code-puppy-core-plugins 0.0.97__tar.gz → 0.0.99__tar.gz

{code_puppy_core_plugins-0.0.97 → code_puppy_core_plugins-0.0.99}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-puppy-core-plugins
-Version: 0.0.97
+Version: 0.0.99
 Summary: Official plugin bundle for Code Puppy
 Project-URL: Repository, https://github.com/mpfaffenberger/code_puppy_core_plugins
 Project-URL: Homepage, https://github.com/mpfaffenberger/code_puppy_core_plugins

code_puppy_core_plugins-0.0.99/code_puppy_core_plugins/execution_environment/README.md

@@ -0,0 +1,46 @@
+# Execution environment
+
+Bundled `load_prompt` provider that tells agents the host OS and the shell used
+by the local shell tool. No configuration or core-agent changes are required.
+The existing runtime-prompt path includes the fragment for main agents and
+subagents, separate from their cacheable authored instructions.
+
+## Shell selection
+
+The provider describes the current core command runner's
+`subprocess.Popen(shell=True)` behavior (no executable override):
+
+| Python host | Local execution shell |
+| --- | --- |
+| Windows | `COMSPEC`, falling back to `SystemRoot/System32/cmd.exe` |
+| macOS / Linux / other POSIX | `/bin/sh` |
+| Android | `/system/bin/sh` |
+
+The terminal launching Code Puppy is not the execution shell. For example,
+PowerShell or Git Bash launching Windows Python still normally uses cmd.exe;
+WSL running Linux Python uses /bin/sh. The provider does not assume Bash or
+GNU utilities on macOS/Linux. It does not select or change the shell, and its
+facts do not describe remote hosts or explicitly invoked interpreters.
+
+Facts are computed whenever core assembles runtime instructions, not cached
+at plugin import. A new process that resumes history builds new instructions.
+Existing core may reuse a built agent and its runtime tail, so this is not a
+promise of per-command refresh or support for changing execution backends
+mid-process. Saved conversations can still contain old environment details.
+If core introduces a configurable shell backend, update this provider to use
+that backend's execution contract rather than inferring it from the terminal.
+
+No date/time injection is added. The independent timestamp-heartbeat plugin
+continues to stamp occasional tool results.
+
+## Verification
+
+Tests simulate Windows, macOS, Linux, FreeBSD, Cygwin, and Android, exercise
+entry-point registration and the unmodified core's additive runtime path, and
+check graceful failure. These are simulated platform tests, not native
+end-to-end runs on every platform.
+
+The original Windows model exercise using `llama-qwen3.8-27b` showed 1/5 correct
+first-choice commands without environment instructions, versus 5/5 with the
+same OS/shell guidance. See the replacement PR for verification scope; prompt
+context reduces ambiguity but cannot guarantee correct model commands.

code_puppy_core_plugins-0.0.99/code_puppy_core_plugins/execution_environment/__init__.py

@@ -0,0 +1 @@
+"""Describe the local OS and command shell through the runtime prompt hook."""

code_puppy_core_plugins-0.0.99/code_puppy_core_plugins/execution_environment/register_callbacks.py

