teardrop-cli 0.3.0__tar.gz → 0.3.2__tar.gz

{teardrop_cli-0.3.0 → teardrop_cli-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: teardrop-cli
-Version: 0.3.0
+Version: 0.3.2
 Summary: Command-line interface for the Teardrop AI agent platform
 Project-URL: Homepage, https://github.com/teardrop-ai/teardrop-cli
 Project-URL: Repository, https://github.com/teardrop-ai/teardrop-cli
@@ -45,7 +45,7 @@ Requires-Dist: httpx>=0.27
 Requires-Dist: keyring>=25.0
 Requires-Dist: platformdirs>=4.0
 Requires-Dist: rich>=13.0
-Requires-Dist: teardrop-sdk>=0.2.0
+Requires-Dist: teardrop-sdk>=0.3.0
 Requires-Dist: tomli-w>=1.0
 Requires-Dist: typer>=0.12
 Provides-Extra: dev
@@ -86,21 +86,27 @@ Requires Python ≥ 3.11.
 
 ## 60-Second Quickstart
 
-The wizard walks you through sign-in, BYOK LLM setup, and your first agent run or scaffolded tool:
+The wizard walks you through sign-in, optional BYOK LLM setup, and your first agent run or scaffolded tool:
 
 ```bash
 teardrop quickstart
 ```
 
+Quickstart keeps local tool scaffolding and public marketplace browsing available
+without sign-in. A saved session is verified when you choose an agent run; if it
+is stale, the wizard offers sign-in again before asking for a prompt or payment
+confirmation. Environment credentials must be updated or unset when they are
+rejected because they take precedence over interactive login.
+
 Prefer the manual path? Pick a sign-in method:
 
 ```bash
-# Wallet-first (no email needed) — generates a wallet on first run if you don't have one
-teardrop auth login --siwe --generate-wallet
-
 # Email + password
 teardrop auth signup --email you@example.com --org-name acme
 
+# Wallet-first (no email needed) — generates a wallet on first run if you don't have one
+teardrop auth login --siwe --generate-wallet
+
 # Already have an account
 teardrop auth login --email you@example.com
 ```
@@ -143,7 +149,7 @@ Scaffold a starter spec, edit it, and publish:
 ```bash
 teardrop tools init my_scraper       # writes ./tool.json
 $EDITOR tool.json                    # set webhook_url, schema, price
-teardrop tools probe my_scraper      # test webhook health before publishing
+teardrop tools probe --from-file tool.json  # test webhook health before publishing
 teardrop tools publish --from-file tool.json \
     --settlement-wallet 0xYourChecksumAddress
 ```
@@ -156,7 +162,7 @@ teardrop tools publish
 
 Tool name rules: `^[a-z][a-z0-9_]*$`, ≤ 64 chars. Prices are in atomic USDC (6 decimals): `5000` = **$0.005** per call. Settlement wallet is required once before your first payout.
 
-Test your webhook before publishing with `teardrop tools probe <tool-name>`. Optionally pass `--auth-header-name` and `--auth-header-value` if your webhook requires auth, or use `--method` and `--payload` to customize the probe request.
+Test a local webhook before publishing with `teardrop tools probe --from-file tool.json`; the spec's method and auth settings are used by default. After publishing, use `teardrop tools probe <tool-name>`. Pass `--auth-header-name` and `--auth-header-value` to override auth settings, or use `--method` and `--payload` to customize the probe request.
 
 Manage existing tools: `teardrop tools list | info | update | pause | delete | probe`. Full reference: [docs/cli-reference.md](docs/cli-reference.md#tool-management).
 
@@ -295,6 +301,12 @@ teardrop llm-config set --provider google --model gemini-3-flash --routing speed
 
 Pipe a key from stdin to keep it out of shell history: `--byok-key -`. See [docs/cli-reference.md](docs/cli-reference.md#llm-configuration) for advanced tuning, BYOK details, and benchmarks.
 
