CLI update: multiple accounts, terminal key management, and agents that delegate

Work and personal. A client's gateway and your own. The CLI now treats accounts as a first-class thing:

anyr account add work      # sign in to a second account
anyr account use work      # switch the default
anyr whoami                # who am I right now?
ANYROUTER_PROFILE=ci anyr claude    # pin an account per shell or CI job

Each account keeps its own key, base URL, and defaults in ~/.anyrouter/config.yaml. --profile wins for one command, ANYROUTER_PROFILE for a shell, account use persistently. anyr whoami always tells you which one is active and where its key lives — masked, never the secret.

anyr logout now removes everything the login stored — from the OS keychain and the config file — while keeping the account's settings, so signing back in is one step.

Browser sign-in now also stores a scoped management credential, so key management works right where you are:

anyr keys list           # * marks the key in use
anyr keys create laptop  # minted and offered for storage in one step
anyr keys use            # pick a key, switch to it
anyr keys revoke <hash>  # gone (asks first)

The management credential can list, create, and revoke keys — and nothing else. It can't run inference, it's never printed by any command, and anyr logout deletes it. The dashboard keys page is still one bare anyr keys away.

anyr task runs a two-phase pipeline: a planning model writes a numbered plan, an implementation model executes exactly that plan. Both phases stream, and a token summary prints at the end.

anyr task "refactor this CSV parser to stream" \
  --plan-model openai/gpt-5.2 \
  --do-model z-ai/glm-4.7-flash

Pairing an expensive planner with a cheap implementer gets you most of the quality at a fraction of the cost — and --json makes the whole thing scriptable.

Because one key drives every coding agent, agents can now hand work to each other:

anyr delegate --to codex "add unit tests for src/utils/slug.ts"
anyr delegate --to claude "explain this stack trace" --model deepseek/deepseek-v3

The target agent runs headlessly (claude -p, codex exec, opencode run) through the gateway with your stored key, streams its output, and exits with its own exit code. Agent sessions that already run through AnyRouter get the same capability as a delegate_task tool call, bridged to the CLI — the delegated agent's output comes back into the conversation.

Guardrails are built in: delegation is capped at **one hop** — a delegated agent can never delegate again — so two agents can't ping-pong tasks (and spend) between each other. Terminal runs confirm before spending; scripts opt in with --yes.

Everything above ships in the current anyr CLI — no new install, no migration, and every command you already use behaves exactly as before.

curl -fsSL https://anyrouter.dev/setup.sh | bash
anyr auth login

Docs: accounts & keys, anyr task, delegation.