
+
+async function configureCommand(config) {
+  const cfg = loadConfig()
+  let updated = config
+  updated = setNestedValue(updated, 'ai.enabled', true)
+  updated = setNestedValue(updated, 'ai.provider', 'command')
+
+  const command = await promptOrBack(() =>
+    input({
+      message: 'Command to run',
+      default: cfg.ai?.command || '',
+      theme,
+    }),
+  )
+  if (command === Symbol.for('back')) return config
+  if (command) {
+    updated = setNestedValue(updated, 'ai.command', command)
+  }
+
+  writeUserConfig(updated)
+  console.log(green(`  ✔ Default provider: command`))
+  return updated
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: API keys
+// ---------------------------------------------------------------------------
+
+// Providers that use API keys (ollama and command don't)
+const KEY_PROVIDERS = ['anthropic', 'openai', 'gemini', 'openai-compat']
+
+async function menuAPIKeys() {
+  let cfg = loadConfig()
+
+  while (true) {
+    cfg = loadConfig()
+    const choices = KEY_PROVIDERS.map((p) => {
+      const key = cfg.ai?.keys?.[p]
+      const status = key ? maskKey(key) : dim('not set')
+      const label = PROVIDER_LABELS[p] || p
+      return { name: `${label.padEnd(20)} ${status}`, value: p }
+    })
+    choices.push({ name: dim('Back'), value: 'back' })
+
+    const provider = await promptOrBack(() => select({ message: 'API Keys', choices, theme }))
+    if (provider === Symbol.for('back') || provider === 'back') return
+
+    const existingKey = cfg.ai?.keys?.[provider]
+    const actionChoices = [{ name: 'Set new key', value: 'set' }]
+    if (existingKey) actionChoices.push({ name: red('Delete key'), value: 'delete' })
+    actionChoices.push({ name: dim('Back'), value: 'back' })
+
+    const label = PROVIDER_LABELS[provider] || provider
+    const action = await promptOrBack(() => select({ message: `${label} key`, choices: actionChoices, theme }))
+    if (action === Symbol.for('back') || action === 'back') continue
+
+    const current = readUserConfig()
+    if (action === 'delete') {
+      const updated = setNestedValue(current, `ai.keys.${provider}`, null)
+      writeUserConfig(updated)
+      console.log(green(`  ✔ ${label} key deleted`))
+    } else {
+      const apiKey = await promptOrBack(() => password({ message: `API key for ${label}`, mask: '*', theme }))
+      if (apiKey === Symbol.for('back')) continue
+      if (apiKey) {
+        const updated = setNestedValue(current, `ai.keys.${provider}`, apiKey)
+        writeUserConfig(updated)
+        console.log(green(`  ✔ ${label} key saved`))
+      }
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: Token budgets
+// ---------------------------------------------------------------------------
+
+async function menuTokenBudgets() {
+  const budgetKeys = [
+    { key: 'maxTokensPerRequest', label: 'Per request', desc: 'max tokens the AI can generate per issue' },
+    { key: 'maxTokensPerHour',    label: 'Per hour',    desc: 'rolling hourly cap across all requests' },
+    { key: 'maxTokensPerDay',     label: 'Per day',     desc: 'rolling daily cap across all requests' },
+  ]
+
+  while (true) {
+    const cfg = loadConfig()
+    const budgets = cfg.ai?.budgets || BUILT_IN_DEFAULTS.ai.budgets
+
+    const choices = budgetKeys.map((b) => ({
+      name: `${b.label.padEnd(14)} ${formatBudget(budgets[b.key])}  ${dim(b.desc)}`,
+      value: b.key,
+    }))
+    choices.push({ name: dim('Restore defaults'), value: 'restore' })
+    choices.push({ name: dim('Back'), value: 'back' })
+
+    const chosen = await promptOrBack(() => select({ message: 'Token Budgets', choices, theme }))
+    if (chosen === Symbol.for('back') || chosen === 'back') return