+### LLM credit model
+
+Non-BYOK organizations use Teardrop's shared provider keys. Platform credits or x402 cover the model token costs and Teardrop platform fee. BYOK organizations pay their model provider directly through their own encrypted key, but still need platform credits or x402 for the Teardrop orchestration fee. BYOK uses the configured model and does not use pooled smart routing.
+
+New email-authenticated organizations may receive optional promotional credit after verifying their email when the program is enabled. Eligibility and availability are server-configured; SIWE users and marketplace author tools are excluded. A real top-up removes promotional restrictions.
+
 ---
 
 ## Browse the Marketplace

{teardrop_cli-0.3.0 → teardrop_cli-0.3.2}/README.md

@@ -26,21 +26,27 @@ Requires Python ≥ 3.11.
 
 ## 60-Second Quickstart
 
-The wizard walks you through sign-in, BYOK LLM setup, and your first agent run or scaffolded tool:
+The wizard walks you through sign-in, optional BYOK LLM setup, and your first agent run or scaffolded tool:
 
 ```bash
 teardrop quickstart
 ```
 
+Quickstart keeps local tool scaffolding and public marketplace browsing available
+without sign-in. A saved session is verified when you choose an agent run; if it
+is stale, the wizard offers sign-in again before asking for a prompt or payment
+confirmation. Environment credentials must be updated or unset when they are
+rejected because they take precedence over interactive login.
+
 Prefer the manual path? Pick a sign-in method:
 
 ```bash
-# Wallet-first (no email needed) — generates a wallet on first run if you don't have one
-teardrop auth login --siwe --generate-wallet
-
 # Email + password
 teardrop auth signup --email you@example.com --org-name acme
 
+# Wallet-first (no email needed) — generates a wallet on first run if you don't have one
+teardrop auth login --siwe --generate-wallet
+
 # Already have an account
 teardrop auth login --email you@example.com
 ```
@@ -83,7 +89,7 @@ Scaffold a starter spec, edit it, and publish:
 ```bash
 teardrop tools init my_scraper       # writes ./tool.json
 $EDITOR tool.json                    # set webhook_url, schema, price
-teardrop tools probe my_scraper      # test webhook health before publishing
+teardrop tools probe --from-file tool.json  # test webhook health before publishing
 teardrop tools publish --from-file tool.json \
     --settlement-wallet 0xYourChecksumAddress
 ```
@@ -96,7 +102,7 @@ teardrop tools publish
 
 Tool name rules: `^[a-z][a-z0-9_]*$`, ≤ 64 chars. Prices are in atomic USDC (6 decimals): `5000` = **$0.005** per call. Settlement wallet is required once before your first payout.
 
-Test your webhook before publishing with `teardrop tools probe <tool-name>`. Optionally pass `--auth-header-name` and `--auth-header-value` if your webhook requires auth, or use `--method` and `--payload` to customize the probe request.
+Test a local webhook before publishing with `teardrop tools probe --from-file tool.json`; the spec's method and auth settings are used by default. After publishing, use `teardrop tools probe <tool-name>`. Pass `--auth-header-name` and `--auth-header-value` to override auth settings, or use `--method` and `--payload` to customize the probe request.
 
 Manage existing tools: `teardrop tools list | info | update | pause | delete | probe`. Full reference: [docs/cli-reference.md](docs/cli-reference.md#tool-management).
 
@@ -235,6 +241,12 @@ teardrop llm-config set --provider google --model gemini-3-flash --routing speed
 
 Pipe a key from stdin to keep it out of shell history: `--byok-key -`. See [docs/cli-reference.md](docs/cli-reference.md#llm-configuration) for advanced tuning, BYOK details, and benchmarks.
 
