feat(cli-tools): add settings handlers for new "custom" configType tools (plan 14 F3)

Adds 5 new settings route handlers for CLIs introduced by plan 14 that
declare configType:"custom" and need automated config file persistence:
forge (~/.forge/config.toml), jcode (~/.jcode/config.json),
deepseek-tui (~/.config/deepseek-tui/config.toml),
smelt (~/.smelt/config.json), pi (~/.pi/config.json).

Also registers the 5 tools in cliRuntime.ts path table so
getCliPrimaryConfigPath() resolves their config paths correctly.

Each handler follows the established pattern: requireCliToolsAuth guard on
every exported method, Zod body validation on POST, buildErrorBody/
sanitizeErrorMessage on all error paths (Hard Rule #12), fs/promises only
(no exec/spawn — Hard Rule #13), saveCliToolLastConfigured on success.

Integration tests: 7 subtests per handler (401 without auth, 200 GET,
400 missing-baseUrl, 400 missing-model, 200 POST writes file, 200 DELETE,
error sanitization + no exec/spawn static audit).

src/app/api/cli-tools/deepseek-tui-settings/route.ts

@@ -0,0 +1,206 @@
+"use server";
+
+import { NextResponse } from "next/server";
+import fs from "fs/promises";
+import path from "path";
+import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
+import {
+  ensureCliConfigWriteAllowed,
+  getCliPrimaryConfigPath,
+  getCliRuntimeStatus,
+} from "@/shared/services/cliRuntime";
+import { createBackup } from "@/shared/services/backupService";
+import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db/cliToolState";
+import { cliModelConfigSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
+
+const TOOL_ID = "deepseek-tui";
+
+const getDeepseekTuiConfigPath = (): string =>
+  getCliPrimaryConfigPath(TOOL_ID) ??
+  path.join(process.env.HOME ?? "~", ".config", "deepseek-tui", "config.toml");
+
+const getDeepseekTuiDir = () => path.dirname(getDeepseekTuiConfigPath());
+
+/**
+ * Render the OmniRoute config block in DeepSeek TUI TOML format.
+ * DeepSeek TUI reads OPENAI_BASE_URL and OPENAI_API_KEY from its config.
+ * Reference: https://github.com/hunterbown/deepseek-tui
+ */
+function renderDeepseekTuiConfig(baseUrl: string, apiKey: string, model: string): string {
+  return [
+    "# DeepSeek TUI config — managed by OmniRoute (plan 14)",
+    "",
+    "[openai]",
+    `base_url = "${baseUrl}"`,
+    `api_key = "${apiKey}"`,
+    `model = "${model}"`,
+    "",
+  ].join("\n");
+}
+
+/**
+ * Check if the config file contains OmniRoute settings.
+ */
+const hasOmniRouteConfig = (content: string | null): boolean => {
+  if (!content) return false;
+  return content.includes("managed by OmniRoute");
+};
+
+// Read current config.toml
+const readConfig = async (): Promise<string | null> => {
+  try {
+    return await fs.readFile(getDeepseekTuiConfigPath(), "utf-8");
+  } catch (err: any) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+};
+
+// GET — check deepseek-tui CLI and return current config
+export async function GET(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const runtime = await getCliRuntimeStatus(TOOL_ID);
+
+    if (!runtime.installed || !runtime.runnable) {
+      return NextResponse.json({
+        installed: runtime.installed,
+        runnable: runtime.runnable,
+        command: runtime.command,
+        commandPath: runtime.commandPath,
+        runtimeMode: runtime.runtimeMode,
+        reason: runtime.reason,
+        config: null,
+        message:
+          runtime.installed && !runtime.runnable
+            ? "DeepSeek TUI is installed but not runnable"
+            : "DeepSeek TUI is not installed",
+      });
+    }
+
+    const config = await readConfig();
+
+    return NextResponse.json({
+      installed: runtime.installed,
+      runnable: runtime.runnable,
+      command: runtime.command,
+      commandPath: runtime.commandPath,
+      runtimeMode: runtime.runtimeMode,
+      reason: runtime.reason,
+      config,
+      hasOmniRoute: hasOmniRouteConfig(config),
+      configPath: getDeepseekTuiConfigPath(),
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// POST — write OmniRoute settings to DeepSeek TUI config.toml
+export async function POST(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(
+      { error: { message: "Invalid JSON body" } },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    // Extract keyId BEFORE Zod validation — Zod strips unknown fields
+    const keyId = typeof rawBody?.keyId === "string" ? rawBody.keyId.trim() : null;
+
+    const validation = validateBody(cliModelConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { baseUrl, model } = validation.data;
+    const apiKey = await resolveApiKey(keyId, validation.data.apiKey);
+
+    const configPath = getDeepseekTuiConfigPath();
+    const configDir = getDeepseekTuiDir();
+
+    // Ensure directory exists
+    await fs.mkdir(configDir, { recursive: true });
+
+    // Backup current config before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Write new config (full replace — simple TOML file)
+    const content = renderDeepseekTuiConfig(baseUrl, apiKey, model);
+    await fs.writeFile(configPath, content, "utf-8");
+
+    // Persist last-configured timestamp
+    try {
+      saveCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: "DeepSeek TUI settings applied successfully!",
+      configPath,
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// DELETE — remove DeepSeek TUI OmniRoute config
+export async function DELETE(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    const configPath = getDeepseekTuiConfigPath();
+
+    // Backup before removing
+    await createBackup(TOOL_ID, configPath);
+
+    await fs.rm(configPath, { force: true });
+
+    // Clear last-configured timestamp
+    try {
+      deleteCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: "DeepSeek TUI settings removed successfully",
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}

