@2kw/ai 7.4.0-dev.1 → 7.4.0-dev.11

package/README.md

@@ -75,8 +75,8 @@ Explicit API keys always take priority over a stored browser session
 ```
 
 Note: `config get apiKey --json` returns a masked value — stored secrets do
-not round-trip through stdout. Scripts needing the raw key should use
-`AI_2KW_API_KEY` or read the config file (path shown by `config list`).
+not round-trip through stdout by default. Scripts needing the raw key pass
+`--reveal` (`config get apiKey --reveal`) or use `AI_2KW_API_KEY`.
 
 ## Contexts
 

package/dist/commands/agent-policy.js

@@ -52,6 +52,9 @@ export function makeAgentPolicyCommand() {
                 `auto-approval ${auto?.enabled ? "on" : "off (every auto pauses for a human)"}`,
                 `judge ${auto?.judgeConfigured ? "configured" : "not configured (every candidate escalates)"}`,
             ];
+            if (auto?.instructionsExceedJudgeBound) {
+                parts.push("instructions longer than the judge reads (every candidate escalates)");
+            }
             if (mode)
                 parts.push(`mode ${mode}`);
             if (data?.catalogResolvedAt)

package/dist/commands/config.js

@@ -86,14 +86,15 @@ export function makeConfigCommand() {
         .command("get")
         .description("Get a configuration value")
         .argument("<key>", `Config key (${ALLOWED_KEYS.join(", ")})`)
-        .action((key, _opts, command) => {
+        .option("--reveal", "Print the API key unmasked (for scripts that need the key itself)")
+        .action((key, opts, command) => {
         const validKey = validateKey(key);
         const ctx = getActiveContext();
         const raw = ctx?.[validKey];
         // A stored "" apiKey stays "" (shown as "(not set)"); only a real key is masked.
         const value = raw === undefined
             ? undefined
-            : validKey === "apiKey" && typeof raw === "string"
+            : validKey === "apiKey" && typeof raw === "string" && !opts.reveal
                 ? raw && maskApiKey(raw)
                 : String(raw);
         if (isJsonOutput(command)) {

package/dist/commands/experiments.js

@@ -17,13 +17,22 @@ function formatComparisonCell(result) {
     const scores = result.scores ?? [];
     if (scores.length > 0) {
         // A SKIP carries a placeholder 0.0 that is not a rating, and a comment-only
-        // score has no number; neither takes part in the average (#693).
-        const rated = scores.filter((s) => s.label !== "SKIP" && s.score != null);
+        // score rates nothing; neither is picked (#693). Of the rest, one score per
+        // evaluator, as the console's pickCellScore: HUMAN, then LLM_JUDGE, then the
+        // first, so an override replaces the score it supersedes (#1410).
+        const byEvaluator = new Map();
+        for (const s of scores) {
+            if (s.label === "SKIP" || (s.score == null && !s.label))
+                continue;
+            byEvaluator.set(s.evaluatorId, [...(byEvaluator.get(s.evaluatorId) ?? []), s]);
+        }
+        const picked = [...byEvaluator.values()].map((group) => group.find((s) => s.source === "HUMAN") ?? group.find((s) => s.source === "LLM_JUDGE") ?? group[0]);
+        const rated = picked.filter((s) => s.score != null);
         if (rated.length > 0) {
             return (rated.reduce((sum, s) => sum + s.score, 0) / rated.length).toFixed(2);
         }
         // A label-only verdict (#1163) has no number; show its label, as the console does.
-        const verdict = scores.find((s) => s.label && s.label !== "SKIP");
+        const verdict = picked[0];
         if (verdict)
             return String(verdict.label);
         if (scores.every((s) => s.label === "SKIP"))

package/dist/lib/errors.js

@@ -102,6 +102,7 @@ const CODE_HINTS = {
         "Check pendingToolCalls and pendingApprovals in the run envelope.",
     unknown_tool_output: "That call id was not released by this response. Use the responseId of the latest envelope.",
     conversation_agent_mismatch: "This conversation belongs to another agent. Start a new conversation or run the agent that owns it.",
+    provider_quota_exhausted: "The model provider account is out of credits or at its spend limit. Add credits or raise the limit with the provider; retrying will not help.",
 };
 /** The most specific hint for an API error: gateway code, then known messages, then the status table. */
 export function hintFor(err) {
@@ -114,7 +115,7 @@ export function hintFor(err) {
     if (err.headResponseId) {
         return `The run's newest response is ${err.headResponseId}. Check it: 2kw responses get ${err.headResponseId}`;
     }
-    if (err.code && CODE_HINTS[err.code])
+    if (err.code && Object.hasOwn(CODE_HINTS, err.code))
         return CODE_HINTS[err.code];
     // The gateway answers `agent_not_published` (code), the REST layer AGENT_NOT_PUBLISHED (errorCode).
     if (err.code === "agent_not_published" || err.errorCode === "AGENT_NOT_PUBLISHED") {

package/dist/relay-protocol/wire.d.ts

@@ -27,6 +27,11 @@ export declare const POLL_WAIT_SECONDS = 25;
 export declare const ACCEPTANCE_MS = 10000;
 export declare const OWNER_LEASE_MS = 30000;
 export declare const OFFLINE_MS = 60000;
+/**
+ * How often a relay refreshes the backend's signing keys on its own. The hub uses it to decide how
+ * long a JWKS refresh hint stays relevant for a relay it first sees later (#801).
+ */
+export declare const JWKS_REFRESH_INTERVAL_MS: number;
 export declare const CALL_TOTAL_MS: number;
 export declare const LISTEN_TOTAL_MS: number;
 export declare const MAX_HEAD_DEADLINE_MS: number;

package/dist/relay-protocol/wire.js

@@ -29,6 +29,11 @@ export const POLL_WAIT_SECONDS = 25;
 export const ACCEPTANCE_MS = 10_000;
 export const OWNER_LEASE_MS = 30_000;
 export const OFFLINE_MS = 60_000;
+/**
+ * How often a relay refreshes the backend's signing keys on its own. The hub uses it to decide how
+ * long a JWKS refresh hint stays relevant for a relay it first sees later (#801).
+ */
+export const JWKS_REFRESH_INTERVAL_MS = 10 * 60_000;
 export const CALL_TOTAL_MS = 10 * 60_000;
 export const LISTEN_TOTAL_MS = 60 * 60_000;
 export const MAX_HEAD_DEADLINE_MS = 10 * 60_000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2kw/ai",
-  "version": "7.4.0-dev.1",
+  "version": "7.4.0-dev.11",
   "description": "CLI for 2kw.ai — schema-driven document extraction, an OpenAI-compatible EU LLM gateway, transcription, prompts, datasets, and experiments from your terminal or agentic workflows. Ships as 2kw, backbone, and bb.",
   "keywords": [
     "cli",