forgefy-cli 0.1.0__tar.gz → 0.2.0__tar.gz

{forgefy_cli-0.1.0 → forgefy_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgefy-cli
-Version: 0.1.0
+Version: 0.2.0
 Summary: Forgefy CLI — coding assistance with local and hosted model-provider profiles.
 License-Expression: LicenseRef-Proprietary
 Project-URL: Homepage, https://forgefy.app
@@ -27,18 +27,28 @@ coverage depend on the selected model; no model is guaranteed to be best at ever
 
 ## Install
 
+No Python required — installs a standalone `forgefy` binary and puts it on
+your PATH, the same way Ollama's or Claude Code's installer does:
+
+macOS / Linux:
+```sh
+curl -fsSL https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.sh | sh
+```
+
+Windows (PowerShell):
 ```powershell
-pip install forgefy-cli
+irm https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.ps1 | iex
 ```
 
-Not yet published to PyPI? Install straight from GitHub instead:
+Already have Python? `pip`/`pipx` work too — prefer `pipx` over plain `pip`,
+since `pip install` can silently install to a user directory that isn't on
+your PATH:
 
 ```powershell
-pip install git+https://github.com/Polybamz/forgefy-cli.git
+pipx install forgefy-cli
 ```
 
-Either way this creates the `forgefy` executable on your PATH (inside whichever
-Python environment you ran `pip install` in):
+Either way, open a new terminal and you should have the `forgefy` command:
 
 ```powershell
 forgefy --help
@@ -179,12 +189,26 @@ pytest
 
 ## Releasing (maintainers)
 
-CI runs on every push/PR (`.github/workflows/ci.yml`). To publish a new version to PyPI:
+CI runs on every push/PR (`.github/workflows/ci.yml`). One tag produces both
+distribution channels:
 
 1. Bump `version` in `pyproject.toml` and commit.
 2. `git tag vX.Y.Z && git push origin vX.Y.Z`.
-3. `.github/workflows/release.yml` builds, tests, and publishes via PyPI Trusted
-   Publishing — no token stored in the repo. One-time setup: on the PyPI project's
-   *Publishing* settings, add a Trusted Publisher for `Polybamz/forgefy-cli`,
-   workflow `release.yml`, environment `pypi`.
+3. `.github/workflows/release.yml` then, in parallel:
+   - builds and publishes the PyPI package via Trusted Publishing — no token
+     stored in the repo. One-time setup: on the PyPI project's *Publishing*
+     settings, add a Trusted Publisher for `Polybamz/forgefy-cli`, workflow
+     `release.yml`, environment `pypi`.
+   - builds a standalone `forgefy` binary for Windows/macOS/Linux with
+     PyInstaller and attaches them to a GitHub Release for the tag — what
+     `install.sh`/`install.ps1` fetch. No setup needed; uses the repo's
+     built-in `GITHUB_TOKEN`.
+
+To build the standalone binary locally (e.g. to test before tagging):
+
+```powershell
+pip install -e . pyinstaller
+pyinstaller --onefile --name forgefy --paths src --hidden-import anyio._backends._asyncio --distpath dist_native --workpath build_native --specpath build_native build_installer/entrypoint.py
+.\dist_native\forgefy.exe --help
+```
 

forgefy_cli-0.1.0/src/forgefy_cli.egg-info/PKG-INFO → forgefy_cli-0.2.0/README.md

@@ -1,190 +1,193 @@
-Metadata-Version: 2.4
-Name: forgefy-cli
-Version: 0.1.0
-Summary: Forgefy CLI — coding assistance with local and hosted model-provider profiles.
-License-Expression: LicenseRef-Proprietary
-Project-URL: Homepage, https://forgefy.app
-Project-URL: Repository, https://github.com/Polybamz/forgefy-cli
-Classifier: Environment :: Console
-Classifier: Intended Audience :: Developers
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: httpx>=0.27
-Provides-Extra: dev
-Requires-Dist: pytest>=8; extra == "dev"
-Dynamic: license-file
-
-# Forgefy CLI (initial release)
-
-A Python 3.11+ coding-assistance CLI. Language-independent prompts support writing,
-debugging, reviewing, testing, refactoring and planning code. Quality and language
-coverage depend on the selected model; no model is guaranteed to be best at everything.