src/app/api/cli-tools/forge-settings/route.ts

@@ -0,0 +1,204 @@
+"use server";
+
+import { NextResponse } from "next/server";
+import fs from "fs/promises";
+import path from "path";
+import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
+import {
+  ensureCliConfigWriteAllowed,
+  getCliPrimaryConfigPath,
+  getCliRuntimeStatus,
+} from "@/shared/services/cliRuntime";
+import { createBackup } from "@/shared/services/backupService";
+import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db/cliToolState";
+import { cliModelConfigSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
+
+const TOOL_ID = "forge";
+
+const getForgeConfigPath = (): string =>
+  getCliPrimaryConfigPath(TOOL_ID) ?? path.join(process.env.HOME ?? "~", ".forge", "config.toml");
+
+const getForgeDir = () => path.dirname(getForgeConfigPath());
+
+/**
+ * Render the OmniRoute provider block in Forge TOML format.
+ * Forge uses a TOML config at ~/.forge/config.toml with an [openai] section.
+ * Reference: https://github.com/antinomyhq/forge
+ */
+function renderForgeConfig(baseUrl: string, apiKey: string, model: string): string {
+  const normalizedBaseUrl = baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+  return [
+    "# Forge config — managed by OmniRoute (plan 14)",
+    "",
+    "[openai]",
+    `api_key = "${apiKey}"`,
+    `base_url = "${normalizedBaseUrl}"`,
+    `model = "${model}"`,
+    "",
+  ].join("\n");
+}
+
+/**
+ * Check if the config file contains OmniRoute settings.
+ * Looks for the managed-by-OmniRoute marker comment.
+ */
+const hasOmniRouteConfig = (content: string | null): boolean => {
+  if (!content) return false;
+  return content.includes("managed by OmniRoute");
+};
+
+// Read current config.toml
+const readConfig = async (): Promise<string | null> => {
+  try {
+    return await fs.readFile(getForgeConfigPath(), "utf-8");
+  } catch (err: any) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+};
+
+// GET — check forge CLI and return current config
+export async function GET(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const runtime = await getCliRuntimeStatus(TOOL_ID);
+
+    if (!runtime.installed || !runtime.runnable) {
+      return NextResponse.json({
+        installed: runtime.installed,
+        runnable: runtime.runnable,
+        command: runtime.command,
+        commandPath: runtime.commandPath,
+        runtimeMode: runtime.runtimeMode,
+        reason: runtime.reason,
+        config: null,
+        message:
+          runtime.installed && !runtime.runnable
+            ? "Forge CLI is installed but not runnable"
+            : "Forge CLI is not installed",
+      });
+    }
+
+    const config = await readConfig();
+
+    return NextResponse.json({
+      installed: runtime.installed,
+      runnable: runtime.runnable,
+      command: runtime.command,
+      commandPath: runtime.commandPath,
+      runtimeMode: runtime.runtimeMode,
+      reason: runtime.reason,
+      config,
+      hasOmniRoute: hasOmniRouteConfig(config),
+      configPath: getForgeConfigPath(),
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// POST — write OmniRoute settings to Forge config.toml
+export async function POST(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(
+      { error: { message: "Invalid JSON body" } },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    // Extract keyId BEFORE Zod validation — Zod strips unknown fields
+    const keyId = typeof rawBody?.keyId === "string" ? rawBody.keyId.trim() : null;
+
+    const validation = validateBody(cliModelConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { baseUrl, model } = validation.data;
+    const apiKey = await resolveApiKey(keyId, validation.data.apiKey);
+
+    const configPath = getForgeConfigPath();
+    const forgeDir = getForgeDir();
+
+    // Ensure directory exists
+    await fs.mkdir(forgeDir, { recursive: true });
+
+    // Backup current config before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Write new config (full replace — Forge config is simple)
+    const content = renderForgeConfig(baseUrl, apiKey, model);
+    await fs.writeFile(configPath, content, "utf-8");
+
+    // Persist last-configured timestamp
+    try {
+      saveCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: "Forge settings applied successfully!",
+      configPath,
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// DELETE — remove Forge OmniRoute config
+export async function DELETE(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    const configPath = getForgeConfigPath();
+
+    // Backup before removing
+    await createBackup(TOOL_ID, configPath);
+
+    await fs.rm(configPath, { force: true });
+
+    // Clear last-configured timestamp
+    try {
+      deleteCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({ success: true, message: "Forge settings removed successfully" });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}

