@lasso-ai/cli 2.1.1 → 2.1.3

package/dist/cli/bridge.js

@@ -151,6 +151,22 @@ async function startBridge(cwd = process.cwd(), collabConfig = null, bridgePort
         ...readEnvFile(root, ".env.local"),
         ...readEnvFile(root, ".env.production"),
     }), {});
+    // Resolve the user's own model-provider key (BYOK) for hosted runs: the
+    // server calls the provider with it and never stores it.
+    const PROVIDER_ENV_KEYS = {
+        anthropic: ["ANTHROPIC_API_KEY"],
+        openai: ["OPENAI_API_KEY"],
+        google: ["GOOGLE_GENERATIVE_AI_API_KEY", "GOOGLE_API_KEY"],
+        nvidia: ["NVIDIA_API_KEY"],
+    };
+    function providerApiKeyFor(provider) {
+        for (const envName of PROVIDER_ENV_KEYS[provider] || []) {
+            const value = (process.env[envName] || fileEnv[envName] || "").trim();
+            if (value)
+                return value;
+        }
+        return undefined;
+    }
     const cliCredentials = (0, auth_1.loadCredentials)();
     const resolvedLassoKey = cliCredentials?.apiKey ||
         (0, project_1.resolveLassoApiKey)(fileEnv) ||
@@ -425,7 +441,7 @@ async function startBridge(cwd = process.cwd(), collabConfig = null, bridgePort
             // already rolled back at that point).
             await facade.runSession(session.id, cwd, (event) => {
                 handleRuntimeEvent(event, socket, taskId, session, `Runtime session: ${instruction}`, true);
-            }, controller.signal);
+            }, controller.signal, { providerApiKey: providerApiKeyFor(provider) });
         }
         catch (error) {
             socket.send(JSON.stringify({
@@ -575,7 +591,7 @@ async function startBridge(cwd = process.cwd(), collabConfig = null, bridgePort
         try {
             await facade.runSession(session.id, cwd, (event) => {
                 handleRuntimeEvent(event, socket, taskId, session, "Corrective run", true);
-            }, controller.signal);
+            }, controller.signal, { providerApiKey: providerApiKeyFor(session.model?.provider || "") });
         }
         catch (error) {
             socket.send(JSON.stringify({
@@ -734,7 +750,7 @@ async function startBridge(cwd = process.cwd(), collabConfig = null, bridgePort
                         message: "Oneshot completed",
                     }));
                 }
-            }, controller.signal);
+            }, controller.signal, { providerApiKey: providerApiKeyFor(provider) });
         }
         catch (error) {
             socket.send(JSON.stringify({

package/dist/cli/local-runtime.d.ts

@@ -14,7 +14,9 @@ export declare class LocalRuntime implements RuntimeFacade {
     private abortControllers;
     createSession(input: RuntimeSessionInput): Promise<RuntimeSession>;
     getSession(sessionId: string): Promise<RuntimeSession>;
-    runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal): Promise<void>;
+    runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal, _opts?: {
+        providerApiKey?: string;
+    }): Promise<void>;
     verifySession(sessionId: string, projectPath: string): Promise<SessionVerificationResult>;
     switchModel(sessionId: string, model: {
         provider: string;

package/dist/cli/local-runtime.js

@@ -63,7 +63,8 @@ class LocalRuntime {
             throw new Error("Session not found");
         return this.toSession(record);
     }
-    async runSession(sessionId, projectPath, onEvent, signal) {
+    async runSession(sessionId, projectPath, onEvent, signal, _opts // local agents run in-process; no server/model key needed
+    ) {
         const record = this.sessions.get(sessionId);
         if (!record)
             throw new Error("Session not found");

package/dist/cli/project.js

@@ -394,8 +394,32 @@ async function resolveWorkspaceConfig(fileEnv) {
 async function fetchModels(fileEnv) {
     const serverUrl = (0, auth_1.serverUrlFrom)(fileEnv).replace(/\/$/, "");
     const apiUrl = `${serverUrl}/api/v1`;
+    // Pass the user's own provider keys (BYOK) so the server can list live
+    // models per provider instead of falling back to empty/static lists.
+    const envKey = (...names) => {
+        for (const name of names) {
+            const value = (process.env[name] || fileEnv[name] || "").trim();
+            if (value)
+                return value;
+        }
+        return "";
+    };
+    const query = new URLSearchParams();
+    const anthropicKey = envKey("ANTHROPIC_API_KEY");
+    const openaiKey = envKey("OPENAI_API_KEY");
+    const googleKey = envKey("GOOGLE_GENERATIVE_AI_API_KEY", "GOOGLE_API_KEY");
+    const nvidiaKey = envKey("NVIDIA_API_KEY");
+    if (anthropicKey)
+        query.set("anthropicKey", anthropicKey);
+    if (openaiKey)
+        query.set("openaiKey", openaiKey);
+    if (googleKey)
+        query.set("googleKey", googleKey);
+    if (nvidiaKey)
+        query.set("nvidiaKey", nvidiaKey);
+    const qs = query.toString();
     try {
-        const response = await (0, auth_1.fetchWithTimeout)(`${apiUrl}/models`, {
+        const response = await (0, auth_1.fetchWithTimeout)(`${apiUrl}/models${qs ? `?${qs}` : ""}`, {
             method: "GET",
         });
         if (!response.ok) {

package/dist/cli/runtime-client.d.ts

@@ -137,7 +137,9 @@ export interface SessionVerificationResult {
  */
 export interface RuntimeFacade {
     createSession(input: RuntimeSessionInput): Promise<RuntimeSession>;
-    runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal): Promise<void>;
+    runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal, opts?: {
+        providerApiKey?: string;
+    }): Promise<void>;
     getSession(sessionId: string): Promise<RuntimeSession>;
     verifySession(sessionId: string, projectPath: string): Promise<SessionVerificationResult>;
     switchModel(sessionId: string, model: {
@@ -288,7 +290,9 @@ export declare class RuntimeClient {
      *   3. On agent_completed: diff the workspace, roll it back, and cache the
      *      changes for the review panel. Only user approval re-applies them.
      */
-    runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal): Promise<void>;
+    runSession(sessionId: string, projectPath: string, onEvent: RuntimeEventHandler, signal?: AbortSignal, opts?: {
+        providerApiKey?: string;
+    }): Promise<void>;
     /** Execute a tool_call request locally against the real project. */
     private executeToolCallLocally;
     /** Post a tool result back to the server (resolves its pending request). */

package/dist/cli/runtime-client.js

@@ -77,7 +77,7 @@ class RuntimeClient {
      *   3. On agent_completed: diff the workspace, roll it back, and cache the
      *      changes for the review panel. Only user approval re-applies them.
      */
-    async runSession(sessionId, projectPath, onEvent, signal) {
+    async runSession(sessionId, projectPath, onEvent, signal, opts) {
         // CLI-side snapshot: nothing the agent does is left on disk before review.
         let guard = null;
         try {
@@ -127,7 +127,9 @@ class RuntimeClient {
                 "Content-Type": "application/json",
                 ...(this.apiKey && { "Authorization": `Bearer ${this.apiKey}` }),
             },
-            body: JSON.stringify({ projectPath }),
+            // providerApiKey is the user's own model-provider key (BYOK): the
+            // server calls the hosted model with it and never stores it.
+            body: JSON.stringify({ projectPath, apiKey: opts?.providerApiKey }),
             signal,
         });
         if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lasso-ai/cli",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Select any part of your running app, describe a change, and let AI edit the real source code.",
   "type": "commonjs",
   "main": "dist/cli/index.js",