@alilis/k-hat 0.1.0

package/dist/cli.js

@@ -0,0 +1,700 @@
+#!/usr/bin/env node
+import { access, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline/promises';
+import { saveJsonAtomic, defaultConfig } from './config.js';
+import { createKhatServer } from './server.js';
+import { openStore, maskSecret } from './store.js';
+import { Vault, generateAccessToken, ACCESS_TOKEN_REF } from './vault.js';
+import { createKeyProtector } from './key-protector.js';
+import { exportPortable, importPortable } from './portable-vault.js';
+import { LogWriter } from './logger.js';
+import { runDoctor as inspectDoctor, formatDoctorSuggestion } from './doctor.js';
+const dataDir = process.env.KHAT_HOME ?? join(homedir(), '.khat');
+const configPath = join(dataDir, 'config.json');
+const statePath = join(dataDir, 'state.json');
+const vaultPath = join(dataDir, 'vault.json');
+const pidPath = join(dataDir, 'daemon.pid');
+const signalPath = join(dataDir, 'daemon.signal');
+const execFileAsync = promisify(execFile);
+const USAGE = `khat — local API key proxy
+
+Usage: khat <command> [arguments]
+
+Setup
+  init                                  first-time setup: create vault + access token + default config
+  start [--foreground]                  start the proxy as a background daemon (or foreground with --foreground)
+  stop                                  stop the background daemon
+  status                                show providers, keys, routes and key health
+  doctor                                detect local Agent Tools and show connection guidance
+  log [--tail <n>]                      show recent masked proxy request logs
+  ui                                    issue a one-time browser ticket for the management page
+  tui                                   open the interactive terminal management UI
+  export <file>                         export encrypted portable vault
+  import <file> [--force]               import encrypted portable vault
+
+Access token
+  token show                            print the current access token
+  token rotate                          generate a new access token (update your tools afterwards)
+
+Providers
+  provider add <id> --base-url <url> [--name <n>] [--protocol openai|anthropic]
+  provider list
+  provider update <id> [--name <n>] [--base-url <url>] [--protocol openai|anthropic]
+  provider remove <id>                  removes the provider, its keys and its routes
+
+Keys (secrets live in the encrypted vault, config keeps only references)
+  key add <provider> <id> [--weight <n>] [--value <v>]   (prompts for the value when omitted)
+    --weight <n>   relative share in weighted round-robin across the provider's keys (default 1)
+  key list [<provider>]
+  key update <provider> <id> [--weight <n>] [--value <v>]
+  key remove <provider> <id>
+  key enable <provider> <id>            reset a key marked unavailable
+  key test <provider> <id> [--model <m>]  send a minimal request to verify the key
+
+Routes
+  route add <model> <provider>
+  route update <model> <provider>
+  route list
+  route remove <model>
+
+Environment
+  KHAT_HOME            data directory (default ~/.khat)
+  KHAT_ACCESS_TOKEN    override the vault access token (mainly for tests)`;
+function parseArgs(argv) {
+    const positionals = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (!arg.startsWith('--')) {
+            positionals.push(arg);
+            continue;
+        }
+        const body = arg.slice(2);
+        const eq = body.indexOf('=');
+        if (eq >= 0) {
+            flags[body.slice(0, eq)] = body.slice(eq + 1);
+            continue;
+        }
+        const next = argv[i + 1];
+        if (next !== undefined && !next.startsWith('--')) {
+            flags[body] = next;
+            i++;
+        }
+        else
+            flags[body] = true;
+    }
+    return { positionals, flags };
+}
+function flagString(flags, name) {
+    const value = flags[name];
+    return typeof value === 'string' ? value : undefined;
+}
+function flagInt(flags, name, fallback) {
+    const value = flagString(flags, name);
+    if (value === undefined)
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1)
+        throw new Error(`--${name} must be a positive integer`);
+    return parsed;
+}
+async function promptSecret(label) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const value = (await rl.question(`${label}: `)).trim();
+        if (!value)
+            throw new Error('empty value');
+        return value;
+    }
+    finally {
+        rl.close();
+    }
+}