src/app/api/cli-tools/jcode-settings/route.ts

@@ -0,0 +1,229 @@
+"use server";
+
+import { NextResponse } from "next/server";
+import fs from "fs/promises";
+import path from "path";
+import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
+import {
+  ensureCliConfigWriteAllowed,
+  getCliPrimaryConfigPath,
+  getCliRuntimeStatus,
+} from "@/shared/services/cliRuntime";
+import { createBackup } from "@/shared/services/backupService";
+import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db/cliToolState";
+import { cliModelConfigSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
+
+const TOOL_ID = "jcode";
+
+const getJcodeConfigPath = (): string =>
+  getCliPrimaryConfigPath(TOOL_ID) ?? path.join(process.env.HOME ?? "~", ".jcode", "config.json");
+
+const getJcodeDir = () => path.dirname(getJcodeConfigPath());
+
+/**
+ * Check if the config file contains OmniRoute settings.
+ */
+const hasOmniRouteConfig = (settings: Record<string, unknown> | null): boolean => {
+  if (!settings) return false;
+  return (
+    typeof settings.baseUrl === "string" &&
+    settings.baseUrl.length > 0 &&
+    settings._managedBy === "omniroute"
+  );
+};
+
+// Read current config.json
+const readConfig = async (): Promise<Record<string, unknown> | null> => {
+  try {
+    const content = await fs.readFile(getJcodeConfigPath(), "utf-8");
+    return JSON.parse(content) as Record<string, unknown>;
+  } catch (err: any) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+};
+
+// GET — check jcode CLI and return current config
+export async function GET(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const runtime = await getCliRuntimeStatus(TOOL_ID);
+
+    if (!runtime.installed || !runtime.runnable) {
+      return NextResponse.json({
+        installed: runtime.installed,
+        runnable: runtime.runnable,
+        command: runtime.command,
+        commandPath: runtime.commandPath,
+        runtimeMode: runtime.runtimeMode,
+        reason: runtime.reason,
+        config: null,
+        message:
+          runtime.installed && !runtime.runnable
+            ? "jcode CLI is installed but not runnable"
+            : "jcode CLI is not installed",
+      });
+    }
+
+    const config = await readConfig();
+
+    return NextResponse.json({
+      installed: runtime.installed,
+      runnable: runtime.runnable,
+      command: runtime.command,
+      commandPath: runtime.commandPath,
+      runtimeMode: runtime.runtimeMode,
+      reason: runtime.reason,
+      config,
+      hasOmniRoute: hasOmniRouteConfig(config),
+      configPath: getJcodeConfigPath(),
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// POST — write OmniRoute settings to jcode config.json
+export async function POST(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(
+      { error: { message: "Invalid JSON body" } },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    // Extract keyId BEFORE Zod validation — Zod strips unknown fields
+    const keyId = typeof rawBody?.keyId === "string" ? rawBody.keyId.trim() : null;
+
+    const validation = validateBody(cliModelConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { baseUrl, model } = validation.data;
+    const apiKey = await resolveApiKey(keyId, validation.data.apiKey);
+
+    const configPath = getJcodeConfigPath();
+    const jcodeDir = getJcodeDir();
+
+    // Ensure directory exists
+    await fs.mkdir(jcodeDir, { recursive: true });
+
+    // Backup current config before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Read existing config or start fresh
+    let existing: Record<string, unknown> = {};
+    try {
+      const raw = await fs.readFile(configPath, "utf-8");
+      existing = JSON.parse(raw) as Record<string, unknown>;
+    } catch {
+      /* No existing config */
+    }
+
+    // Merge OmniRoute settings (jcode uses OpenAI-compatible config)
+    const normalizedBaseUrl = baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+    const updated: Record<string, unknown> = {
+      ...existing,
+      baseUrl: normalizedBaseUrl,
+      apiKey,
+      model,
+      _managedBy: "omniroute",
+    };
+
+    await fs.writeFile(configPath, JSON.stringify(updated, null, 2), "utf-8");
+
+    // Persist last-configured timestamp
+    try {
+      saveCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: "jcode settings applied successfully!",
+      configPath,
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// DELETE — remove OmniRoute settings from jcode config
+export async function DELETE(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    const configPath = getJcodeConfigPath();
+
+    // Backup before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Read existing config
+    let existing: Record<string, unknown> = {};
+    try {
+      const raw = await fs.readFile(configPath, "utf-8");
+      existing = JSON.parse(raw) as Record<string, unknown>;
+    } catch (err: any) {
+      if (err.code === "ENOENT") {
+        return NextResponse.json({ success: true, message: "No config file to reset" });
+      }
+      throw err;
+    }
+
+    // Remove OmniRoute-managed fields
+    delete existing.baseUrl;
+    delete existing.apiKey;
+    delete existing.model;
+    delete existing._managedBy;
+
+    if (Object.keys(existing).length === 0) {
+      await fs.rm(configPath, { force: true });
+    } else {
+      await fs.writeFile(configPath, JSON.stringify(existing, null, 2), "utf-8");
+    }
+
+    // Clear last-configured timestamp
+    try {
+      deleteCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({ success: true, message: "jcode OmniRoute settings removed" });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}