-
-## Install
-
-```powershell
-pip install forgefy-cli
-```
-
-Not yet published to PyPI? Install straight from GitHub instead:
-
-```powershell
-pip install git+https://github.com/Polybamz/forgefy-cli.git
-```
-
-Either way this creates the `forgefy` executable on your PATH (inside whichever
-Python environment you ran `pip install` in):
-
-```powershell
-forgefy --help
-forgefy config --init
-forgefy providers
-forgefy skills
-forgefy doctor
-```
-
-### Developing locally
-
-```powershell
-git clone https://github.com/Polybamz/forgefy-cli.git
-cd forgefy-cli
-pip install -e ".[dev]"
-```
-
-## Local and hosted models
-
-With Ollama running and a model installed, list exact IDs and choose one:
-
-```powershell
-forgefy models --provider ollama
-forgefy run "Write a Rust function with unit tests that validates an email address" --provider ollama --model YOUR_INSTALLED_MODEL
-```
-
-For OpenRouter, set `OPENROUTER_API_KEY` in your environment, list models, then select
-an exact available ID. Free-tier models and availability are provider-controlled;
-verify pricing before sending requests. Local inference has hardware/energy costs.
-
-```powershell
-forgefy models --provider openrouter
-forgefy run "Explain this Python module and suggest tests" --provider openrouter --model YOUR_MODEL_ID --workspace 'C:\Users\USER\Desktop\polycarp\forgefy-cli' --file src/forgefy_cli/context.py --skill review
-```
-
-Built-in profiles: Ollama, OpenAI, OpenRouter, DeepSeek and Groq. Anthropic and Gemini
-models can be used through OpenRouter when offered there; native Anthropic/Gemini
-protocols are not implemented. No automatic provider or paid-model fallback occurs.
-Compatibility requires the `/models` and `/chat/completions` endpoints; a listed model
-is not necessarily a compatible text-generation model.
-
-## Provider plugins
-
-`forgefy config` prints the config path (normally your home directory's
-`.forgefy/config.toml`). `FORGEFY_CONFIG` can select an alternate file.
-Add declarative OpenAI-compatible provider profiles:
-
-```toml
-default_provider = "local_server"
-default_model = "your-model-id"
-
-[providers.local_server]
-base_url = "http://localhost:1234/v1"
-api_key_env = ""
-
-[providers.company]
-base_url = "https://models.example.com/v1"
-api_key_env = "COMPANY_MODEL_KEY"
-```
-
-Never store keys directly in configuration. Custom profiles cannot override built-in
-names. HTTPS is required for non-loopback endpoints. Only configure servers you trust:
-the chosen server receives your prompt, explicit file context, and its configured key.
-These plugins are configuration, not executable Python code or an MCP integration.
-
-## Skills and context
-
-Choose `--skill code|debug|review|test|refactor|plan`. Repeat `--skill-file` to include
-trusted UTF-8 Markdown instructions. Repeat `--file` to send workspace-relative source
-files. Use a prompt of `-` for standard input. No repository files are sent implicitly.
-Files must resolve within the workspace. Common credential paths are excluded, but this
-is not a secret scanner: review every file and prompt before sending. Requests have a
-120,000-character input cap; individual models may require much smaller inputs.
-
-## Interactive chat
-
-```powershell
-& 'C:\Users\USER\Desktop\polycarp\.venv\Scripts\forgefy.exe' chat --provider ollama --model llama3:latest
-```
-
-Chat retains conversation history in memory for follow-up questions. `/new` clears it,
-`/help` lists commands, and `/exit` or `/quit` ends the session. EOF exits normally;
-Ctrl+C cancels. History is not saved to disk. Each request resends retained history,
-so hosted-provider usage can grow each turn. No automatic paid fallback occurs.
-Oldest complete user/assistant pairs are omitted when conversational content exceeds
-120,000 characters; system/skill instructions are additional. This is a character cap,
-not a token budget. Failed requests preserve prior history. Chat accepts single-line
-turns and skill plugins; explicit `--file` context is currently supported by `run` only.
-
-## Approved file editing
-
-`forgefy edit` can modify explicitly selected, **existing** UTF-8 files with a model
-supporting OpenAI-compatible tool calling. `run` and `chat` remain suggestion-only.