+async function promptPassword(label) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        throw new Error(`${label} requires an interactive terminal; passwords cannot be supplied via flags or environment variables`);
+    process.stdout.write(`${label}: `);
+    return new Promise((resolve, reject) => {
+        const stdin = process.stdin;
+        let value = '';
+        const onData = (chunk) => { const text = chunk.toString(); if (text.includes('\\n') || text.includes('\\r')) {
+            stdin.setRawMode?.(false);
+            stdin.pause();
+            stdin.off('data', onData);
+            process.stdout.write('\\n');
+            value = value.trim();
+            value ? resolve(value) : reject(new Error('empty password'));
+        }
+        else
+            value += text; };
+        stdin.setRawMode?.(true);
+        stdin.resume();
+        stdin.on('data', onData);
+    });
+}
+async function fileExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function ensureDaemon() {
+    if (await daemonRunning())
+        return;
+    await runStart(false);
+}
+async function adminRequest(path, init = {}) {
+    const store = await openInitializedStore();
+    const token = process.env.KHAT_ACCESS_TOKEN ?? store.vault.get(ACCESS_TOKEN_REF);
+    if (!token)
+        throw new Error('no access token found; run khat init');
+    await ensureDaemon();
+    const response = await fetch(`http://${store.config.bind}:${store.config.port}${path}`, { ...init, headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json', ...(init.headers ?? {}) } });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(body?.error?.message ?? `Admin API returned ${response.status}`);
+    return body;
+}
+async function openInitializedStore() {
+    if (!(await fileExists(vaultPath)))
+        throw new Error(`not initialized; run 'khat init' first (expected vault at ${vaultPath})`);
+    return openStore(dataDir, createKeyProtector());
+}
+function keyStatusLine(store, providerId, keyId) {
+    const state = store.states[`${providerId}/${keyId}`];
+    if (!state || state.status === 'available')
+        return { status: 'available', note: '' };
+    return { status: 'unavailable', note: `  last error: ${state.lastError?.http ?? '?'} at ${state.lastError?.at ?? '?'}` };
+}
+function printStatus(store) {
+    const token = store.vault.get(ACCESS_TOKEN_REF);
+    console.log(`khat (${dataDir})`);
+    console.log(`  listen:      http://${store.config.bind}:${store.config.port}`);
+    console.log(`  access token: ${token ? maskSecret(token) : '(none — run khat init)'}  (khat token show)`);
+    console.log('  providers:');
+    if (!store.config.providers.length)
+        console.log('    (none — khat provider add)');
+    for (const provider of store.config.providers) {
+        console.log(`    ${provider.id} (${provider.name}) ${provider.protocol} ${provider.baseUrl}`);
+        if (!provider.keys.length) {
+            console.log('      (no keys — khat key add)');
+            continue;
+        }
+        for (const key of provider.keys) {
+            const secret = store.vault.get(key.vaultRef);
+            const { status, note } = keyStatusLine(store, provider.id, key.id);
+            const masked = secret ? maskSecret(secret) : '(missing from vault!)';
+            console.log(`      ${key.id}  weight ${key.weight}  ${status}  ${masked}${note}`);
+        }
+    }
+    console.log('  routes:');
+    if (!store.config.routes.length)
+        console.log('    (none — khat route add)');
+    for (const route of store.config.routes)
+        console.log(`    ${route.model} -> ${route.provider}`);
+}
+async function daemonRunning() {
+    let pid;
+    try {
+        pid = Number.parseInt((await readFile(pidPath, 'utf8')).trim(), 10);
+    }
+    catch {
+        return false;
+    }
+    if (!Number.isInteger(pid) || pid < 1)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        await unlink(pidPath).catch(() => undefined);
+        return false;
+    }
+}
+async function runForeground() {
+    const store = await openInitializedStore();
+    const secrets = {};
+    for (const provider of store.config.providers) {
+        for (const key of provider.keys) {
+            const secret = store.vault.get(key.vaultRef);
+            if (secret === undefined)
+                throw new Error(`vault is missing the secret for ${key.vaultRef} (provider ${provider.id}, key ${key.id}); fix with khat key remove + khat key add`);
+            secrets[key.vaultRef] = secret;
+        }
+    }
+    const accessToken = process.env.KHAT_ACCESS_TOKEN ?? store.vault.get(ACCESS_TOKEN_REF);