src/app/api/cli-tools/pi-settings/route.ts

@@ -0,0 +1,229 @@
+"use server";
+
+import { NextResponse } from "next/server";
+import fs from "fs/promises";
+import path from "path";
+import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
+import {
+  ensureCliConfigWriteAllowed,
+  getCliPrimaryConfigPath,
+  getCliRuntimeStatus,
+} from "@/shared/services/cliRuntime";
+import { createBackup } from "@/shared/services/backupService";
+import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db/cliToolState";
+import { cliModelConfigSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
+
+const TOOL_ID = "pi";
+
+const getPiConfigPath = (): string =>
+  getCliPrimaryConfigPath(TOOL_ID) ?? path.join(process.env.HOME ?? "~", ".pi", "config.json");
+
+const getPiDir = () => path.dirname(getPiConfigPath());
+
+/**
+ * Check if the config file contains OmniRoute settings.
+ */
+const hasOmniRouteConfig = (settings: Record<string, unknown> | null): boolean => {
+  if (!settings) return false;
+  return (
+    typeof settings.baseUrl === "string" &&
+    settings.baseUrl.length > 0 &&
+    settings._managedBy === "omniroute"
+  );
+};
+
+// Read current config.json
+const readConfig = async (): Promise<Record<string, unknown> | null> => {
+  try {
+    const content = await fs.readFile(getPiConfigPath(), "utf-8");
+    return JSON.parse(content) as Record<string, unknown>;
+  } catch (err: any) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+};
+
+// GET — check pi CLI and return current config
+export async function GET(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const runtime = await getCliRuntimeStatus(TOOL_ID);
+
+    if (!runtime.installed || !runtime.runnable) {
+      return NextResponse.json({
+        installed: runtime.installed,
+        runnable: runtime.runnable,
+        command: runtime.command,
+        commandPath: runtime.commandPath,
+        runtimeMode: runtime.runtimeMode,
+        reason: runtime.reason,
+        config: null,
+        message:
+          runtime.installed && !runtime.runnable
+            ? "Pi CLI is installed but not runnable"
+            : "Pi CLI is not installed",
+      });
+    }
+
+    const config = await readConfig();
+
+    return NextResponse.json({
+      installed: runtime.installed,
+      runnable: runtime.runnable,
+      command: runtime.command,
+      commandPath: runtime.commandPath,
+      runtimeMode: runtime.runtimeMode,
+      reason: runtime.reason,
+      config,
+      hasOmniRoute: hasOmniRouteConfig(config),
+      configPath: getPiConfigPath(),
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// POST — write OmniRoute settings to Pi config.json
+export async function POST(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(
+      { error: { message: "Invalid JSON body" } },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    // Extract keyId BEFORE Zod validation — Zod strips unknown fields
+    const keyId = typeof rawBody?.keyId === "string" ? rawBody.keyId.trim() : null;
+
+    const validation = validateBody(cliModelConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { baseUrl, model } = validation.data;
+    const apiKey = await resolveApiKey(keyId, validation.data.apiKey);
+
+    const configPath = getPiConfigPath();
+    const piDir = getPiDir();
+
+    // Ensure directory exists
+    await fs.mkdir(piDir, { recursive: true });
+
+    // Backup current config before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Read existing config or start fresh
+    let existing: Record<string, unknown> = {};
+    try {
+      const raw = await fs.readFile(configPath, "utf-8");
+      existing = JSON.parse(raw) as Record<string, unknown>;
+    } catch {
+      /* No existing config */
+    }
+
+    // Merge OmniRoute settings (pi uses OpenAI-compatible config)
+    const normalizedBaseUrl = baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+    const updated: Record<string, unknown> = {
+      ...existing,
+      baseUrl: normalizedBaseUrl,
+      apiKey,
+      model,
+      _managedBy: "omniroute",
+    };
+
+    await fs.writeFile(configPath, JSON.stringify(updated, null, 2), "utf-8");
+
+    // Persist last-configured timestamp
+    try {
+      saveCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: "Pi settings applied successfully!",
+      configPath,
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// DELETE — remove OmniRoute settings from Pi config
+export async function DELETE(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    const configPath = getPiConfigPath();
+
+    // Backup before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Read existing config
+    let existing: Record<string, unknown> = {};
+    try {
+      const raw = await fs.readFile(configPath, "utf-8");
+      existing = JSON.parse(raw) as Record<string, unknown>;
+    } catch (err: any) {
+      if (err.code === "ENOENT") {
+        return NextResponse.json({ success: true, message: "No config file to reset" });
+      }
+      throw err;
+    }
+
+    // Remove OmniRoute-managed fields
+    delete existing.baseUrl;
+    delete existing.apiKey;
+    delete existing.model;
+    delete existing._managedBy;
+
+    if (Object.keys(existing).length === 0) {
+      await fs.rm(configPath, { force: true });
+    } else {
+      await fs.writeFile(configPath, JSON.stringify(existing, null, 2), "utf-8");
+    }
+
+    // Clear last-configured timestamp
+    try {
+      deleteCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({ success: true, message: "Pi OmniRoute settings removed" });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}