+### LLM credit model
+
+Non-BYOK organizations use Teardrop's shared provider keys. Platform credits or x402 cover the model token costs and Teardrop platform fee. BYOK organizations pay their model provider directly through their own encrypted key, but still need platform credits or x402 for the Teardrop orchestration fee. BYOK uses the configured model and does not use pooled smart routing.
+
+New email-authenticated organizations may receive optional promotional credit after verifying their email when the program is enabled. Eligibility and availability are server-configured; SIWE users and marketplace author tools are excluded. A real top-up removes promotional restrictions.
+
 ---
 
 ## Browse the Marketplace

{teardrop_cli-0.3.0 → teardrop_cli-0.3.2}/docs/cli-reference.md

@@ -39,7 +39,7 @@ teardrop auth login --client-id <id> --client-secret <secret>
 teardrop auth login --token <jwt>
 
 # Sign-In With Ethereum (EIP-4361) — pick one source for the key:
-teardrop auth login --siwe                              # interactive hidden prompt
+teardrop auth login --siwe                              # hidden prompt when no other source is supplied
 teardrop auth login --siwe --key-file ./wallet.key      # read once, never persisted
 teardrop auth login --siwe --generate-wallet            # creates a fresh wallet
 TEARDROP_SIWE_PRIVATE_KEY=0x... teardrop auth login --siwe   # CI / non-interactive
@@ -72,8 +72,9 @@ teardrop auth logout               # revoke refresh token + clear stored credent
 | 1 | `TEARDROP_API_KEY` env var (static JWT) |
 | 2 | `TEARDROP_EMAIL` + `TEARDROP_SECRET` env vars |
 | 3 | `TEARDROP_CLIENT_ID` + `TEARDROP_CLIENT_SECRET` env vars |
-| 4 | `access_token` in `~/.teardrop/config.toml` |
-| 5 | System keyring (email + secret, or client credentials) |
+| 4 | System keyring (email + secret, or client credentials) |
+| 5 | `access_token` in `~/.teardrop/config.toml` |
+| 6 | Legacy `auth.token` in `~/.teardrop/config.toml` |
 
 ---
 
@@ -123,17 +124,18 @@ will start a fresh thread.
 
 ## Schedules
 
-Recurring interval-based runs:
+Recurring interval-based runs. Most commands accept `--json` to return raw structured payloads for pipeline automation:
 
 ```bash
 teardrop schedules create \
   --name hourly-briefing \
   --prompt "Summarize open incidents" \
-  --interval-seconds 3600
+  --interval-seconds 3600 \
+  --json
 
-teardrop schedules list
-teardrop schedules get <schedule-id>
-teardrop schedules update <schedule-id> --enabled false
+teardrop schedules list --json
+teardrop schedules get <schedule-id> --json
+teardrop schedules update <schedule-id> --enabled false --json
 teardrop schedules update <schedule-id> --clear-callback-url
 teardrop schedules runs <schedule-id> --limit 50 --json
 teardrop schedules delete <schedule-id>
@@ -150,24 +152,25 @@ Run history output includes: `Run ID`, `Status`, `Cost (USDC)`, `Error Message`,
 
 ## Event Triggers
 
-Reactive runs exposed as signed public webhook endpoints:
+Reactive runs exposed as signed public webhook endpoints. Commands support a `--json` option to output formatted shapes (with creation and rotation payloads securely exposing the one-time dispatch secret):
 
 ```bash
 teardrop event-triggers create \
   --name inbound-orders \
-  --prompt "Validate and process this order payload"
+  --prompt "Validate and process this order payload" \
+  --json
 