-In an interactive terminal, for example:
-
-```powershell
-& 'C:\Users\USER\Desktop\polycarp\.venv\Scripts\forgefy.exe' edit "Improve error handling in this module" --provider ollama --model YOUR_TOOL_CALLING_MODEL --workspace 'C:\Users\USER\Desktop\polycarp\forgefy-cli' --file src/forgefy_cli/context.py
-```
-
-Review the selected files for secrets before starting: the model can read their contents
-and send them to the selected provider without further read approval. Each replacement
-shows a complete diff and requires typing `yes`. There is no automatic approval flag.
-The executor requires a prior read, an exact single match, and unchanged contents before
-and after approval. Updates use a sibling temporary file and atomic replacement.
-
-Only files named by repeatable `--file` options are accessible. Hidden paths, common
-credential files, symlinks, junctions, hardlinks and nonregular files are rejected.
-Files and replacements are limited to 32,000 bytes; oversized diffs are rejected, not
-truncated for approval. These checks are not a secret scanner or an OS security sandbox.
-Use a trusted workspace without concurrent writers: a small filesystem race window
-remains between validation and replacement. Atomic replacement preserves mode bits,
-not necessarily all filesystem metadata or custom ACLs.
-
-The default limit is 12 model requests (`--max-turns` accepts 1–30), with a
-120,000-character serialized conversation cap. Exit code 2 means a limit stopped an
-incomplete session; 1 indicates an error and 130 indicates cancellation. Exit code 0
-means the model finished, not that its changes are correct or tested. Applied edits
-remain on disk if the session stops or fails—there is no session-wide rollback.
-Use version control or backups and review the printed list of files actually changed.
-
-Editing currently supports replacements only: no file creation, deletion, shell commands,
-or custom skill files. Its integration tests use mocked model responses and temporary
-files; live model-driven editing has not been verified.
-
-## Current boundaries
-
-This release can apply approved replacements, but it does **not** execute
-commands, run tests on generated code, stream tokens, persist chat history, or connect
-to the Forgefy admin catalogue. Provider profiles and skill files are the initial plugin
-interfaces, not a full autonomous coding-agent system. Output is untrusted: inspect it
-before running anything. Tests use mocked HTTP, not live model quality benchmarks.
-
-## Tests
-
-```powershell
-pytest
-```
-
-## Releasing (maintainers)
-
-CI runs on every push/PR (`.github/workflows/ci.yml`). To publish a new version to PyPI:
-
-1. Bump `version` in `pyproject.toml` and commit.
-2. `git tag vX.Y.Z && git push origin vX.Y.Z`.
-3. `.github/workflows/release.yml` builds, tests, and publishes via PyPI Trusted
-   Publishing — no token stored in the repo. One-time setup: on the PyPI project's
-   *Publishing* settings, add a Trusted Publisher for `Polybamz/forgefy-cli`,
-   workflow `release.yml`, environment `pypi`.
-
+# Forgefy CLI (initial release)
+
+A Python 3.11+ coding-assistance CLI. Language-independent prompts support writing,
+debugging, reviewing, testing, refactoring and planning code. Quality and language
+coverage depend on the selected model; no model is guaranteed to be best at everything.
+
+## Install
+
+No Python required — installs a standalone `forgefy` binary and puts it on
+your PATH, the same way Ollama's or Claude Code's installer does:
+
+macOS / Linux:
+```sh
+curl -fsSL https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.sh | sh
+```
+
+Windows (PowerShell):
+```powershell
+irm https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.ps1 | iex
+```
+
+Already have Python? `pip`/`pipx` work too — prefer `pipx` over plain `pip`,
+since `pip install` can silently install to a user directory that isn't on
+your PATH:
+
+```powershell
+pipx install forgefy-cli
+```
+
+Either way, open a new terminal and you should have the `forgefy` command:
+
+```powershell
+forgefy --help
+forgefy config --init
+forgefy providers
+forgefy skills
+forgefy doctor
+```
+
+### Developing locally
+
+```powershell
+git clone https://github.com/Polybamz/forgefy-cli.git
+cd forgefy-cli
+pip install -e ".[dev]"
+```
+
+## Local and hosted models
+
+With Ollama running and a model installed, list exact IDs and choose one:
+
+```powershell
+forgefy models --provider ollama
+forgefy run "Write a Rust function with unit tests that validates an email address" --provider ollama --model YOUR_INSTALLED_MODEL
+```
+
+For OpenRouter, set `OPENROUTER_API_KEY` in your environment, list models, then select
+an exact available ID. Free-tier models and availability are provider-controlled;
+verify pricing before sending requests. Local inference has hardware/energy costs.