src/app/api/cli-tools/smelt-settings/route.ts

@@ -0,0 +1,229 @@
+"use server";
+
+import { NextResponse } from "next/server";
+import fs from "fs/promises";
+import path from "path";
+import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
+import {
+  ensureCliConfigWriteAllowed,
+  getCliPrimaryConfigPath,
+  getCliRuntimeStatus,
+} from "@/shared/services/cliRuntime";
+import { createBackup } from "@/shared/services/backupService";
+import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db/cliToolState";
+import { cliModelConfigSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
+
+const TOOL_ID = "smelt";
+
+const getSmeltConfigPath = (): string =>
+  getCliPrimaryConfigPath(TOOL_ID) ?? path.join(process.env.HOME ?? "~", ".smelt", "config.json");
+
+const getSmeltDir = () => path.dirname(getSmeltConfigPath());
+
+/**
+ * Check if the config file contains OmniRoute settings.
+ */
+const hasOmniRouteConfig = (settings: Record<string, unknown> | null): boolean => {
+  if (!settings) return false;
+  return (
+    typeof settings.baseUrl === "string" &&
+    settings.baseUrl.length > 0 &&
+    settings._managedBy === "omniroute"
+  );
+};
+
+// Read current config.json
+const readConfig = async (): Promise<Record<string, unknown> | null> => {
+  try {
+    const content = await fs.readFile(getSmeltConfigPath(), "utf-8");
+    return JSON.parse(content) as Record<string, unknown>;
+  } catch (err: any) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+};
+
+// GET — check smelt CLI and return current config
+export async function GET(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const runtime = await getCliRuntimeStatus(TOOL_ID);
+
+    if (!runtime.installed || !runtime.runnable) {
+      return NextResponse.json({
+        installed: runtime.installed,
+        runnable: runtime.runnable,
+        command: runtime.command,
+        commandPath: runtime.commandPath,
+        runtimeMode: runtime.runtimeMode,
+        reason: runtime.reason,
+        config: null,
+        message:
+          runtime.installed && !runtime.runnable
+            ? "Smelt CLI is installed but not runnable"
+            : "Smelt CLI is not installed",
+      });
+    }
+
+    const config = await readConfig();
+
+    return NextResponse.json({
+      installed: runtime.installed,
+      runnable: runtime.runnable,
+      command: runtime.command,
+      commandPath: runtime.commandPath,
+      runtimeMode: runtime.runtimeMode,
+      reason: runtime.reason,
+      config,
+      hasOmniRoute: hasOmniRouteConfig(config),
+      configPath: getSmeltConfigPath(),
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// POST — write OmniRoute settings to Smelt config.json
+export async function POST(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(
+      { error: { message: "Invalid JSON body" } },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    // Extract keyId BEFORE Zod validation — Zod strips unknown fields
