feat: multi-provider cli setup wizard and self-hosted iroh relay

[ital0]

Stacked on #1032. Removes the CLI's hard Anthropic dependency and stands up the self-hosted iroh relay path.

What

Multi-provider model resolution (cli/src/agent/)

• --provider now accepts 14 builtin vendors resolved against the Pi catalog (anthropic, openai, google, xai, deepseek, zai, mistral, groq, openrouter, moonshotai, minimax, cerebras, together, fireworks) plus the existing openai-compat escape hatch.
• Per-provider default models; explicit --api-key is threaded per-call and wins over env; each builtin provider keeps Pi's native env resolution (OPENAI_API_KEY, GEMINI_API_KEY, …).
• Missing-credential errors moved into model resolution and name the exact env var + flag.

First-run setup wizard (cli/src/config/)

• Plain thunderbolt with no credentials in a TTY now launches a 3-step wizard (17-choice vendor menu incl. Ollama/LM Studio presets and custom OpenAI-compatible endpoints → hidden API-key input → model pick) instead of erroring.
• Persists to $THUNDERBOLT_HOME/config.json (mode 0600). Precedence: flag > env > config > default. Saved key/baseUrl are provider-scoped — a saved Anthropic key is never forwarded when --provider overrides to another vendor.
• New thunderbolt config subcommand re-runs the wizard. Non-TTY keeps a crisp guidance error.

Self-hosted iroh relay (deploy/iroh-relay/, docs/architecture/)

• Local PoC: docker compose up -d runs n0computer/iroh-relay:v1.0.2 --dev on :3340; both sides already accept overrides (THUNDERBOLT_IROH_RELAY_URL runtime CLI / VITE_IROH_RELAY_URL build-time app).
• Production template (config.example.toml): LetsEncrypt, QUIC address discovery (UDP 4433), shared-token access control, rate limits.
• Explainer doc covers what a relay does/doesn't (E2E crypto stays), what still rides on n0 (DNS discovery for bare-NodeId dials; tickets don't need it), and the prod hosting trade-offs (VPS full fit vs Render no-UDP partial fit).

Validation

• cli: tsc clean, 271 tests × 5 runs = 1355 pass / 0 fail; root make check green (lint, prettier, license headers).
• E2E (real PTY + browser): first-run wizard driven end-to-end in a PTY (key not echoed, config 0600, no restart into session); config reuse skips wizard; oneshot + TUI inference against live Anthropic; browser → self-hosted relay → CLI iroh bridge → two chat conversations answered (ticket base32-decodes to http://localhost:3340/, zero n0 relay involvement).

Follow-ups (not in this PR)

• Sort wizard model suggestions by recency (Pi catalog order currently surfaces older ids after the default).
• Prod relay hosting decision (VPS vs Render) + bake default relay URL into builds.
• Replace n0 DNS discovery with self-hosted pkarr/DNS if we want zero n0 dependency for bare-NodeId dials.

[github-actions]

Semgrep Security Scan

No security issues found.

[github-actions]

PR Metrics

Metric	Value
Lines changed (prod code)	+942 / -171
JS bundle size (gzipped)	🟢 632.6 KB → 635.4 KB (+2.8 KB, +0.4%)
Test coverage	🟢 77.59% → 77.59% (+0.0%)
Performance (preview)	Preview not ready — Render deploy may have timed out
Accessibility	—
Best Practices	—
SEO	—

Updated Fri, 10 Jul 2026 00:52:47 GMT · run #2256