+
+```powershell
+forgefy models --provider openrouter
+forgefy run "Explain this Python module and suggest tests" --provider openrouter --model YOUR_MODEL_ID --workspace 'C:\Users\USER\Desktop\polycarp\forgefy-cli' --file src/forgefy_cli/context.py --skill review
+```
+
+Built-in profiles: Ollama, OpenAI, OpenRouter, DeepSeek and Groq. Anthropic and Gemini
+models can be used through OpenRouter when offered there; native Anthropic/Gemini
+protocols are not implemented. No automatic provider or paid-model fallback occurs.
+Compatibility requires the `/models` and `/chat/completions` endpoints; a listed model
+is not necessarily a compatible text-generation model.
+
+## Provider plugins
+
+`forgefy config` prints the config path (normally your home directory's
+`.forgefy/config.toml`). `FORGEFY_CONFIG` can select an alternate file.
+Add declarative OpenAI-compatible provider profiles:
+
+```toml
+default_provider = "local_server"
+default_model = "your-model-id"
+
+[providers.local_server]
+base_url = "http://localhost:1234/v1"
+api_key_env = ""
+
+[providers.company]
+base_url = "https://models.example.com/v1"
+api_key_env = "COMPANY_MODEL_KEY"
+```
+
+Never store keys directly in configuration. Custom profiles cannot override built-in
+names. HTTPS is required for non-loopback endpoints. Only configure servers you trust:
+the chosen server receives your prompt, explicit file context, and its configured key.
+These plugins are configuration, not executable Python code or an MCP integration.
+
+## Skills and context
+
+Choose `--skill code|debug|review|test|refactor|plan`. Repeat `--skill-file` to include
+trusted UTF-8 Markdown instructions. Repeat `--file` to send workspace-relative source
+files. Use a prompt of `-` for standard input. No repository files are sent implicitly.
+Files must resolve within the workspace. Common credential paths are excluded, but this
+is not a secret scanner: review every file and prompt before sending. Requests have a
+120,000-character input cap; individual models may require much smaller inputs.
+
+## Interactive chat
+
+```powershell
+& 'C:\Users\USER\Desktop\polycarp\.venv\Scripts\forgefy.exe' chat --provider ollama --model llama3:latest
+```
+
+Chat retains conversation history in memory for follow-up questions. `/new` clears it,
+`/help` lists commands, and `/exit` or `/quit` ends the session. EOF exits normally;
+Ctrl+C cancels. History is not saved to disk. Each request resends retained history,
+so hosted-provider usage can grow each turn. No automatic paid fallback occurs.
+Oldest complete user/assistant pairs are omitted when conversational content exceeds
+120,000 characters; system/skill instructions are additional. This is a character cap,
+not a token budget. Failed requests preserve prior history. Chat accepts single-line
+turns and skill plugins; explicit `--file` context is currently supported by `run` only.
+
+## Approved file editing
+
+`forgefy edit` can modify explicitly selected, **existing** UTF-8 files with a model
+supporting OpenAI-compatible tool calling. `run` and `chat` remain suggestion-only.
+In an interactive terminal, for example:
+
+```powershell
+& 'C:\Users\USER\Desktop\polycarp\.venv\Scripts\forgefy.exe' edit "Improve error handling in this module" --provider ollama --model YOUR_TOOL_CALLING_MODEL --workspace 'C:\Users\USER\Desktop\polycarp\forgefy-cli' --file src/forgefy_cli/context.py
+```
+
+Review the selected files for secrets before starting: the model can read their contents
+and send them to the selected provider without further read approval. Each replacement
+shows a complete diff and requires typing `yes`. There is no automatic approval flag.
+The executor requires a prior read, an exact single match, and unchanged contents before
+and after approval. Updates use a sibling temporary file and atomic replacement.
+
+Only files named by repeatable `--file` options are accessible. Hidden paths, common
+credential files, symlinks, junctions, hardlinks and nonregular files are rejected.
+Files and replacements are limited to 32,000 bytes; oversized diffs are rejected, not
+truncated for approval. These checks are not a secret scanner or an OS security sandbox.