+
+    if (chosen === 'restore') {
+      const current = readUserConfig()
+      const updated = setNestedValue(current, 'ai.budgets', BUILT_IN_DEFAULTS.ai.budgets)
+      writeUserConfig(updated)
+      console.log(green('  ✔ Token budgets restored to defaults'))
+      continue
+    }
+
+    const info = budgetKeys.find((b) => b.key === chosen)
+    const currentVal = budgets[chosen]
+
+    const value = await promptOrBack(() =>
+      input({ message: `${info.label} (0 = unlimited)`, default: String(currentVal ?? 0), theme }),
+    )
+    if (value === Symbol.for('back')) continue
+
+    const num = Number(value)
+    if (isNaN(num) || num < 0) {
+      console.log(red('  Must be a non-negative number (0 for unlimited)'))
+      continue
+    }
+
+    const current = readUserConfig()
+    const updated = setNestedValue(current, `ai.budgets.${chosen}`, num)
+    writeUserConfig(updated)
+    console.log(green(`  ✔ ${info.label}: ${num === 0 ? 'unlimited' : num.toLocaleString()}`))
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: Default template (selectable list)
+// ---------------------------------------------------------------------------
+
+async function menuDefaultTemplate() {
+  const cfg = loadConfig()
+  const repoRoot = findRepoRoot()
+  const templates = listTemplates(repoRoot)
+
+  // Deduplicate by key (higher-priority sources shadow lower ones)
+  const seen = new Set()
+  const choices = []
+  for (const tpl of templates) {
+    if (!seen.has(tpl.key)) {
+      seen.add(tpl.key)
+      const current = tpl.key === (cfg.templates?.default || 'default') ? green(' (current)') : ''
+      choices.push({
+        name: `${tpl.key.padEnd(14)} ${dim(tpl.name)} ${dim(`(${tpl.source})`)}${current}`,
+        value: tpl.key,
+      })
+    }
+  }
+  choices.push({ name: 'Create new template', value: '_create' })
+  const defaultTpl = BUILT_IN_DEFAULTS.templates.default
+  choices.push({ name: dim(`Restore default (${defaultTpl})`), value: '_restore' })
+  choices.push({ name: dim('Back'), value: 'back' })
+
+  const chosen = await promptOrBack(() =>
+    select({ message: 'Default Template', choices, default: cfg.templates?.default, theme }),
+  )
+  if (chosen === Symbol.for('back') || chosen === 'back') return
+
+  if (chosen === '_restore') {
+    const current = readUserConfig()
+    const updated = setNestedValue(current, 'templates.default', defaultTpl)
+    writeUserConfig(updated)
+    console.log(green(`  ✔ Restored default: ${defaultTpl}`))
+    return
+  }
+
+  if (chosen === '_create') {
+    const name = await promptOrBack(() => input({ message: 'Template name (lowercase, no spaces)', theme }))
+    if (name === Symbol.for('back') || !name) return
+
+    const key = name.trim().toLowerCase().replace(/\s+/g, '-')
+    if (!key) return
+
+    // Create in user templates dir
+    const templateDir = path.join(os.homedir(), '.config', 'tissues', 'templates')
+    fs.mkdirSync(templateDir, { recursive: true })
+    const templatePath = path.join(templateDir, `${key}.md`)
+
+    if (fs.existsSync(templatePath)) {
+      console.log(yellow(`  Template "${key}" already exists at ${templatePath}`))
+      return
+    }
+
+    const body = `name: ${key.charAt(0).toUpperCase() + key.slice(1)}\n\n## Summary\n\n{{description}}\n\n## Details\n\n`
+    fs.writeFileSync(templatePath, body, 'utf8')
+    console.log(green(`  ✔ Template created: ${templatePath}`))
+
+    const setDefault = await promptOrBack(() =>
+      confirm({ message: `Set "${key}" as default?`, default: true, theme }),
+    )
+    if (setDefault === true) {
+      const current = readUserConfig()
+      const updated = setNestedValue(current, 'templates.default', key)