@@ -0,0 +1,60 @@
+"""Add OS/shell facts to runtime instructions, without changing core agents."""
+
+import logging
+import os
+import platform
+import sys
+
+from code_puppy.callbacks import register_callback
+
+logger = logging.getLogger(__name__)
+
+
+def get_execution_environment_prompt() -> str:
+    """Describe core command_runner's subprocess(shell=True) defaults.
+
+    No executable override is supplied by the local runner. SHELL and the
+    interactive terminal are not authoritative: Windows Python uses COMSPEC,
+    POSIX Python uses /bin/sh, and Android Python uses /system/bin/sh.
+    Revisit this provider if the runner adds a configurable execution backend.
+    """
+    system = platform.system() or sys.platform
+    if sys.platform == "win32":
+        shell = os.environ.get("COMSPEC") or os.path.join(
+            os.environ.get("SystemRoot", r"C:\Windows"), "System32", "cmd.exe"
+        )
+        guidance = (
+            "Use syntax compatible with this Windows command shell. "
+            "For cmd.exe, use %NAME% for environment variables and Windows "
+            "commands such as dir and where; do not use PowerShell cmdlets "
+            "or POSIX shell syntax unless explicitly invoking that interpreter."
+        )
+    else:
+        shell = "/system/bin/sh" if hasattr(sys, "getandroidapilevel") else "/bin/sh"
+        guidance = (
+            "Use POSIX sh-compatible syntax, not Bash-specific syntax unless "
+            "explicitly invoking Bash. Do not assume GNU-only utilities or flags "
+            "are available on every POSIX operating system."
+        )
+    return (
+        "\n\nExecution environment (local shell tool):\n"
+        f"- Operating system: {system}\n"
+        f"- Command shell: {shell} (subprocess shell=True)\n"
+        f"- {guidance}\n"
+        "- The interactive terminal may use a different shell. These facts apply "
+        "to local commands, not remote hosts, containers, or explicitly invoked shells."
+    )
+
+
+def _on_load_prompt() -> str | None:
+    """Compute current host facts at prompt assembly; never block agent startup."""
+    try:
+        return get_execution_environment_prompt()
+    except Exception:
+        logger.debug(
+            "Unable to describe the local execution environment", exc_info=True
+        )
+        return None
+
+
+register_callback("load_prompt", _on_load_prompt)

{code_puppy_core_plugins-0.0.97 → code_puppy_core_plugins-0.0.99}/code_puppy_core_plugins/setup_cli/README.md

@@ -11,6 +11,7 @@ no parallel config logic.
 code-puppy --setup wizard                     # guided first-run setup
 code-puppy --setup doctor [--network]         # what's broken / missing?
 code-puppy --setup auth login meta            # delegate to the plugin's own flow
+code-puppy --setup auth login zai-coding-plan # models.dev id (raw env var also works)
 code-puppy --setup auth list --json
 code-puppy --setup model add anthropic/claude-haiku-5-5 --set-default
 code-puppy --setup model list