+Use a trusted workspace without concurrent writers: a small filesystem race window
+remains between validation and replacement. Atomic replacement preserves mode bits,
+not necessarily all filesystem metadata or custom ACLs.
+
+The default limit is 12 model requests (`--max-turns` accepts 1–30), with a
+120,000-character serialized conversation cap. Exit code 2 means a limit stopped an
+incomplete session; 1 indicates an error and 130 indicates cancellation. Exit code 0
+means the model finished, not that its changes are correct or tested. Applied edits
+remain on disk if the session stops or fails—there is no session-wide rollback.
+Use version control or backups and review the printed list of files actually changed.
+
+Editing currently supports replacements only: no file creation, deletion, shell commands,
+or custom skill files. Its integration tests use mocked model responses and temporary
+files; live model-driven editing has not been verified.
+
+## Current boundaries
+
+This release can apply approved replacements, but it does **not** execute
+commands, run tests on generated code, stream tokens, persist chat history, or connect
+to the Forgefy admin catalogue. Provider profiles and skill files are the initial plugin
+interfaces, not a full autonomous coding-agent system. Output is untrusted: inspect it
+before running anything. Tests use mocked HTTP, not live model quality benchmarks.
+
+## Tests
+
+```powershell
+pytest
+```
+
+## Releasing (maintainers)
+
+CI runs on every push/PR (`.github/workflows/ci.yml`). One tag produces both
+distribution channels:
+
+1. Bump `version` in `pyproject.toml` and commit.
+2. `git tag vX.Y.Z && git push origin vX.Y.Z`.
+3. `.github/workflows/release.yml` then, in parallel:
+   - builds and publishes the PyPI package via Trusted Publishing — no token
+     stored in the repo. One-time setup: on the PyPI project's *Publishing*
+     settings, add a Trusted Publisher for `Polybamz/forgefy-cli`, workflow
+     `release.yml`, environment `pypi`.
+   - builds a standalone `forgefy` binary for Windows/macOS/Linux with
+     PyInstaller and attaches them to a GitHub Release for the tag — what
+     `install.sh`/`install.ps1` fetch. No setup needed; uses the repo's
+     built-in `GITHUB_TOKEN`.
+
+To build the standalone binary locally (e.g. to test before tagging):
+
+```powershell
+pip install -e . pyinstaller
+pyinstaller --onefile --name forgefy --paths src --hidden-import anyio._backends._asyncio --distpath dist_native --workpath build_native --specpath build_native build_installer/entrypoint.py
+.\dist_native\forgefy.exe --help
+```
+

{forgefy_cli-0.1.0 → forgefy_cli-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgefy-cli"
-version = "0.1.0"
+version = "0.2.0"
 description = "Forgefy CLI — coding assistance with local and hosted model-provider profiles."
 readme = "README.md"
 requires-python = ">=3.11"

forgefy_cli-0.2.0/src/forgefy_cli/auth.py

@@ -0,0 +1,65 @@
+"""Local storage for the credential `forgefy login` obtains.
+
+config.py is explicit that provider credentials are read only from the
+environment and never stored in config.toml. This module doesn't relax that:
+Provider.headers() still reads only os.environ. `forgefy login` just gives
+one more, opt-in way to populate $FORGEFY_API_KEY for the process — from a
+single-purpose file the user created by explicitly running `login`, kept out
+of config.toml and permissioned as tightly as the OS allows, the same
+convention `gh`/`docker`/`npm` use for their own login credential.
+"""
+from __future__ import annotations
+
+import json
+import os
+import stat
+from pathlib import Path
+
+
+def credentials_path() -> Path:
+    return Path(
+        os.environ.get("FORGEFY_CREDENTIALS", str(Path.home() / ".forgefy" / "credentials.json"))
+    ).expanduser()
+
+
+def save_credentials(api_key: str) -> Path:
+    path = credentials_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps({"api_key": api_key}), encoding="utf-8")
+    try:
+        os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)  # 0600 — no-op on Windows, effective on POSIX
+    except OSError:
+        pass  # best-effort; some filesystems (e.g. certain network mounts) reject chmod
+    return path
+
+
+def load_credentials() -> str | None:
+    path = credentials_path()
+    if not path.exists():
+        return None
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError, UnicodeDecodeError):
+        return None
+    key = data.get("api_key") if isinstance(data, dict) else None
+    return key if isinstance(key, str) and key else None
+
+
+def clear_credentials() -> bool:
+    path = credentials_path()
+    if path.exists():
+        path.unlink()
+        return True
+    return False
+
+
+def bootstrap_env() -> None:
+    """Populate $FORGEFY_API_KEY from the stored credential if not already set.