+      writeUserConfig(updated)
+      console.log(green(`  ✔ Default template: ${key}`))
+    }
+    return
+  }
+
+  // Set chosen template as default
+  const current = readUserConfig()
+  const updated = setNestedValue(current, 'templates.default', chosen)
+  writeUserConfig(updated)
+  console.log(green(`  ✔ Default template: ${chosen}`))
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: Safety limits (with descriptions)
+// ---------------------------------------------------------------------------
+
+async function menuSafety() {
+  const safetyKeys = [
+    { key: 'maxPerHour',         label: 'Max per hour',       desc: 'issues one agent can create per hour' },
+    { key: 'burstLimit',         label: 'Burst limit',        desc: 'max issues in a short burst window' },
+    { key: 'burstWindowMinutes', label: 'Burst window (min)', desc: 'how many minutes the burst window spans' },
+    { key: 'tripThreshold',      label: 'Trip threshold',     desc: 'consecutive failures before circuit opens' },
+    { key: 'cooldownMinutes',    label: 'Cooldown (min)',     desc: 'minutes circuit stays open after tripping' },
+    { key: 'globalMaxPerHour',   label: 'Global max/hour',   desc: 'total issues across all agents per hour' },
+  ]
+
+  while (true) {
+    const cfg = loadConfig()
+    const safety = cfg.safety || BUILT_IN_DEFAULTS.safety
+
+    const choices = safetyKeys.map((s) => ({
+      name: `${s.label.padEnd(20)} ${cyan(String(safety[s.key]).padEnd(4))} ${dim(s.desc)}`,
+      value: s.key,
+    }))
+    choices.push({ name: dim('Restore defaults'), value: 'restore' })
+    choices.push({ name: dim('Back'), value: 'back' })
+
+    const chosen = await promptOrBack(() => select({ message: 'Safety Limits', choices, theme }))
+    if (chosen === Symbol.for('back') || chosen === 'back') return
+
+    if (chosen === 'restore') {
+      const current = readUserConfig()
+      const updated = setNestedValue(current, 'safety', BUILT_IN_DEFAULTS.safety)
+      writeUserConfig(updated)
+      console.log(green('  ✔ Safety limits restored to defaults'))
+      continue
+    }
+
+    const info = safetyKeys.find((s) => s.key === chosen)
+    const value = await promptOrBack(() =>
+      input({ message: `${info.label} ${dim(`— ${info.desc}`)}`, default: String(safety[chosen]), theme }),
+    )
+    if (value === Symbol.for('back')) continue
+
+    const num = Number(value)
+    if (isNaN(num) || num < 0) {
+      console.log(red('  Must be a non-negative number'))
+      continue
+    }
+
+    const current = readUserConfig()
+    const updated = setNestedValue(current, `safety.${chosen}`, num)
+    writeUserConfig(updated)
+    console.log(green(`  ✔ ${info.label}: ${num}`))
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: Routing rules (full CRUD)
+// ---------------------------------------------------------------------------
+
+function formatRoute(rule) {
+  const match = Object.entries(rule.match || {})
+    .map(([k, v]) => `${k}=${Array.isArray(v) ? v.join(',') : v}`)
+    .join(', ')
+  return `${match} ${dim('->')} ${rule.provider || 'default'}${rule.model ? dim(` (${rule.model})`) : ''}`
+}
+
+async function editRoute(rule) {
+  const cfg = loadConfig()
+  const repoRoot = findRepoRoot()
+  const providers = listProviders()
+  const templates = listTemplates(repoRoot)
+  const seen = new Set()
+  const templateKeys = []
+  for (const tpl of templates) {
+    if (!seen.has(tpl.key)) { seen.add(tpl.key); templateKeys.push(tpl.key) }
+  }
+
+  // Match type
+  const matchType = await promptOrBack(() =>
+    select({
+      message: 'Match on',
+      choices: [
+        { name: 'Template', value: 'template' },