+    if (!accessToken)
+        throw new Error('no access token found (vault has none and KHAT_ACCESS_TOKEN is unset); run khat init');
+    const server = createKhatServer({ config: store.config, states: store.states, statePath, accessToken, secrets, store });
+    server.listen(store.config.port, store.config.bind, () => console.log(`khat listening on http://${store.config.bind}:${store.config.port}`));
+    const shutdown = () => {
+        console.log('shutting down…');
+        server.close(() => process.exit(0));
+        setTimeout(() => process.exit(0), 30_000).unref();
+    };
+    process.once('SIGINT', shutdown);
+    process.once('SIGTERM', shutdown);
+}
+async function runStart(foreground) {
+    if (foreground)
+        return runForeground();
+    const store = await openInitializedStore();
+    if (await daemonRunning())
+        throw new Error('khat is already running; use khat stop first');
+    const occupiedPid = await findListeningPid(store.config.port);
+    if (occupiedPid !== undefined)
+        throw new Error(`port ${store.config.port} is already occupied by process ${occupiedPid}; run 'khat stop' or stop it with taskkill /PID ${occupiedPid} /T /F`);
+    await unlink(signalPath).catch(() => undefined);
+    const supervisorPath = fileURLToPath(new URL('./supervisor.js', import.meta.url));
+    const child = spawn(process.execPath, [supervisorPath], {
+        cwd: process.cwd(),
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: true,
+        env: process.env
+    });
+    child.unref();
+    const token = process.env.KHAT_ACCESS_TOKEN ?? store.vault.get(ACCESS_TOKEN_REF);
+    if (!token)
+        throw new Error('no access token found; run khat init');
+    const started = await new Promise((resolve) => {
+        const deadline = Date.now() + 5_000;
+        const poll = async () => {
+            try {
+                const health = await fetch(`http://${store.config.bind}:${store.config.port}/_keys/health`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(500) });
+                if (health.ok) {
+                    resolve(true);
+                    return;
+                }
+            }
+            catch { }
+            if (Date.now() >= deadline) {
+                resolve(false);
+                return;
+            }
+            setTimeout(poll, 50);
+        };
+        void poll();
+    });
+    if (!started) {
+        await runStop().catch(() => undefined);
+        throw new Error('daemon started but health check failed; run khat start --foreground for diagnostics');
+    }
+    console.log(`khat started on http://${store.config.bind}:${store.config.port}`);
+}
+async function findListeningPid(port) {
+    if (process.platform !== 'win32')
+        return undefined;
+    try {
+        const { stdout } = await execFileAsync('netstat', ['-ano', '-p', 'tcp']);
+        const pattern = new RegExp(`^\\s*TCP\\s+[^\\s:]+:${port}\\s+[^\\s]+\\s+LISTENING\\s+(\\d+)\\s*$`, 'im');
+        const match = stdout.match(pattern);
+        return match ? Number.parseInt(match[1], 10) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function runStop() {
+    if (!(await daemonRunning())) {
+        const store = await openInitializedStore();
+        const listenerPid = await findListeningPid(store.config.port);
+        if (!listenerPid) {
+            console.log('khat is not running');
+            return;
+        }
+        try {
+            await execFileAsync('taskkill', ['/PID', String(listenerPid), '/T', '/F']);
+            console.log(`stopped orphaned khat process (pid ${listenerPid})`);
+            return;
+        }
+        catch {
+            throw new Error(`port ${store.config.port} is occupied by process ${listenerPid}; stop it manually with taskkill /PID ${listenerPid} /T /F`);
+        }
+    }
+    await writeFile(signalPath, 'stop\n', { mode: 0o600 });
+    const deadline = Date.now() + 35_000;
+    while (await daemonRunning()) {
+        if (Date.now() >= deadline)
+            throw new Error('timed out waiting for khat to stop');
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    console.log('khat stopped');
+}
+async function runTui() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error("khat tui requires an interactive terminal; use 'khat status', 'khat log', or 'khat ui' instead");
+    }
+    const store = await openInitializedStore();
+    const token = process.env.KHAT_ACCESS_TOKEN ?? store.vault.get(ACCESS_TOKEN_REF);
+    if (!token)
+        throw new Error('no access token found; run khat init');