+
+    Called once at CLI startup, before providers are resolved. An explicitly
+    exported FORGEFY_API_KEY always wins over a stored one.
+    """
+    if not os.environ.get("FORGEFY_API_KEY"):
+        key = load_credentials()
+        if key:
+            os.environ["FORGEFY_API_KEY"] = key

{forgefy_cli-0.1.0 → forgefy_cli-0.2.0}/src/forgefy_cli/cli.py

@@ -8,6 +8,7 @@ import sys
 
 import httpx
 
+from .auth import bootstrap_env
 from .chat import chat_loop
 from .config import TEMPLATE, config_path, load_config
 from .context import build_prompt
@@ -43,6 +44,9 @@ def parser() -> argparse.ArgumentParser:
     edit.add_argument("--max-turns", type=int, default=12, help="Maximum model requests (1–30; default 12)")
     models = sub.add_parser("models", help="List live provider model IDs (availability and pricing vary)")
     models.add_argument("--provider")
+    login = sub.add_parser("login", help="Sign in with your Forgefy account via the browser (device code)")
+    login.add_argument("--api-url", help="Override FORGEFY_API_URL for this login only")
+    sub.add_parser("logout", help="Remove the locally stored Forgefy account credential")
     sub.add_parser("providers", help="List built-in and configured provider plugins")
     sub.add_parser("skills", help="List built-in coding skills")
     sub.add_parser("doctor", help="Check configuration and key presence without sending requests")
@@ -53,7 +57,15 @@ def parser() -> argparse.ArgumentParser:
 
 def main(argv: list[str] | None = None) -> int:
     args = parser().parse_args(argv)
+    bootstrap_env()
     try:
+        if args.command == "login":
+            from .login import device_login
+            with httpx.Client(timeout=15) as http:
+                return device_login(http, api_url=args.api_url)
+        if args.command == "logout":
+            from .login import logout
+            return logout()
         if args.command == "config":
             path = config_path()
             if args.init:

{forgefy_cli-0.1.0 → forgefy_cli-0.2.0}/src/forgefy_cli/config.py

@@ -24,10 +24,16 @@ class Provider:
         return {"Authorization": f"Bearer {key}"}
 
 
-# Same $FORGEFY_API_URL convention as the official SDKs (sdks/python,
-# sdks/typescript) and the self-hosted docs — the API has no single fixed
-# public host, so the origin is always read from the environment.
-_FORGEFY_API_URL = os.environ.get("FORGEFY_API_URL", "http://localhost:5000").rstrip("/")
+def forgefy_api_url() -> str:
+    """Return the Forgefy API origin — same $FORGEFY_API_URL convention as the
+    official SDKs (sdks/python, sdks/typescript) and the self-hosted docs, since
+    the API has no single fixed public host.
+
+    Read fresh (not cached at import time) so `forgefy login` picks up a
+    `--api-url` override passed after the process has already started.
+    """
+    return os.environ.get("FORGEFY_API_URL", "http://localhost:5000").rstrip("/")
+
 
 BUILTINS = {
     "ollama": Provider("ollama", "http://localhost:11434/v1"),
@@ -39,8 +45,10 @@ BUILTINS = {
     # Developers page — the same fgy_live_… keys and monthly token budget the
     # extract API and web builds use — and `export FORGEFY_API_KEY=fgy_live_…`.
     # Set FORGEFY_API_URL too if you're not on the default host (self-hosted,
-    # local dev). See app/api/v1/cli.py in forgefy-backend.
-    "forgefy": Provider("forgefy", f"{_FORGEFY_API_URL}/api/v1/cli", "FORGEFY_API_KEY"),
+    # local dev). Run `forgefy login` to fill FORGEFY_API_KEY automatically
+    # instead of copying a key from the Developers page by hand. See
+    # app/api/v1/cli.py in forgefy-backend.
+    "forgefy": Provider("forgefy", f"{forgefy_api_url()}/api/v1/cli", "FORGEFY_API_KEY"),
 }
 
 TEMPLATE = '''# Keep API keys in environment variables, never here.