+        { name: 'Labels',   value: 'labels' },
+      ],
+      default: rule?.match?.template ? 'template' : rule?.match?.labels ? 'labels' : 'template',
+      theme,
+    }),
+  )
+  if (matchType === Symbol.for('back')) return null
+
+  let match = {}
+  if (matchType === 'template') {
+    const tplChoices = templateKeys.map((k) => ({ name: k, value: k }))
+    const tpl = await promptOrBack(() =>
+      select({ message: 'Template', choices: tplChoices, default: rule?.match?.template, theme }),
+    )
+    if (tpl === Symbol.for('back')) return null
+    match = { template: tpl }
+  } else {
+    const labelsRaw = await promptOrBack(() =>
+      input({
+        message: 'Labels (comma-separated, any match)',
+        default: rule?.match?.labels?.join(', ') || '',
+        theme,
+      }),
+    )
+    if (labelsRaw === Symbol.for('back')) return null
+    match = { labels: labelsRaw.split(',').map((l) => l.trim()).filter(Boolean) }
+    if (match.labels.length === 0) {
+      console.log(red('  At least one label required'))
+      return null
+    }
+  }
+
+  // Provider
+  const providerChoices = providers.map((p) => ({
+    name: p.charAt(0).toUpperCase() + p.slice(1),
+    value: p,
+  }))
+  const provider = await promptOrBack(() =>
+    select({ message: 'Provider', choices: providerChoices, default: rule?.provider, theme }),
+  )
+  if (provider === Symbol.for('back')) return null
+
+  // Model
+  const defaultModels = cfg.ai?.models || BUILT_IN_DEFAULTS.ai.models
+  const model = await promptOrBack(() =>
+    input({
+      message: 'Model (enter for provider default)',
+      default: rule?.model || defaultModels[provider] || '',
+      theme,
+    }),
+  )
+  if (model === Symbol.for('back')) return null
+
+  return { match, provider, model: model || undefined }
+}
+
+async function menuRoutingRules() {
+  while (true) {
+    const cfg = loadConfig()
+    const routes = cfg.ai?.routes || []
+
+    const choices = routes.map((rule, i) => ({
+      name: `${String(i + 1).padEnd(3)} ${formatRoute(rule)}`,
+      value: String(i),
+    }))
+    choices.push({ name: green('+ Add rule'), value: 'add' })
+    choices.push({ name: dim('Back'), value: 'back' })
+
+    const chosen = await promptOrBack(() => select({ message: 'Routing Rules', choices, theme }))
+    if (chosen === Symbol.for('back') || chosen === 'back') return
+
+    if (chosen === 'add') {
+      const newRule = await editRoute(null)
+      if (newRule) {
+        const current = readUserConfig()
+        const existingRoutes = current.ai?.routes || []
+        existingRoutes.push(newRule)
+        const updated = setNestedValue(current, 'ai.routes', existingRoutes)
+        writeUserConfig(updated)
+        console.log(green(`  ✔ Route added: ${formatRoute(newRule)}`))
+      }
+      continue
+    }
+
+    // Edit existing route
+    const idx = Number(chosen)
+    const rule = routes[idx]
+
+    const action = await promptOrBack(() =>
+      select({
+        message: `Rule ${idx + 1}: ${formatRoute(rule)}`,
+        choices: [
+          { name: 'Edit', value: 'edit' },
+          { name: red('Delete'), value: 'delete' },
+          { name: dim('Back'), value: 'back' },
+        ],
+        theme,
+      }),
+    )
+    if (action === Symbol.for('back') || action === 'back') continue
+
+    const current = readUserConfig()
+    const existingRoutes = [...(current.ai?.routes || routes)]
+
+    if (action === 'delete') {
+      existingRoutes.splice(idx, 1)
+      const updated = setNestedValue(current, 'ai.routes', existingRoutes)
+      writeUserConfig(updated)
+      console.log(green(`  ✔ Route ${idx + 1} deleted`))
+    } else {
