[5dive-bot]

Summary

Adds 5dive as a configure target: omniroute configure 5dive and omniroute setup-5dive
point a 5dive agent fleet's claude seats at OmniRoute by writing one 5dive
auth profile.

This is the PR promised in #11578, after the mid-turn failover run you asked for
(transcript).

It does not call 5dive agent create. That was the deviation you flagged, and it was the right
thing to flag: agent create is root-on-the-host by construction (adduser, systemctl enable),
with no remote mode. Provisioning a worker is a different concern from pointing an existing one at
an endpoint. The operation that matches what the other targets do is 5dive agent auth set, which
writes an auth profile and nothing else.

The command needs four value flags, not the three named in the issue. Running it against a real
fleet is what surfaced this — the form in the original issue, and the corrected form in my first
reply, both still fail:

$ 5dive agent auth set claude --provider=openai --base-url=<url> --api-key=<key>
error: claude BYO (--provider) requires --auth-profile=<name> (custom-provider creds are profile-scoped)

$ ... --auth-profile=omniroute
error: --base-url with a custom provider requires --model=<slug> (no catalog entry for 'openai',
       so there are no per-tier model ids to fall back to)

$ ... --auth-profile=omniroute --model=failover-demo
OK — api key stored for claude/openai (profile=omniroute)

The recipe emits that form, and hands the key over on stdin (--api-key=-) so it never reaches
argv.

Three ways 5dive deviates from the other targets, each handled explicitly rather than left to fail
late:

Deviation	What the recipe does
Writing the profile is root-only on the fleet host	Re-execs through sudo; --no-sudo opts out and prints the command instead
http:// is refused for any non-loopback host (the agent's key rides that URL)	Reproduces the check locally, so the operator gets the reason at the point of choosing, not three commands later
Each seat's own runtime model pin outranks the profile's ANTHROPIC_DEFAULT_*_MODEL	--agent <name> (repeatable) pins the seats too; otherwise it prints the command

5dive is configure-only (run: false in the manifest): it is a fleet manager, not a coding CLI,
so omniroute run 5dive would have nothing to launch.

Related Issues

• Closes feat(nodejs): add 5dive as a configure target #11578

Validation

• Change type: CLI (+ i18n, docs)
• Focused tests and category gates from the golden path — see below
• npm run lint — full repo-wide pass, exit 0; prettier --check clean on every touched file
• Reconciled with the current active release base (release/v3.8.51); focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• SonarQube: not run (opt-in).

Focused run, on this branch:

tests/unit/cli/**  +  tests/unit/cli-*  +  tests/unit/i18n-*  +  tests/unit/docs/**
1302 tests — 1299 pass, 2 skipped, 1 fail

The single failure is cli-doctor-command.test.ts › "doctor reports warnings but no failures when
database is not initialized", and it reproduces on a clean checkout of the base branch with my
changes stashed. It is not from this PR.

Also green: npm run check:docs-counts, npm run check:docs-sync, npx prettier --check on every
touched file. npm run check:docs-counts is what caught the stale 35 tools line in README.md,
which this PR updates to 36.

Tests Added Or Updated

• Added tests/unit/cli/setup-5dive.test.ts — 9 tests: base-URL resolution (/v1 stripped, the
  Anthropic surface is the root), the loopback-vs-https rule including a private-LAN address,
  the exact auth argv (and an assertion that the key is never in it), the separate per-seat pin
  command, the sudo wrapper, and shell-safe command rendering.
• Updated tests/unit/cli/configure-command.test.ts — manifest-order target list.
• Updated tests/unit/cli-catalog-counts.test.ts — agent count 9 → 10, D15 agent set.
• Updated tests/unit/cli-tools-schema.test.ts — registry expectation 35 → 36 entries.

The drift guard (tests/unit/cli/cli-manifest-drift.test.ts) is unchanged and passes: it is what
forced the cliRuntime + cliTools entries below to exist, which is the point of it.

Coverage Notes

Production code touched: bin/cli/commands/setup-5dive.mjs (new), bin/cli/cli-manifest.mjs,
bin/cli/commands/configure.mjs, bin/cli/commands/registry.mjs,
src/shared/services/cliRuntime.ts, src/shared/constants/cliTools.ts,
src/shared/schemas/cliCatalog.ts.

Every exported function in setup-5dive.mjs except runSetup5diveCommand is covered directly by
the new test file; the pure logic is factored out of the orchestrator precisely so it is testable
without spawning 5dive. runSetup5diveCommand itself is I/O orchestration (spawn + prompt) and is
exercised end-to-end only against a real fleet, which is what the transcript on #11578 records.
The catalog and manifest changes are covered by the four drift/count tests above.

Reviewer Notes

• --provider collision, deliberate. configure's --provider selects which model provider to
  filter the picker on, and it reaches setup recipes verbatim in setupOpts. 5dive's BYO id is a
  different thing, so the recipe reads --byo-provider and never opts.provider. Reading
  opts.provider here would have sent --provider=openrouter into 5dive agent auth set and
  failed for a non-obvious reason.
• getCliConfigPaths special case. 5dive's credentials are root-owned and live under
  /var/lib/5dive/auth-profiles/, not $HOME, so the generic home-join would resolve to nothing
  real. Handled the same way opencode and hermes-agent already are, with a
  CLI_5DIVE_STATE_DIR override.
• i18n: cliTools.toolDescriptions.5dive added to all 43 locales (pt-BR parity is a hard gate;
  the rest follow the convention every other tool entry uses).
• One thing I'd like your call on: the catalog entry has no image, only icon: "hub". I did
  not want to add a logo asset to your public/providers/ uninvited. Say the word and I'll add an
  SVG.
• Diff noise in docs/guides/CLI-INTEGRATIONS.md is Prettier, not me. Adding a row to the
  master table widened its columns, so prettier --write realigned all 16 existing rows. The
  only semantic changes in that file are the new row, the new ## 5dive agent fleets section,
  the --model tool list, the configure delegate list, and one base-URL-convention row.
• A bug in your setup --add-provider path, found while building this (v3.8.49): the
  program-level --api-key <key> option shadows the setup subcommand's own --api-key, so
  omniroute setup --add-provider --api-key <key> exits with "Provider API key is required. Pass
  --api-key or OMNIROUTE_API_KEY" even though it was passed — and OMNIROUTE_API_KEY does not work
  around it, because .omniroute/.env loads after the process environment. I configured providers
  through POST /api/providers instead. Happy to open that as its own issue.