+    const keyId = typeof rawBody?.keyId === "string" ? rawBody.keyId.trim() : null;
+
+    const validation = validateBody(cliModelConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { baseUrl, model } = validation.data;
+    const apiKey = await resolveApiKey(keyId, validation.data.apiKey);
+
+    const configPath = getSmeltConfigPath();
+    const smeltDir = getSmeltDir();
+
+    // Ensure directory exists
+    await fs.mkdir(smeltDir, { recursive: true });
+
+    // Backup current config before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Read existing config or start fresh
+    let existing: Record<string, unknown> = {};
+    try {
+      const raw = await fs.readFile(configPath, "utf-8");
+      existing = JSON.parse(raw) as Record<string, unknown>;
+    } catch {
+      /* No existing config */
+    }
+
+    // Merge OmniRoute settings (smelt uses OpenAI-compatible config)
+    const normalizedBaseUrl = baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+    const updated: Record<string, unknown> = {
+      ...existing,
+      baseUrl: normalizedBaseUrl,
+      apiKey,
+      model,
+      _managedBy: "omniroute",
+    };
+
+    await fs.writeFile(configPath, JSON.stringify(updated, null, 2), "utf-8");
+
+    // Persist last-configured timestamp
+    try {
+      saveCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: "Smelt settings applied successfully!",
+      configPath,
+    });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}
+
+// DELETE — remove OmniRoute settings from Smelt config
+export async function DELETE(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+
+  try {
+    const writeGuard = ensureCliConfigWriteAllowed();
+    if (writeGuard) {
+      return NextResponse.json({ error: writeGuard }, { status: 403 });
+    }
+
+    const configPath = getSmeltConfigPath();
+
+    // Backup before modifying
+    await createBackup(TOOL_ID, configPath);
+
+    // Read existing config
+    let existing: Record<string, unknown> = {};
+    try {
+      const raw = await fs.readFile(configPath, "utf-8");
+      existing = JSON.parse(raw) as Record<string, unknown>;
+    } catch (err: any) {
+      if (err.code === "ENOENT") {
+        return NextResponse.json({ success: true, message: "No config file to reset" });
+      }
+      throw err;
+    }
+
+    // Remove OmniRoute-managed fields
+    delete existing.baseUrl;
+    delete existing.apiKey;
+    delete existing.model;
+    delete existing._managedBy;
+
+    if (Object.keys(existing).length === 0) {
+      await fs.rm(configPath, { force: true });
+    } else {
+      await fs.writeFile(configPath, JSON.stringify(existing, null, 2), "utf-8");
+    }
+
+    // Clear last-configured timestamp
+    try {
+      deleteCliToolLastConfigured(TOOL_ID);
+    } catch {
+      /* non-critical */
+    }
+
+    return NextResponse.json({ success: true, message: "Smelt OmniRoute settings removed" });
+  } catch (err) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(err) } },
+      { status: 500 }
+    );
+  }
+}