+      const edited = await editRoute(rule)
+      if (edited) {
+        existingRoutes[idx] = edited
+        const updated = setNestedValue(current, 'ai.routes', existingRoutes)
+        writeUserConfig(updated)
+        console.log(green(`  ✔ Route ${idx + 1} updated`))
+      }
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Submenu: Enhancement pipeline
+// ---------------------------------------------------------------------------
+
+const STEP_NAMES = ['triage', 'dedup', 'context', 'scope', 'complexity', 'risk', 'labels', 'format']
+const STEP_LABELS = {
+  triage: 'Input analysis',
+  dedup: 'Duplicate check',
+  context: 'Context extraction',
+  scope: 'Scope analysis',
+  complexity: 'Complexity scoring',
+  risk: 'Risk assessment',
+  labels: 'Label suggestion',
+  format: 'Body formatting',
+}
+
+async function menuPipeline() {
+  while (true) {
+    const cfg = loadConfig()
+    const pipeline = cfg.ai?.pipeline || BUILT_IN_DEFAULTS.ai.pipeline
+    const enabled = pipeline.enabled !== false
+
+    const choices = [
+      {
+        name: `${'Pipeline'.padEnd(18)} ${enabled ? green('enabled') : dim('disabled')}`,
+        value: 'toggle',
+      },
+    ]
+
+    if (enabled) {
+      for (const name of STEP_NAMES) {
+        const setting = pipeline.steps?.[name] || 'auto'
+        const color = setting === 'always' ? green : setting === 'never' ? red : dim
+        choices.push({
+          name: `  ${(STEP_LABELS[name] || name).padEnd(22)} ${color(setting)}`,
+          value: name,
+        })
+      }
+    }
+
+    choices.push({ name: dim('Restore defaults'), value: 'restore' })
+    choices.push({ name: dim('Back'), value: 'back' })
+
+    const chosen = await promptOrBack(() => select({ message: 'Enhancement Pipeline', choices, theme }))
+    if (chosen === Symbol.for('back') || chosen === 'back') return
+
+    if (chosen === 'toggle') {
+      const current = readUserConfig()
+      const updated = setNestedValue(current, 'ai.pipeline.enabled', !enabled)
+      writeUserConfig(updated)
+      console.log(green(`  ✔ Pipeline ${!enabled ? 'enabled' : 'disabled'}`))
+      continue
+    }
+
+    if (chosen === 'restore') {
+      const current = readUserConfig()
+      const updated = setNestedValue(current, 'ai.pipeline', BUILT_IN_DEFAULTS.ai.pipeline)
+      writeUserConfig(updated)
+      console.log(green('  ✔ Pipeline settings restored to defaults'))
+      continue
+    }
+
+    // Toggle a step setting: always → auto → never → always
+    const stepSetting = await promptOrBack(() =>
+      select({
+        message: `${STEP_LABELS[chosen] || chosen}`,
+        choices: [
+          { name: 'always — run every time', value: 'always' },
+          { name: 'auto — run when heuristics suggest it', value: 'auto' },
+          { name: 'never — skip this step', value: 'never' },
+          { name: dim('Back'), value: 'back' },
+        ],
+        default: pipeline.steps?.[chosen] || 'auto',
+        theme,
+      }),
+    )
+    if (stepSetting === Symbol.for('back') || stepSetting === 'back') continue
+
+    const current = readUserConfig()
+    const updated = setNestedValue(current, `ai.pipeline.steps.${chosen}`, stepSetting)
+    writeUserConfig(updated)
+    console.log(green(`  ✔ ${STEP_LABELS[chosen]}: ${stepSetting}`))
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Backup / Restore
+// ---------------------------------------------------------------------------
+
+function getBackupFiles() {
+  const dir = backupsDir()
+  try {
+    return fs.readdirSync(dir)
+      .filter((f) => f.endsWith('.json'))
+      .sort()
+      .reverse()
+  } catch {
+    return []
+  }
+}
+
+async function menuBackupRestore() {