+    await ensureDaemon();
+    const { runTui: startTui } = await import('./tui-main.js');
+    await startTui(`http://${store.config.bind}:${store.config.port}`, token);
+}
+async function runUi() {
+    const store = await openInitializedStore();
+    const token = process.env.KHAT_ACCESS_TOKEN ?? store.vault.get(ACCESS_TOKEN_REF);
+    if (!token)
+        throw new Error('no access token found; run khat init');
+    const baseUrl = `http://${store.config.bind}:${store.config.port}`;
+    let response;
+    try {
+        response = await fetch(`${baseUrl}/_keys/ticket`, { method: 'POST', headers: { authorization: `Bearer ${token}` } });
+    }
+    catch {
+        throw new Error('khat is not running; start it with khat start');
+    }
+    if (!response.ok)
+        throw new Error(`could not issue UI ticket: ${response.status}`);
+    const { ticket } = await response.json();
+    const url = `${baseUrl}/_keys/ui?ticket=${encodeURIComponent(ticket)}`;
+    const command = process.platform === 'win32' ? 'cmd' : process.platform === 'darwin' ? 'open' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    const browser = spawn(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+    browser.unref();
+    console.log(`Opening management page. If it does not open, visit:\n  ${url}`);
+}
+async function runLog(flags) {
+    const tail = flagInt(flags, 'tail', 50);
+    const entries = await new LogWriter(join(dataDir, 'logs')).recent(tail);
+    if (!entries.length) {
+        console.log('(no request logs)');
+        return;
+    }
+    for (const entry of entries) {
+        console.log(`${entry.ts}\t${entry.status}\t${entry.provider}/${entry.key.split('/').pop()}\t${entry.model}\t${entry.durationMs}ms\t${entry.tokensIn ?? 0}/${entry.tokensOut ?? 0} tokens`);
+    }
+}
+async function runDoctor() {
+    console.log('khat doctor');
+    console.log(`  data directory: ${dataDir}`);
+    console.log(`  proxy: ${await daemonRunning() ? 'running' : 'stopped'}`);
+    const suggestions = await inspectDoctor();
+    const names = new Set(suggestions.map((item) => item.tool));
+    for (const item of suggestions)
+        for (const line of formatDoctorSuggestion(item))
+            console.log(line);
+    for (const name of ['Codex', 'OpenCode', 'ZCode', 'Cursor'])
+        if (!names.has(name))
+            console.log(`  ${name}: not detected`);
+    if (!(await fileExists(vaultPath)))
+        console.log("  setup: not initialized; run 'khat init'");
+}
+async function runExport(path) {
+    if (!path)
+        throw new Error("usage: khat export <file>");
+    const store = await openInitializedStore();
+    if (await daemonRunning())
+        throw new Error("khat daemon is running; stop it before export");
+    const password = await promptPassword("Export password");
+    await exportPortable(path, store.vault, password, store.config);
+    console.log(`exported encrypted vault to ${path}`);
+}
+async function runImport(path, force) {
+    if (!path)
+        throw new Error("usage: khat import <file> [--force]");
+    if (await fileExists(vaultPath) && !force)
+        throw new Error(`target is already initialized at ${dataDir}; use --force to replace it`);
+    if (await daemonRunning())
+        throw new Error("khat daemon is running; stop it before import");
+    const password = await promptPassword("Import password");
+    await importPortable(path, dataDir, createKeyProtector(), password, force);
+    console.log(`imported encrypted vault into ${dataDir}`);
+}
+async function runInit() {
+    await mkdir(dataDir, { recursive: true, mode: 0o700 });
+    if (await fileExists(configPath)) {
+        console.error(`already initialized at ${configPath} (delete the directory to start over)`);
+        process.exitCode = 1;
+        return;
+    }
+    const vault = await Vault.create(vaultPath, createKeyProtector());
+    const token = generateAccessToken();
+    vault.set(ACCESS_TOKEN_REF, token);
+    await vault.save();
+    await saveJsonAtomic(configPath, defaultConfig);
+    await saveJsonAtomic(statePath, { keys: {} });
+    console.log(`Initialized ${dataDir}`);
+    console.log();
+    console.log('Access token (also available via `khat token show`):');
+    console.log(`  ${token}`);
+    console.log();
+    console.log('Point your tools at the proxy, e.g.:');
+    console.log(`  base URL:      http://${defaultConfig.bind}:${defaultConfig.port}/v1`);
+    console.log(`  Authorization: Bearer ${token}`);
+}
+const [command, ...rest] = process.argv.slice(2);
+const { positionals, flags } = parseArgs(rest);