-teardrop event-triggers list
-teardrop event-triggers get <trigger-id>
-teardrop event-triggers update <trigger-id> --enabled false
+teardrop event-triggers list --json
+teardrop event-triggers get <trigger-id> --json
+teardrop event-triggers update <trigger-id> --enabled false --json
 teardrop event-triggers update <trigger-id> --callback-url https://example.com/hook
 teardrop event-triggers runs <trigger-id> --limit 50 --json
-teardrop event-triggers rotate-secret <trigger-id>
+teardrop event-triggers rotate-secret <trigger-id> --json
 teardrop event-triggers delete <trigger-id>
 teardrop event-triggers delete <trigger-id> --yes
 ```
 
-`create` and `rotate-secret` display the signing secret once. Store it immediately; subsequent `list` and `get` calls do not return the plaintext secret.
+`create` and `rotate-secret` display the signing secret once (both inside non-JSON stderr summaries and their corresponding use-once JSON attributes). Store it immediately; subsequent `list`, `get`, or `update` calls permanently exclude the plaintext secret.
 
 Non-JSON list output includes: `ID`, `Name`, `Enabled`, `Kind`, `Consecutive Failures`, `Last Run At`.
 
@@ -193,6 +196,12 @@ The CLI does not support direct top-ups. To add credits or manage your billing m
 
 If you run out of credits during an agent run, the agent will pause and provide this link.
 
+### LLM credit model
+
+Non-BYOK organizations use Teardrop's shared provider keys and need credits or x402 for model token costs plus the platform fee. BYOK organizations pay their provider directly through their encrypted key, but still need credits or x402 for the Teardrop orchestration fee. BYOK uses the configured model; pooled smart routing is disabled.
+
+Optional promotional credit may be granted after successful email verification when the server-side program is enabled. It is not available to SIWE users or marketplace author tools, and a real top-up removes promotional restrictions. The CLI does not assume eligibility or a fixed promotional amount.
+
 ---
 
 ## Tool Management
@@ -264,7 +273,13 @@ teardrop tools delete get_weather --yes              # skip confirmation
 
 ### Test webhook health
 
-Before publishing or after updating a webhook URL, test it:
+Before publishing, test a local spec without authentication or an API lookup:
+
+```bash
+teardrop tools probe --from-file tool.json
+```
+
+After publishing or updating a webhook URL, test the registered tool:
 
 ```bash
 teardrop tools probe get_weather                    # test default POST request
@@ -287,6 +302,8 @@ teardrop tools probe get_weather --method GET
 teardrop tools probe get_weather --payload '{"test": "data"}'
 ```
 
+For `--from-file`, the spec's `webhook_method`, `auth_header_name`, and `auth_header_value` are used by default. Explicit probe flags override them.
+
 Exit code: 0 on success (2xx–3xx), 1 on timeout/5xx/connection error. Warning (exit 0) on 4xx responses (e.g., auth failures).
 
 ---
@@ -352,7 +369,7 @@ teardrop llm-config set \
   --timeout-seconds 60
 ```
 
-**Providers:** `openrouter`, `google`, `anthropic`
+**Providers:** `openrouter`, `google`, `anthropic`, `openai`
 **Routing:** `default` · `cost` · `speed` · `quality`
 **Validation:** temperature 0.0–2.0 · max tokens 1–200,000 · timeout ≥ 1 s
 