src/shared/services/cliRuntime.ts

@@ -188,6 +188,52 @@ const CLI_TOOLS: Record<string, any> = {
       settings: ".gemini/settings.json",
     },
   },
+  // ── Plan 14 — new "custom" configType tools ───────────────────────────────
+  forge: {
+    defaultCommand: "forge",
+    envBinKey: "CLI_FORGE_BIN",
+    requiresBinary: true,
+    healthcheckTimeoutMs: 8000,
+    paths: {
+      config: ".forge/config.toml",
+    },
+  },
+  jcode: {
+    defaultCommand: "jcode",
+    envBinKey: "CLI_JCODE_BIN",
+    requiresBinary: true,
+    healthcheckTimeoutMs: 8000,
+    paths: {
+      config: ".jcode/config.json",
+    },
+  },
+  "deepseek-tui": {
+    defaultCommand: "deepseek-tui",
+    envBinKey: "CLI_DEEPSEEK_TUI_BIN",
+    requiresBinary: true,
+    healthcheckTimeoutMs: 8000,
+    paths: {
+      config: ".config/deepseek-tui/config.toml",
+    },
+  },
+  smelt: {
+    defaultCommand: "smelt",
+    envBinKey: "CLI_SMELT_BIN",
+    requiresBinary: true,
+    healthcheckTimeoutMs: 8000,
+    paths: {
+      config: ".smelt/config.json",
+    },
+  },
+  pi: {
+    defaultCommand: "pi",
+    envBinKey: "CLI_PI_BIN",
+    requiresBinary: true,
+    healthcheckTimeoutMs: 8000,
+    paths: {
+      config: ".pi/config.json",
+    },
+  },
 };
 
 const isWindows = () => process.platform === "win32";