+  while (true) {
+    const backups = getBackupFiles()
+    const choices = [
+      { name: 'Save current config', value: 'save' },
+    ]
+    if (backups.length > 0) {
+      choices.push({ name: `Restore from backup ${dim(`(${backups.length} saved)`)}`, value: 'restore' })
+      choices.push({ name: 'Delete a backup', value: 'delete' })
+    }
+    choices.push({ name: dim('Back'), value: 'back' })
+
+    const action = await promptOrBack(() => select({ message: 'Backup & Restore', choices, theme }))
+    if (action === Symbol.for('back') || action === 'back') return
+
+    if (action === 'save') {
+      const label = await promptOrBack(() =>
+        input({ message: 'Backup name (optional)', default: '', theme }),
+      )
+      if (label === Symbol.for('back')) continue
+
+      const dir = backupsDir()
+      fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+
+      // Warn if backup will contain API keys
+      const cfg = readUserConfig()
+      const hasKeys = cfg.ai?.keys && Object.values(cfg.ai.keys).some(Boolean)
+      if (hasKeys) {
+        const proceed = await promptOrBack(() =>
+          confirm({ message: yellow('Backup will contain unencrypted API keys. Continue?'), default: true, theme }),
+        )
+        if (proceed === Symbol.for('back') || !proceed) continue
+      }
+
+      const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)
+      const safeName = label ? label.trim().replace(/[^a-zA-Z0-9_-]/g, '_') : ''
+      const filename = safeName ? `${timestamp}_${safeName}.json` : `${timestamp}.json`
+
+      // Bundle user config + templates
+      const bundle = {
+        _version: 1,
+        _createdAt: new Date().toISOString(),
+        _label: label || undefined,
+        config: cfg,
+        activeRepo: store.get('activeRepo') || null,
+      }
+
+      // Include user templates if they exist
+      const templateDir = path.join(os.homedir(), '.config', 'tissues', 'templates')
+      try {
+        const files = fs.readdirSync(templateDir).filter((f) => f.endsWith('.md'))
+        if (files.length > 0) {
+          bundle.templates = {}
+          for (const f of files) {
+            bundle.templates[f] = fs.readFileSync(path.join(templateDir, f), 'utf8')
+          }
+        }
+      } catch { /* no templates dir */ }
+
+      const filePath = path.join(dir, filename)
+      fs.writeFileSync(filePath, JSON.stringify(bundle, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 })
+      console.log(green(`  ✔ Saved: ${filename}`))
+      continue
+    }
+
+    if (action === 'restore') {
+      const backupChoices = backups.map((f) => {
+        let label = f.replace('.json', '')
+        try {
+          const data = JSON.parse(fs.readFileSync(path.join(backupsDir(), f), 'utf8'))
+          if (data._label) label = `${label} ${dim(`"${data._label}"`)}`
+        } catch { /* ignore */ }
+        return { name: label, value: f }
+      })
+      backupChoices.push({ name: dim('Back'), value: 'back' })
+
+      const file = await promptOrBack(() => select({ message: 'Restore from', choices: backupChoices, theme }))
+      if (file === Symbol.for('back') || file === 'back') continue
+
+      const filePath = path.join(backupsDir(), file)
+      let bundle
+      try {
+        bundle = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+      } catch (err) {
+        console.log(red(`  Failed to read backup: ${err.message}`))
+        continue
+      }
+
+      const proceed = await promptOrBack(() =>
+        confirm({ message: 'This will overwrite your current config. Continue?', default: false, theme }),
+      )
+      if (proceed !== true) continue
+
+      // Restore config