+try {
+    switch (command ?? 'help') {
+        case 'help':
+        case '--help':
+        case '-h':
+            console.log(USAGE);
+            break;
+        case 'init':
+            await runInit();
+            break;
+        case 'export':
+            await runExport(positionals[0]);
+            break;
+        case 'import':
+            await runImport(positionals[0], flags.force === true);
+            break;
+        case 'start':
+            await runStart(flags.foreground === true);
+            break;
+        case 'stop':
+            await runStop();
+            break;
+        case 'status':
+            printStatus(await openInitializedStore());
+            break;
+        case 'doctor':
+            await runDoctor();
+            break;
+        case 'log':
+            await runLog(flags);
+            break;
+        case 'ui':
+            await runUi();
+            break;
+        case 'tui':
+            await runTui();
+            break;
+        case 'token': {
+            if (positionals[0] === 'show') {
+                const store = await openInitializedStore();
+                const token = store.vault.get(ACCESS_TOKEN_REF);
+                if (!token) {
+                    console.error('no access token in the vault; run khat init');
+                    process.exitCode = 1;
+                    break;
+                }
+                console.log(token);
+            }
+            else if (positionals[0] === 'rotate') {
+                const { token } = await adminRequest('/_keys/token/rotate', { method: 'POST' });
+                console.log('Access token rotated. Update every tool that points at khat:');
+                console.log(`  ${token}`);
+            }
+            else {
+                console.error("usage: khat token show | khat token rotate");
+                process.exitCode = 1;
+            }
+            break;
+        }
+        case 'provider': {
+            const action = positionals[0];
+            if (action === 'add') {
+                const id = positionals[1];
+                const baseUrl = flagString(flags, 'base-url');
+                if (!id || !baseUrl) {
+                    console.error('usage: khat provider add <id> --base-url <url> [--name <n>] [--protocol openai|anthropic]');
+                    process.exitCode = 1;
+                    break;
+                }
+                const protocol = (flagString(flags, 'protocol') ?? 'openai');
+                if (protocol !== 'openai' && protocol !== 'anthropic')
+                    throw new Error(`unsupported protocol '${protocol}' (use 'openai' or 'anthropic')`);
+                await adminRequest('/_keys/providers', { method: 'POST', body: JSON.stringify({ id, name: flagString(flags, 'name'), protocol, baseUrl: baseUrl.replace(/\/+$/, '') }) });
+                console.log(`added provider ${id} -> ${baseUrl}`);
+            }
+            else if (action === 'list') {
+                const store = await openInitializedStore();
+                if (!store.config.providers.length)
+                    console.log('(no providers)');
+                for (const provider of store.config.providers)
+                    console.log(`${provider.id}\t${provider.protocol}\t${provider.baseUrl}\t${provider.keys.length} key(s)`);
+            }
+            else if (action === 'update') {
+                const id = positionals[1];
+                if (!id || (!flagString(flags, 'name') && !flagString(flags, 'base-url') && !flagString(flags, 'protocol')))
+                    throw new Error('usage: khat provider update <id> [--name <n>] [--base-url <url>] [--protocol openai|anthropic]');
+                const protocol = flagString(flags, 'protocol');
+                if (protocol && protocol !== 'openai' && protocol !== 'anthropic')
+                    throw new Error(`unsupported protocol '${protocol}'`);
+                await adminRequest(`/_keys/providers/${encodeURIComponent(id)}`, { method: 'PUT', body: JSON.stringify({ name: flagString(flags, 'name'), baseUrl: flagString(flags, 'base-url'), protocol }) });
+                console.log(`updated provider ${id}`);
+            }
+            else if (action === 'remove') {
+                const id = positionals[1];
+                if (!id) {
+                    console.error('usage: khat provider remove <id>');
+                    process.exitCode = 1;
+                    break;
+                }
+                await adminRequest(`/_keys/providers/${encodeURIComponent(id)}`, { method: 'DELETE' });