code_puppy_core_plugins-0.0.99/code_puppy_core_plugins/setup_cli/auth_cmds.py

@@ -0,0 +1,215 @@
+"""``setup auth`` — one front door for every provider login Code Puppy has.
+
+OAuth logins are *delegated* to the owning plugin's existing interactive
+command in a full Code Puppy subprocess (``code-puppy -p "/x-auth"``):
+those flows print through the messaging system and may open browsers or
+localhost callbacks, none of which exist yet in the ``handle_cli_args``
+context this CLI runs in. Status/logout reads go through the plugins'
+own loaders with structured results. API keys are collected directly
+(hidden prompt, stdin, or environment) into the shared credential
+store and never echoed.
+"""
+
+from __future__ import annotations
+
+import getpass
+import os
+import re
+import shutil
+import subprocess
+import sys
+from typing import Optional
+
+from . import providers
+from .output import Out, SetupError
+
+
+def _delegate_slash_command(command: str) -> int:
+    exe = shutil.which("code-puppy") or sys.argv[0]
+    print(f'launching: code-puppy -p "/{command}" (interactive provider flow)')
+    return subprocess.call([exe, "-p", f"/{command}"])
+
+
+_ENV_NAME_RE = re.compile(r"[A-Z_][A-Z0-9_]*")
+
+
+def _resolve_api_key_envs(provider_id: str) -> tuple[list[str], Optional[str]]:
+    """Resolve an ``auth`` target to its API-key env vars.
+
+    Accepts a models.dev provider id (``zai-coding-plan`` -> the env
+    vars it declares, canonical first) or a raw env var name
+    (``ZHIPU_API_KEY``). Returns ``(envs, models_dev_id)``; the id
+    is None for the raw-env form. A known provider declaring no env
+    vars yields ``([], id)``.
+    """
+    envs = providers.api_key_envs_for_provider(provider_id)
+    if envs is not None:
+        return envs, provider_id.strip().lower()
+    return [provider_id.strip().upper()], None
+
+
+def cmd_auth_list(out: Out) -> int:
+    status = providers.all_provider_status()
+    human = []
+    for entry in status.oauth:
+        mark = "authenticated" if entry["authenticated"] else "not authenticated"
+        human.append(f"{entry['id']}: {mark} [{entry['sandbox_transport']}]")
+    for entry in status.api_keys:
+        if entry["authenticated"]:
+            human.append(f"{entry['env_var']}: set")
+    out.result(
+        {"oauth": status.oauth, "api_keys": status.api_keys},
+        human=human or ["(nothing authenticated)"],
+    )
+    return 0
+
+
+def cmd_auth_status(out: Out, provider_id: str) -> int:
+    provider = providers.get_oauth_provider(provider_id)
+    if provider:
+        entry = providers.oauth_status(provider)
+        out.result(
+            entry,
+            human=f"{provider.id}: "
+            + ("authenticated" if entry["authenticated"] else "not authenticated")
+            + f" (source: {entry['source']})",
+        )
+        return 0 if entry["authenticated"] else 1
+    envs, models_dev_id = _resolve_api_key_envs(provider_id)
+    if models_dev_id is None and not providers.is_known_api_key_env(envs[0]):
+        raise SetupError(
+            f"unknown provider '{provider_id}' (see `setup auth list`)", exit_code=2
+        )
+    if not envs:
+        out.result(
+            {
+                "provider": models_dev_id,
+                "env_var": None,
+                "env_vars": {},
+                "authenticated": False,
+                "kind": "api-key",
+            },
+            human=f"{models_dev_id}: declares no API-key env var in models.dev",
+        )
+        return 1
+    per_env = {env: providers.credential_present(env) for env in envs}
+    present = any(per_env.values())
+    result: dict = {
+        "env_var": envs[0],
+        "env_vars": per_env,
+        "authenticated": present,
+        "kind": "api-key",
+    }
+    if models_dev_id:
+        result["provider"] = models_dev_id
+        detail = ", ".join(
+            f"{env} {'set' if is_set else 'not set'}" for env, is_set in per_env.items()
+        )
+        human = f"{models_dev_id}: {'set' if present else 'not set'} ({detail})"
+    else:
+        human = f"{envs[0]}: {'set' if present else 'not set'}"
+    out.result(result, human=human)
+    return 0 if present else 1
+
+
+def _collect_api_key(env_var: str, from_env: Optional[str], stdin: bool) -> str:
+    if stdin:
+        value = sys.stdin.read().strip()
+    elif from_env:
+        value = os.environ.get(from_env, "").strip()
+    else:
+        value = getpass.getpass(f"Enter {env_var}: ").strip()
+    if not value:
+        raise SetupError(f"no value provided for {env_var}")
+    return value
+
+
+def cmd_auth_login(
+    out: Out, provider_id: str, from_env: Optional[str], stdin: bool
+) -> int:
+    provider = providers.get_oauth_provider(provider_id)
+    if provider and provider.login_kind == "slash" and provider.auth_command:
+        return _delegate_slash_command(provider.auth_command)
+    if provider and provider.env_var:
+        env_var, models_dev_id = provider.env_var, None
+    else:
+        envs, models_dev_id = _resolve_api_key_envs(provider_id)
+        if models_dev_id is not None and not envs:
+            raise SetupError(
+                f"provider '{provider_id}' declares no API-key env var in models.dev",
+                exit_code=2,
+            )
+        env_var = envs[0]
+        if models_dev_id is None and not _ENV_NAME_RE.fullmatch(env_var):
+            raise SetupError(
+                f"unknown provider '{provider_id}' (see `setup auth list`"
+                " and `setup model catalog`)",
+                exit_code=2,
+            )
+    value = _collect_api_key(env_var, from_env, stdin)
+    from code_puppy.provider_credentials import save_credential
+
+    save_credential(env_var, value)
+    result: dict = {"env_var": env_var, "saved": True}
+    suffix = ""
+    if models_dev_id:
+        result["provider"] = models_dev_id
+        suffix = f" (provider {models_dev_id})"
+    out.result(result, human=f"saved credential for {env_var}{suffix}")
+    return 0
+
+
+def _clear_stored_credential(env_var: str) -> None:
+    from pathlib import Path
+
+    from code_puppy import config, secret_store, shared_credentials
+    from code_puppy.atomic_io import path_lock
+    from code_puppy.config_file import mutate_config
+
+    # Core has no delete-credential API (save() rejects empty values), so
+    # mirror shared_credentials.save() in reverse under the same lock:
+    # drop the shared-store secret and any legacy puppy.cfg value.
+    def _remove_legacy(parser):
+        return (
+            parser.remove_option(config.DEFAULT_SECTION, env_var)
+            if parser.has_section(config.DEFAULT_SECTION)
+            else False
+        )
+
+    try:
+        with path_lock(str(Path(config.CONFIG_DIR) / "provider_credentials")):
+            secret_store.delete_secret(shared_credentials._name(env_var))
+            mutate_config(str(config.CONFIG_FILE), _remove_legacy)
+    except Exception as e:
+        raise SetupError(f"failed to clear stored credential for {env_var}: {e}") from e
+    os.environ.pop(env_var, None)
+
+
+def cmd_auth_logout(out: Out, provider_id: str) -> int:
+    provider = providers.get_oauth_provider(provider_id)
+    if provider and provider.logout_command:
+        return _delegate_slash_command(provider.logout_command)
+    if provider and provider.env_var:
+        envs, models_dev_id = [provider.env_var], None
+    else:
+        envs, models_dev_id = _resolve_api_key_envs(provider_id)
+    if models_dev_id is not None and not envs:
+        raise SetupError(
+            f"provider '{provider_id}' declares no API-key env var in models.dev",
+            exit_code=2,
+        )
+    if models_dev_id is None and not _ENV_NAME_RE.fullmatch(envs[0]):
+        raise SetupError(
+            f"unknown provider '{provider_id}' (see `setup auth list`)", exit_code=2
+        )
+    for env_var in envs:
+        _clear_stored_credential(env_var)
+    result: dict = {"env_var": envs[0], "env_vars": envs, "cleared": True}
+    if models_dev_id:
+        result["provider"] = models_dev_id
+    out.result(
+        result,
+        human=f"cleared stored credential for {', '.join(envs)} "
+        "(a shell environment variable of the same name still wins if set)",
+    )
+    return 0