@@ -373,6 +390,8 @@ Get-Content "$key_file" | teardrop llm-config set `
 teardrop llm-config set --provider anthropic --model claude-sonnet-4-6 --clear-key
 ```
 
+BYOK keys are encrypted by the platform and used only for the configured provider/model. Teardrop still charges the orchestration fee through credits or x402; it does not charge Teardrop for the provider's model usage.
+
 ---
 
 ## MCP Servers

{teardrop_cli-0.3.0 → teardrop_cli-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "teardrop-cli"
-version = "0.3.0"
+version = "0.3.2"
 description = "Command-line interface for the Teardrop AI agent platform"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
-    "teardrop-sdk>=0.2.0",
+    "teardrop-sdk>=0.3.0",
     "typer>=0.12",
     "rich>=13.0",
     "platformdirs>=4.0",

{teardrop_cli-0.3.0 → teardrop_cli-0.3.2}/src/teardrop_cli/commands/auth.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import asyncio
 import os
 import re
+import sys
 from datetime import UTC, datetime
 from pathlib import Path
 from typing import Annotated
@@ -319,7 +320,11 @@ def login(
     print_success(f"Logged in as [bold]{email}[/bold]{org_label}")
 
 
-def interactive_reauthenticate(base_url: str | None = None) -> bool:
+def interactive_reauthenticate(
+    base_url: str | None = None,
+    *,
+    warning_message: str = "Your session expired during this command.",
+) -> bool:
     """Prompt the user to sign in again after an expired session.
 
     Returns ``True`` when authentication completed and the caller should retry,
@@ -328,7 +333,7 @@ def interactive_reauthenticate(base_url: str | None = None) -> bool:
     from teardrop_cli import config
     from teardrop_cli.formatting import console, print_warning
 
-    print_warning("Your session expired during this command.")
+    print_warning(warning_message)
     console.print("\n[bold]Sign in to continue:[/bold]")
     console.print("  [cyan]0[/cyan]  Cancel")
     console.print("  [cyan]1[/cyan]  Email + password [recommended]")
@@ -375,7 +380,7 @@ def _resolve_siwe_private_key(
         try:
             from eth_account import Account
         except ImportError:
-            print_error("eth-account is required.", hint="pip install 'teardrop-cli[siwe]'")
+            print_error("eth-account is required.", hint="pip install teardrop-cli")
             raise typer.Exit(1) from None
         acct = Account.create()
         from rich.panel import Panel
@@ -406,16 +411,21 @@ def _resolve_siwe_private_key(
     if env_key := os.environ.get("TEARDROP_SIWE_PRIVATE_KEY"):
         return env_key, False
 
-    print_error(
-        "No Ethereum private key found.",
-        hint=(
-            "Provide one via:\n"
-            "  • TEARDROP_SIWE_PRIVATE_KEY env var\n"
-            "  • --key-file PATH\n"
-            "  • --generate-wallet (creates a new wallet)"
-        ),
+    hint = (
+        "Provide one via:\n"
+        "  • TEARDROP_SIWE_PRIVATE_KEY env var\n"
+        "  • --key-file PATH\n"
+        "  • --generate-wallet (creates a new wallet)"
     )
-    raise typer.Exit(1)
+    if not sys.stdin.isatty():
+        print_error("No Ethereum private key found.", hint=hint)
+        raise typer.Exit(1)
+
+    private_key = typer.prompt("Ethereum private key", hide_input=True).strip()
+    if not private_key:
+        print_error("No Ethereum private key provided.", hint=hint)
+        raise typer.Exit(1)
+    return private_key, False
 
 
 async def _siwe_auth_async(

{teardrop_cli-0.3.0 → teardrop_cli-0.3.2}/src/teardrop_cli/commands/quickstart.py

@@ -7,6 +7,8 @@ orchestration: each step delegates to an existing command implementation.
 
 from __future__ import annotations
 
+import asyncio
+
 import click
 import typer
 
@@ -20,6 +22,110 @@ def app(base_url: str | None) -> None:
     _run_quickstart(base_url)
 
 
+def _is_authentication_failure(exc: BaseException) -> bool:
+    from teardrop import AuthenticationError
+
+    return isinstance(exc, AuthenticationError) or getattr(exc, "status_code", None) == 401
+
+
+def _verify_saved_session(
+    base_url: str | None,
+    source: str,
+    *,
+    allow_recovery: bool = True,
+) -> bool:
+    from teardrop_cli import config
+    from teardrop_cli.formatting import print_error, spinner
+
+    try:
+        client = config.get_client(base_url)
+
+        async def _fetch_identity():
+            try:
+                return await client.get_me()
+            finally:
+                await client.close()
+
+        with spinner("Verifying saved credentials…"):
+            identity = asyncio.run(_fetch_identity())
+    except (click.exceptions.Exit, SystemExit):
+        return False