+                console.log(`removed provider ${id} (its keys and routes were removed too)`);
+            }
+            else {
+                console.error('usage: khat provider add | list | update | remove');
+                process.exitCode = 1;
+            }
+            break;
+        }
+        case 'key': {
+            const action = positionals[0];
+            if (action === 'add') {
+                const [providerId, keyId] = [positionals[1], positionals[2]];
+                if (!providerId || !keyId) {
+                    console.error('usage: khat key add <provider> <id> [--weight <n>] [--value <v>]');
+                    process.exitCode = 1;
+                    break;
+                }
+                const value = flagString(flags, 'value') ?? (await promptSecret(`Paste the API key for ${providerId}/${keyId}`));
+                await adminRequest(`/_keys/providers/${encodeURIComponent(providerId)}/keys`, { method: 'POST', body: JSON.stringify({ id: keyId, value, weight: flagInt(flags, 'weight', 1) }) });
+                console.log(`added key ${providerId}/${keyId} (stored encrypted in vault)`);
+            }
+            else if (action === 'list') {
+                const store = await openInitializedStore();
+                const providers = positionals[1] ? store.config.providers.filter((item) => item.id === positionals[1]) : store.config.providers;
+                if (positionals[1] && !providers.length)
+                    throw new Error(`unknown provider: ${positionals[1]}`);
+                for (const provider of providers) {
+                    for (const key of provider.keys) {
+                        const secret = store.vault.get(key.vaultRef);
+                        const { status, note } = keyStatusLine(store, provider.id, key.id);
+                        console.log(`${provider.id}/${key.id}\tweight ${key.weight}\t${status}\t${secret ? maskSecret(secret) : '(missing from vault!)'}${note ? `\t${note}` : ''}`);
+                    }
+                }
+            }
+            else if (action === 'remove') {
+                const [providerId, keyId] = [positionals[1], positionals[2]];
+                if (!providerId || !keyId) {
+                    console.error('usage: khat key remove <provider> <id>');
+                    process.exitCode = 1;
+                    break;
+                }
+                await adminRequest(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}`, { method: 'DELETE' });
+                console.log(`removed key ${providerId}/${keyId}`);
+            }
+            else if (action === 'update') {
+                const [providerId, keyId] = [positionals[1], positionals[2]];
+                if (!providerId || !keyId || (flagString(flags, 'weight') === undefined && flagString(flags, 'value') === undefined))
+                    throw new Error('usage: khat key update <provider> <id> [--weight <n>] [--value <v>]');
+                await adminRequest(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}`, { method: 'PUT', body: JSON.stringify({ weight: flagString(flags, 'weight') === undefined ? undefined : flagInt(flags, 'weight', 1), value: flagString(flags, 'value') }) });
+                console.log(`updated key ${providerId}/${keyId}`);
+            }
+            else if (action === 'enable') {
+                const [providerId, keyId] = [positionals[1], positionals[2]];
+                if (!providerId || !keyId) {
+                    console.error('usage: khat key enable <provider> <id>');
+                    process.exitCode = 1;
+                    break;
+                }
+                await adminRequest(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}/enable`, { method: 'POST' });
+                console.log(`${providerId}/${keyId} is available again`);
+            }
+            else if (action === 'test') {
+                const [providerId, keyId] = [positionals[1], positionals[2]];
+                if (!providerId || !keyId) {
+                    console.error('usage: khat key test <provider> <id> [--model <m>]');
+                    process.exitCode = 1;
+                    break;
+                }
+                const store = await openInitializedStore();
+                const provider = store.config.providers.find((item) => item.id === providerId);
+                if (!provider)
+                    throw new Error(`unknown provider: ${providerId}`);
+                const key = provider.keys.find((item) => item.id === keyId);
+                if (!key)