{code_puppy_core_plugins-0.0.97 → code_puppy_core_plugins-0.0.99}/code_puppy_core_plugins/setup_cli/cli.py

@@ -92,10 +92,10 @@ def build_parser() -> argparse.ArgumentParser:
         func=lambda o, a: auth_cmds.cmd_auth_list(o)
     )
     s = pa.add_parser("status", parents=[common])
-    s.add_argument("provider")
+    s.add_argument("provider", help="OAuth id, models.dev provider id, or env var")
     s.set_defaults(func=lambda o, a: auth_cmds.cmd_auth_status(o, a.provider))
     li = pa.add_parser("login", parents=[common])
-    li.add_argument("provider")
+    li.add_argument("provider", help="OAuth id, models.dev provider id, or env var")
     li.add_argument(
         "--from-env", metavar="VAR", help="read an API key from this env var"
     )
@@ -104,7 +104,7 @@ def build_parser() -> argparse.ArgumentParser:
         func=lambda o, a: auth_cmds.cmd_auth_login(o, a.provider, a.from_env, a.stdin)
     )
     lo = pa.add_parser("logout", parents=[common])
-    lo.add_argument("provider")
+    lo.add_argument("provider", help="OAuth id, models.dev provider id, or env var")
     lo.set_defaults(func=lambda o, a: auth_cmds.cmd_auth_logout(o, a.provider))
 