+    except Exception as exc:  # noqa: BLE001
+        if _is_authentication_failure(exc):
+            if not allow_recovery:
+                print_error(
+                    "Sign-in failed.",
+                    hint="Run [bold]teardrop auth login[/bold] to try again.",
+                )
+                return False
+            if source.startswith("env:"):
+                print_error(
+                    "Saved environment credentials were rejected.",
+                    hint=(
+                        "Update or unset TEARDROP_API_KEY, TEARDROP_EMAIL, or "
+                        "TEARDROP_CLIENT_ID, then run [bold]teardrop auth login[/bold]."
+                    ),
+                )
+                return False
+
+            from teardrop_cli.commands.auth import interactive_reauthenticate
+
+            try:
+                if not interactive_reauthenticate(
+                    base_url=base_url,
+                    warning_message="Your saved session is no longer valid. Sign in again to continue.",
+                ):
+                    return False
+            except (click.exceptions.Exit, SystemExit):
+                return False
+
+            refreshed_source = config.detect_credential_source()
+            if refreshed_source is None:
+                print_error("Sign-in did not produce a saved session.")
+                return False
+            return _verify_saved_session(
+                base_url,
+                refreshed_source,
+                allow_recovery=False,
+            )
+
+        print_error(
+            "Could not verify your saved session.",
+            hint="Check your network connection and API URL, then try again.",
+        )
+        return False
+
+    label = None
+    if isinstance(identity, dict):
+        label = identity.get("email") or identity.get("sub")
+    else:
+        label = getattr(identity, "email", None) or getattr(identity, "sub", None)
+    suffix = f" for [bold]{label}[/bold]" if label else ""
+    from teardrop_cli.formatting import console
+
+    console.print(f"[bold green]✓[/bold green] Session verified{suffix}.")
+    return True
+
+
+def _ensure_authenticated(base_url: str | None) -> bool:
+    from teardrop_cli import config
+    from teardrop_cli.formatting import console, print_error
+
+    source = config.detect_credential_source()
+    if source is None:
+        console.print("\n[bold]Sign-in is required to run an agent.[/bold]")
+        try:
+            _auth_menu(base_url)
+        except (click.exceptions.Exit, SystemExit):
+            return False
+        source = config.detect_credential_source()
+        if source is None:
+            print_error("Sign-in did not produce a saved session.")
+            return False
+
+    return _verify_saved_session(base_url, source)
+
+
 def _run_quickstart(base_url: str | None) -> None:
     from teardrop_cli import config
     from teardrop_cli.formatting import console
@@ -31,19 +137,15 @@ def _run_quickstart(base_url: str | None) -> None:
             "\n[bold cyan]Welcome to Teardrop.[/bold cyan]  "
             "[dim]This wizard will get you running in under a minute.[/dim]\n"
         )
-
-    # 1. Auth — use existing creds if present, otherwise guide through auth.
-    if is_repeat:
-        console.print("[dim]Existing credentials detected.[/dim]")
-        console.print(f"[dim](source: {config.detect_credential_source()})[/dim]")
         console.print(
-            "[dim]Stored credentials found locally. "
-            "They will be verified on first authenticated command.[/dim]"
+            "[dim]You can explore locally now; sign-in is requested only for "
+            "account actions and agent runs.[/dim]"
         )
     else:
-        _auth_menu(base_url)
+        console.print("[dim]Saved session found locally.[/dim]")
+        console.print(f"[dim](source: {config.detect_credential_source()})[/dim]")
+        console.print("[dim]It will be checked when you choose an authenticated action.[/dim]")
 
-    # 2. What's next?
     console.print()
     console.print("[bold]What would you like to do next?[/bold]")
     console.print("  [cyan]0[/cyan]  Nothing, just exploring [dim](exit)[/dim]")
@@ -70,13 +172,11 @@ def _auth_menu(base_url: str | None) -> None:
 
     if not has_account:
         console.print("\n[bold]Create your account:[/bold]")
-        console.print("  [cyan]1[/cyan]  Ethereum wallet — fastest, no email needed [recommended]")
-        console.print("  [cyan]2[/cyan]  Email + password")
+        console.print("  [cyan]1[/cyan]  Email + password [recommended]")
+        console.print("  [cyan]2[/cyan]  Ethereum wallet — no email needed")