+                    throw new Error(`unknown key: ${providerId}/${keyId}`);
+                const secret = store.vault.get(key.vaultRef);
+                if (!secret)
+                    throw new Error(`vault is missing the secret for ${key.vaultRef}`);
+                const model = flagString(flags, 'model') ?? store.config.routes.find((route) => route.provider === providerId)?.model;
+                if (!model)
+                    throw new Error('no route tells which model to probe; pass --model <name>');
+                const anthropic = provider.protocol === 'anthropic';
+                const path = anthropic ? '/v1/messages' : '/v1/chat/completions';
+                const headers = anthropic
+                    ? { 'content-type': 'application/json', 'x-api-key': secret, 'anthropic-version': '2023-06-01' }
+                    : { 'content-type': 'application/json', authorization: `Bearer ${secret}` };
+                const body = anthropic
+                    ? JSON.stringify({ model, max_tokens: 1, messages: [{ role: 'user', content: 'ping' }] })
+                    : JSON.stringify({ model, messages: [{ role: 'user', content: 'ping' }], max_tokens: 1, stream: false });
+                console.log(`probing ${provider.baseUrl}${path} with model ${model}…`);
+                const response = await fetch(new URL(path, provider.baseUrl), {
+                    method: 'POST',
+                    headers,
+                    body,
+                    signal: AbortSignal.timeout(30_000)
+                });
+                console.log(`HTTP ${response.status}`);
+                if (response.ok) {
+                    await adminRequest(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}/enable`, { method: 'POST' });
+                    console.log(`${providerId}/${keyId} is available`);
+                }
+                else if ([401, 402, 429].includes(response.status))
+                    console.log('this error marks a key unavailable during proxying; check the key on the provider side');
+            }
+            else {
+                console.error('usage: khat key add | list | update | remove | enable | test');
+                process.exitCode = 1;
+            }
+            break;
+        }
+        case 'route': {
+            const action = positionals[0];
+            if (action === 'add') {
+                const [model, providerId] = [positionals[1], positionals[2]];
+                if (!model || !providerId) {
+                    console.error('usage: khat route add <model> <provider>');
+                    process.exitCode = 1;
+                    break;
+                }
+                await adminRequest('/_keys/routes', { method: 'POST', body: JSON.stringify({ model, provider: providerId }) });
+                console.log(`route added: ${model} -> ${providerId}`);
+            }
+            else if (action === 'list') {
+                const store = await openInitializedStore();
+                if (!store.config.routes.length)
+                    console.log('(no routes)');
+                for (const route of store.config.routes)
+                    console.log(`${route.model} -> ${route.provider}`);
+            }
+            else if (action === 'update') {
+                const [model, providerId] = [positionals[1], positionals[2]];
+                if (!model || !providerId)
+                    throw new Error('usage: khat route update <model> <provider>');
+                await adminRequest(`/_keys/routes/${encodeURIComponent(model)}`, { method: 'PUT', body: JSON.stringify({ provider: providerId }) });
+                console.log(`route updated: ${model} -> ${providerId}`);
+            }
+            else if (action === 'remove') {
+                const model = positionals[1];
+                if (!model) {
+                    console.error('usage: khat route remove <model>');
+                    process.exitCode = 1;
+                    break;
+                }
+                await adminRequest(`/_keys/routes?model=${encodeURIComponent(model)}`, { method: 'DELETE' });
+                console.log(`route removed: ${model}`);
+            }
+            else {
+                console.error('usage: khat route add | list | update | remove');
+                process.exitCode = 1;
+            }
+            break;
+        }
+        default:
+            console.error(`unknown command: ${command}\n`);
+            console.log(USAGE);
+            process.exitCode = 1;
+    }
+}
+catch (error) {
+    console.error(`error: ${error?.message ?? error}`);
+    process.exitCode = 1;
+}