     p = sub.add_parser("mcp", parents=[common], help="MCP servers")
@@ -226,7 +226,12 @@ def build_parser() -> argparse.ArgumentParser:
         help="derive sandbox credentials/egress from configured models",
     )
     plan_p.add_argument("--provider", help="restrict to one service/provider id")
-    plan_p.set_defaults(func=lambda o, a: sbx_plan.cmd_sbx_plan(o, a.provider))
+    plan_p.add_argument(
+        "--prune",
+        action="store_true",
+        help="remove stored sbx secrets the current catalog no longer needs",
+    )
+    plan_p.set_defaults(func=lambda o, a: sbx_plan.cmd_sbx_plan(o, a.provider, a.prune))
     creds_p = psbx.add_parser(
         "creds-mixin",
         parents=[common],

{code_puppy_core_plugins-0.0.97 → code_puppy_core_plugins-0.0.99}/code_puppy_core_plugins/setup_cli/providers.py

@@ -160,6 +160,31 @@ def _models_dev_env_vars() -> frozenset:
         return frozenset()
 
 
+def _models_dev_providers() -> dict[str, list[str]]:
+    """models.dev provider id -> declared API-key env vars (best effort)."""
+    try:
+        from code_puppy.models_dev_parser import ModelsDevRegistry
+
+        providers_map = ModelsDevRegistry().get_providers()
+        values = (
+            providers_map.values() if isinstance(providers_map, dict) else providers_map
+        )
+        return {p.id: list(p.env or []) for p in values if getattr(p, "id", None)}
+    except Exception:
+        return {}
+
+
+def api_key_envs_for_provider(provider_id: str) -> Optional[list[str]]:
+    """Env vars a models.dev provider declares; None if the id is unknown.
+
+    ``env[0]`` is canonical: it is the name ``setup model add``
+    encodes into generated model configs, so a login by provider id
+    stores the key exactly where those models will look for it.
+    """
+    envs = _models_dev_providers().get(provider_id.strip().lower())
+    return list(envs) if envs is not None else None
+
+
 def is_known_api_key_env(env_var: str) -> bool:
     """Known via the curated lists OR declared by a models.dev provider."""
     return env_var in api_key_env_vars() or env_var in _models_dev_env_vars()

{code_puppy_core_plugins-0.0.97 → code_puppy_core_plugins-0.0.99}/code_puppy_core_plugins/setup_cli/sbx_plan.py

@@ -16,11 +16,12 @@ Values are never read or emitted — only presence on the host.
 from __future__ import annotations
 
 import re
+import subprocess
 from typing import Any, Optional
 from urllib.parse import urlparse
 
 from . import providers
-from .output import Out
+from .output import Out, SetupError
 
 # Static-key model types: type -> (service, env var, domain, header, format)
 _STATIC_TYPES: dict[str, tuple[str, str, str, str, str]] = {
@@ -279,10 +280,95 @@ def render_human(plan: dict[str, Any]) -> list[str]:
     return lines
 