         choice = typer.prompt("Choice", default="1")
 
         if choice == "2":
-            signup(base_url=base_url)
-        else:
             from teardrop_cli import config
 
             url = base_url or config.get_base_url()
@@ -86,6 +186,8 @@ def _auth_menu(base_url: str | None) -> None:
                 default=False,
             )
             _login_siwe(url, generate_wallet=generate, save_key=save_key)
+        else:
+            signup(base_url=base_url)
     else:
         console.print("\n[bold]Sign in:[/bold]")
         console.print("  [cyan]1[/cyan]  Ethereum wallet")
@@ -121,27 +223,39 @@ def _scaffold_branch() -> None:
 
 
 def _sample_run_branch(base_url: str | None) -> None:
-    import asyncio
-
-    from teardrop_cli import config
-    from teardrop_cli.commands.run import _handle_run_error, _stream
+    from teardrop_cli.commands.run import _estimate_cost, _execute_run
     from teardrop_cli.formatting import console
 
+    if not _ensure_authenticated(base_url):
+        return
+
     message = typer.prompt(
         "Prompt", default="What is the current ETH gas price?", show_default=True
     )
     console.print()
-    if typer.confirm("Configure a BYOK LLM key first? (skip if you have credits)", default=False):
+    console.print(
+        "[dim]Billing note: platform credits or x402 cover non-BYOK model usage and platform costs. "
+        "BYOK pays your provider directly but still needs Teardrop payment capacity for orchestration.[/dim]"
+    )
+    if typer.confirm("Configure a BYOK LLM key first?", default=False):
         from teardrop_cli.commands.llm_config import _byok_interactive
 
         _byok_interactive(base_url=base_url)
         console.print()
 
-    client = config.get_client(base_url)
+    if typer.confirm(
+        "Show an estimated cost before running?", default=True
+    ) and not _estimate_cost(message, base_url=base_url):
+        console.print("\nNo run started. Resolve the issue and run quickstart again.")
+        return
+
+    if not typer.confirm("Run this prompt now? It may use credits or x402.", default=True):
+        console.print("\nRun cancelled. No agent request was sent.")
+        return
+
     try:
-        asyncio.run(_stream(client, message, None, None))
-    except Exception as exc:  # noqa: BLE001
-        _handle_run_error(exc)
+        _execute_run(message, base_url=base_url)
+    except click.exceptions.Exit:
         return  # error already printed; skip next-steps
 
     console.print(

{teardrop_cli-0.3.0 → teardrop_cli-0.3.2}/src/teardrop_cli/commands/run.py

@@ -216,7 +216,7 @@ def _estimate_cost(
     context: dict | None = None,
     tool_policy=None,
     base_url: str | None = None,
-) -> None:
+) -> bool:
     """Show an estimated cost based on current pricing and config — no inference."""
     from teardrop_cli.formatting import console, print_table
     from teardrop_cli.pricing import estimate_run_cost
@@ -227,7 +227,7 @@ def _estimate_cost(
         )
     except Exception as exc:  # noqa: BLE001
         _handle_run_error(exc)
-        return
+        return False
 
     from teardrop import format_usdc
 
@@ -247,6 +247,7 @@ def _estimate_cost(
     ]
     print_table([("Item", {"style": "bold cyan"}), "Value"], rows, title="Cost Estimate")
     console.print(f"[dim]{est.disclaimer}[/dim]")
+    return True
 
 
 async def _stream(
@@ -341,23 +342,26 @@ async def _collect(
 
 
 def _handle_run_error(exc: BaseException) -> None:
+    from teardrop import AuthenticationError, PaymentRequiredError, RateLimitError
+
     from teardrop_cli.formatting import print_error
 
     name = type(exc).__name__
     msg = str(exc)
+    status_code = getattr(exc, "status_code", None)
 
-    if name == "PaymentRequiredError" or "402" in msg:
+    if isinstance(exc, PaymentRequiredError) or status_code == 402:
         print_error(
             "Insufficient credit.",
-            hint="Topup at: https://teardrop.dev/billing",
+            hint="Check [bold]teardrop balance[/bold]. Add funds at: https://teardrop.dev/billing",
         )
         return
-    if name == "RateLimitError" or "429" in msg:
+    if isinstance(exc, RateLimitError) or status_code == 429:
         retry = getattr(exc, "retry_after", None)
         suffix = f" (retry after {retry}s)" if retry else ""
         print_error(f"Rate limit exceeded{suffix}.")
         return
-    if name == "AuthenticationError" or "401" in msg:
+    if isinstance(exc, AuthenticationError) or status_code == 401:
         print_error(
             "Not authenticated.",
             hint="Run `teardrop auth login` to sign in.",