+      if (bundle.config) writeUserConfig(bundle.config)
+      if (bundle.activeRepo) store.set('activeRepo', bundle.activeRepo)
+
+      // Restore templates
+      if (bundle.templates) {
+        const templateDir = path.join(os.homedir(), '.config', 'tissues', 'templates')
+        fs.mkdirSync(templateDir, { recursive: true })
+        for (const [filename, content] of Object.entries(bundle.templates)) {
+          fs.writeFileSync(path.join(templateDir, filename), content, 'utf8')
+        }
+        console.log(green(`  ✔ Restored ${Object.keys(bundle.templates).length} template(s)`))
+      }
+
+      console.log(green(`  ✔ Config restored from ${file}`))
+      continue
+    }
+
+    if (action === 'delete') {
+      const deleteChoices = backups.map((f) => ({ name: f.replace('.json', ''), value: f }))
+      deleteChoices.push({ name: dim('Back'), value: 'back' })
+
+      const file = await promptOrBack(() => select({ message: 'Delete backup', choices: deleteChoices, theme }))
+      if (file === Symbol.for('back') || file === 'back') continue
+
+      fs.unlinkSync(path.join(backupsDir(), file))
+      console.log(green(`  ✔ Deleted: ${file}`))
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Main menu loop
+// ---------------------------------------------------------------------------
+
+async function runWizard() {
+  console.log(bold('\ntissues config\n'))
+
+  while (true) {
+    const cfg = loadConfig()
+    const providers = listProviders()
+    const budgets = cfg.ai?.budgets || {}
+
+    const summaries = {
+      repo: store.get('activeRepo') || dim('not set'),
+      provider: cfg.ai?.enabled === false
+        ? dim('disabled')
+        : (cfg.ai?.provider || dim('not set')),
+      keys: KEY_PROVIDERS
+        .filter((p) => cfg.ai?.keys?.[p])
+        .join(', ') || dim('none'),
+      budgets: [budgets.maxTokensPerRequest, budgets.maxTokensPerHour, budgets.maxTokensPerDay]
+        .map((v) => (v === 0 || !v) ? '\u221E' : v.toLocaleString())
+        .join('/'),
+      template: cfg.templates?.default || 'default',
+      safety: `${cfg.safety?.maxPerHour || '?'}/hr, burst ${cfg.safety?.burstLimit || '?'}`,
+      routes: `${(cfg.ai?.routes || []).length} rule${(cfg.ai?.routes || []).length === 1 ? '' : 's'}`,
+      pipeline: cfg.ai?.pipeline?.enabled !== false ? green('enabled') : dim('disabled'),
+      backups: `${getBackupFiles().length} saved`,
+    }
+
+    const choices = [
+      { name: `${'Default Repo'.padEnd(18)} ${dim(summaries.repo)}`,        value: 'repo' },
+      { name: `${'Default Provider'.padEnd(18)} ${dim(summaries.provider)}`,value: 'provider' },
+      { name: `${'Default Template'.padEnd(18)} ${dim(summaries.template)}`,value: 'template' },
+      { name: `${'API Keys'.padEnd(18)} ${dim(summaries.keys)}`,            value: 'keys' },
+      { name: `${'Token Budgets'.padEnd(18)} ${dim(summaries.budgets)}`,    value: 'budgets' },
+      { name: `${'Safety Limits'.padEnd(18)} ${dim(summaries.safety)}`,     value: 'safety' },
+      { name: `${'Routing Rules'.padEnd(18)} ${dim(summaries.routes)}`,     value: 'routes' },
+      { name: `${'AI Pipeline'.padEnd(18)} ${summaries.pipeline}`,          value: 'pipeline' },
+      { name: `${'Backup & Restore'.padEnd(18)} ${dim(summaries.backups)}`, value: 'backup' },
+      { name: dim('Done'),                                                   value: 'done' },
+    ]
+
+    let choice
+    try {
+      choice = await select({ message: 'Configure', choices, theme })
+    } catch (err) {
+      if (isCancelled(err)) break
+      throw err
+    }
+    if (choice === 'done') break
+
+    try {
+      switch (choice) {
+        case 'repo':     await menuActiveRepo(); break