 
-def cmd_sbx_plan(out: Out, provider: Optional[str] = None) -> int:
+def _parse_secret_ls(stdout: str) -> list[str]:
+    """Global service-secret names from `sbx secret ls` table output."""
+    names = []
+    for line in stdout.splitlines():
+        cols = line.split()
+        if len(cols) >= 3 and cols[0] == "(global)" and cols[1] == "service":
+            names.append(cols[2])
+    return sorted(set(names))
+
+
+def _stored_sbx_secrets() -> Optional[list[str]]:
+    """Stored global sbx service secrets; None when sbx is unavailable."""
+    try:
+        result = subprocess.run(
+            ["sbx", "secret", "ls"],
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=30,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if result.returncode != 0:
+        return None
+    return _parse_secret_ls(result.stdout)
+
+
+def _remove_sbx_secret(name: str) -> Optional[str]:
+    """Remove one global sbx secret; None on success, else an error line."""
+    try:
+        result = subprocess.run(
+            ["sbx", "secret", "rm", name, "-f"],
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=30,
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        return str(e)
+    if result.returncode != 0:
+        return (result.stderr or result.stdout).strip()[
+            :200
+        ] or f"exit {result.returncode}"
+    return None
+
+
+def cmd_sbx_plan(out: Out, provider: Optional[str] = None, prune: bool = False) -> int:
+    if prune and provider:
+        raise SetupError(
+            "refusing --prune with --provider: a filtered plan would "
+            "delete secrets other providers still need",
+            exit_code=2,
+        )
     plan = build_plan(provider=provider)
-    out.result(plan, human=render_human(plan))
-    return 0
+    stored = _stored_sbx_secrets()
+    needed = {c["service"] for c in plan["credentials"]}
+    stale = (
+        [name for name in stored if name not in needed]
+        if stored is not None and not provider
+        else []
+    )
+    human = render_human(plan)
+    pruned: list[str] = []
+    errors: dict[str, str] = {}
+    if prune:
+        for name in stale:
+            error = _remove_sbx_secret(name)
+            if error is None:
+                pruned.append(name)
+                human.append(f"pruned stale sbx secret '{name}'")
+            else:
+                errors[name] = error
+                human.append(f"failed to prune sbx secret '{name}': {error}")
+        stale = [name for name in stale if name not in pruned]
+    elif stale:
+        human.append(
+            "stale sbx secrets (not needed by current catalog): "
+            + ", ".join(stale)
+            + " - re-run with --prune to remove"
+        )
+    result: dict[str, Any] = {
+        **plan,
+        "stale_sbx_secrets": stale,
+        "pruned_sbx_secrets": pruned,
+    }
+    if errors:
+        result["prune_errors"] = errors
+    out.result(result, human=human)
+    return 1 if errors else 0
 
 
 def render_creds_mixin(plan: dict[str, Any]) -> str:

{code_puppy_core_plugins-0.0.97 → code_puppy_core_plugins-0.0.99}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "code-puppy-core-plugins"
-version = "0.0.97"
+version = "0.0.99"
 description = "Official plugin bundle for Code Puppy"
 readme = "README.md"
 requires-python = ">=3.11,<3.15"
@@ -83,6 +83,7 @@ destructive_command_guard = "code_puppy_core_plugins.destructive_command_guard.r
 emoji_filter = "code_puppy_core_plugins.emoji_filter.register_callbacks"
 empty_html_comment_filter = "code_puppy_core_plugins.empty_html_comment_filter.register_callbacks"
 example_custom_command = "code_puppy_core_plugins.example_custom_command.register_callbacks"
+execution_environment = "code_puppy_core_plugins.execution_environment.register_callbacks"
 file_permission_handler = "code_puppy_core_plugins.file_permission_handler.register_callbacks"
 flux_bootstrap = "code_puppy_core_plugins.flux_bootstrap.register_callbacks"
 force_push_guard = "code_puppy_core_plugins.force_push_guard.register_callbacks"