+        case 'provider': await menuActiveProvider(); break
+        case 'keys':     await menuAPIKeys(); break
+        case 'budgets':  await menuTokenBudgets(); break
+        case 'template': await menuDefaultTemplate(); break
+        case 'safety':   await menuSafety(); break
+        case 'routes':   await menuRoutingRules(); break
+        case 'pipeline': await menuPipeline(); break
+        case 'backup':   await menuBackupRestore(); break
+      }
+    } catch (err) {
+      if (isCancelled(err)) continue
+      console.error(red(`  Error: ${err.message}`))
+    }
+
+    console.log()
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Command
 // ---------------------------------------------------------------------------
 
 export const configCommand = new Command('config')
   .description('Get or set persistent configuration values')
+  .argument('[key]', 'Config key (dot notation, e.g. ai.provider)')
+  .argument('[value]', 'Value to set (omit to get)')
+  .action(async (key, rawValue) => {
+    if (!key) {
+      await runWizard()
+      return
+    }
+
+    if (rawValue === undefined) {
+      const cfg = loadConfig()
+      const value = getNestedValue(cfg, key)
+      if (value === undefined) {
+        console.error(red(`Unknown config key: ${key}`))
+        process.exit(1)
+      }
+      if (key.startsWith('ai.keys.') && value && typeof value === 'string') {
+        console.log(maskKey(value))
+      } else if (typeof value === 'object') {
+        console.log(JSON.stringify(value, null, 2))
+      } else {
+        console.log(value)
+      }
+      return
+    }
+
+    let value
+    try {
+      value = coerceValue(key, rawValue)
+    } catch (err) {
+      console.error(red(err.message))
+      process.exit(1)
+    }
+    const current = readUserConfig()
+    const updated = setNestedValue(current, key, value)
+    writeUserConfig(updated)
+    const display = key.startsWith('ai.keys.') && typeof value === 'string'
+      ? maskKey(value)
+      : typeof value === 'object' ? JSON.stringify(value) : value
+    console.log(green(`✔ Set ${key} = ${display}`))
+  })
 
 configCommand
   .command('get <key>')
@@ -72,10 +1011,16 @@ configCommand
     const cfg = loadConfig()
     const value = getNestedValue(cfg, key)
     if (value === undefined) {
-      console.error(chalk.red(`Unknown config key: ${key}`))
+      console.error(red(`Unknown config key: ${key}`))
       process.exit(1)
     }
-    console.log(value)
+    if (key.startsWith('ai.keys.') && value && typeof value === 'string') {
+      console.log(maskKey(value))
+    } else if (typeof value === 'object') {
+      console.log(JSON.stringify(value, null, 2))
+    } else {
+      console.log(value)
+    }
   })
 
 configCommand
@@ -86,13 +1031,16 @@ configCommand
     try {
       value = coerceValue(key, rawValue)
     } catch (err) {
-      console.error(chalk.red(err.message))
+      console.error(red(err.message))
       process.exit(1)
     }
     const current = readUserConfig()
     const updated = setNestedValue(current, key, value)
     writeUserConfig(updated)
-    console.log(chalk.green(`✔ Set ${key} = ${value}`))
+    const display = key.startsWith('ai.keys.') && typeof value === 'string'
+      ? maskKey(value)
+      : typeof value === 'object' ? JSON.stringify(value) : value
+    console.log(green(`✔ Set ${key} = ${display}`))
   })
 
 configCommand
@@ -100,5 +1048,6 @@ configCommand
   .description('Show all resolved config values')
   .action(() => {
     const cfg = loadConfig()
-    console.log(JSON.stringify(cfg, null, 2))
+    const masked = maskKeysForDisplay(cfg)
+    console.log(JSON.stringify(masked, null, 2))
   })