code_puppy_core_plugins-0.0.97/code_puppy_core_plugins/setup_cli/auth_cmds.py

@@ -1,124 +0,0 @@
-"""``setup auth`` — one front door for every provider login Code Puppy has.
-
-OAuth logins are *delegated* to the owning plugin's existing interactive
-command in a full Code Puppy subprocess (``code-puppy -p "/x-auth"``):
-those flows print through the messaging system and may open browsers or
-localhost callbacks, none of which exist yet in the ``handle_cli_args``
-context this CLI runs in. Status/logout reads go through the plugins'
-own loaders with structured results. API keys are collected directly
-(hidden prompt, stdin, or environment) into the shared credential
-store and never echoed.
-"""
-
-from __future__ import annotations
-
-import getpass
-import os
-import shutil
-import subprocess
-import sys
-from typing import Optional
-
-from . import providers
-from .output import Out, SetupError
-
-
-def _delegate_slash_command(command: str) -> int:
-    exe = shutil.which("code-puppy") or sys.argv[0]
-    print(f'launching: code-puppy -p "/{command}" (interactive provider flow)')
-    return subprocess.call([exe, "-p", f"/{command}"])
-
-
-def cmd_auth_list(out: Out) -> int:
-    status = providers.all_provider_status()
-    human = []
-    for entry in status.oauth:
-        mark = "authenticated" if entry["authenticated"] else "not authenticated"
-        human.append(f"{entry['id']}: {mark} [{entry['sandbox_transport']}]")
-    for entry in status.api_keys:
-        if entry["authenticated"]:
-            human.append(f"{entry['env_var']}: set")
-    out.result(
-        {"oauth": status.oauth, "api_keys": status.api_keys},
-        human=human or ["(nothing authenticated)"],
-    )
-    return 0
-
-
-def cmd_auth_status(out: Out, provider_id: str) -> int:
-    provider = providers.get_oauth_provider(provider_id)
-    if provider:
-        entry = providers.oauth_status(provider)
-        out.result(
-            entry,
-            human=f"{provider.id}: "
-            + ("authenticated" if entry["authenticated"] else "not authenticated")
-            + f" (source: {entry['source']})",
-        )
-        return 0 if entry["authenticated"] else 1
-    env_var = provider_id.strip().upper()
-    if providers.is_known_api_key_env(env_var):
-        present = providers.credential_present(env_var)
-        out.result(
-            {"env_var": env_var, "authenticated": present, "kind": "api-key"},
-            human=f"{env_var}: {'set' if present else 'not set'}",
-        )
-        return 0 if present else 1
-    raise SetupError(
-        f"unknown provider '{provider_id}' (see `setup auth list`)", exit_code=2
-    )
-
-
-def _collect_api_key(env_var: str, from_env: Optional[str], stdin: bool) -> str:
-    if stdin:
-        value = sys.stdin.read().strip()
-    elif from_env:
-        value = os.environ.get(from_env, "").strip()
-    else:
-        value = getpass.getpass(f"Enter {env_var}: ").strip()
-    if not value:
-        raise SetupError(f"no value provided for {env_var}")
-    return value
-
-
-def cmd_auth_login(
-    out: Out, provider_id: str, from_env: Optional[str], stdin: bool
-) -> int:
-    provider = providers.get_oauth_provider(provider_id)
-    if provider and provider.login_kind == "slash" and provider.auth_command:
-        return _delegate_slash_command(provider.auth_command)
-    env_var = (
-        provider.env_var
-        if provider and provider.env_var
-        else provider_id.strip().upper()
-    )
-    if not env_var:
-        raise SetupError(f"provider '{provider_id}' has no API-key login", exit_code=2)
-    value = _collect_api_key(env_var, from_env, stdin)
-    from code_puppy.provider_credentials import save_credential
-
-    save_credential(env_var, value)
-    out.result(
-        {"env_var": env_var, "saved": True}, human=f"saved credential for {env_var}"
-    )
-    return 0
-
-
-def cmd_auth_logout(out: Out, provider_id: str) -> int:
-    provider = providers.get_oauth_provider(provider_id)
-    if provider and provider.logout_command:
-        return _delegate_slash_command(provider.logout_command)
-    env_var = (
-        provider.env_var
-        if provider and provider.env_var
-        else provider_id.strip().upper()
-    )
-    from code_puppy.provider_credentials import save_credential
-
-    save_credential(env_var, "")
-    out.result(
-        {"env_var": env_var, "cleared": True},
-        human=f"cleared stored credential for {env_var} "
-        "(a shell environment variable of the same name still wins if set)",
-    )
-    return 0