@ngockhoale/ukit 3.1.3 → 3.1.5

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to UKit are documented here.
 
+## 3.1.5 - 2026-09-26
+
+- **Install/update warns when the decision lane has no API key.** After a project refresh, `ukit install` (and `ukit update`'s refresh) prints a bold-red warning with setup instructions — `ukit decision --base-url <url> --key <key>`, `~/.ukit/storage/gatewayDecision.json`, or `UKIT_DECISION_API_KEY` — whenever no dedicated decision key and no shared UNIC token are resolvable. When a key (or the shared UNIC token fallback) is found, a one-line confirmation is printed instead.
+
+## 3.1.4 - 2026-09-26
+
+- **`ukit decision` — user-facing decision-lane gateway setup.** Resolution order (per field): env `UKIT_DECISION_BASE_URL`/`UKIT_DECISION_API_KEY`/`UKIT_DECISION_SCHEME` → `~/.ukit/storage/gatewayDecision.json` (new per-lane file; `gateway<Lane>.json` pattern) → `~/.ukit/storage/config.json` `decisionGateway` → `openai.unicjsc.com` + shared UNIC token. File field names mirror the env vars; `scheme` selects `Authorization: Bearer` vs `x-api-key`. Both files are seeded by `ukit install` with the full key set (`mergeStrategy: skip` — `ukit update` never overwrites user values). Commands: `--status`, `--base-url/--key/--scheme`, `--set-unic`, `--clear`.
+
 ## 3.1.3 - 2026-09-26
 
 - **`unic-decision-multilingual` becomes the shipped default checkpoint** — the variant is credential-bound on UNIC Provider (verified via live `health-probe` + `safe-vs-risky-lane` decision). `english`/`unknownLanguage` classes keep the bare `unic-decision` alias; `model_not_found` auto-fallback still covers unbound variants.

package/manifests/platform.user.yaml

@@ -41,6 +41,17 @@ items:
     packs:
       - core
 
+  - id: user-gateway-decision
+    type: config
+    sourceTemplate: storage/gatewayDecision.json
+    targetPath: storage/gatewayDecision.json
+    requires: []
+    mergeStrategy: skip
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
   - id: user-playbook-issue
     type: config
     sourceTemplate: playbooks/issue-implementation.md

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.1.3",
+  "version": "3.1.5",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/cli/commands/decision.js

@@ -0,0 +1,150 @@
+// `ukit decision` — decision-lane gateway setup (S6 follow-up 2026-09-26).
+//
+// The decision lane resolves its own endpoint/key independently of the
+// engine's LLM gateway: ~/.ukit/storage/gatewayDecision.json →
+// ~/.ukit/storage/config.json "decisionGateway" → UKIT_DECISION_* env →
+// default https://openai.unicjsc.com + shared UNIC token fallback. This
+// command edits gatewayDecision.json (one file per lane: gateway<Lane>.json)
+// so a user who runs the engine on a non-UNIC provider (e.g. OpenAI) can
+// point the decision lane at UNIC — or anywhere — without hand-editing JSON.
+//
+// Usage:
+//   ukit decision --status            resolved baseUrl/key source + redacted key
+//   ukit decision --set-unic          reset to UNIC defaults (empty overrides)
+//   ukit decision --base-url <url> --key <k> [--scheme auth-token|api-key]
+//   ukit decision --key <k>           update key only (keeps stored baseUrl)
+//   ukit decision --clear             reset fields to template defaults
+//
+// Writes are atomic-ish (tmp + rename); unknown keys are preserved verbatim.
+
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { resolveDecisionBaseUrl, resolveDecisionApiKey } from '../../core/gatewayProbe.js';
+
+const GATEWAY_FILE = path.join('.ukit', 'storage', 'gatewayDecision.json');
+const UNIC_DEFAULT = 'https://openai.unicjsc.com';
+// Template defaults — written on --clear/--set-unic so the file always keeps
+// its full key set (empty = default endpoint + shared UNIC token). Field
+// names mirror the env vars exactly.
+const TEMPLATE_BLOCK = {
+  _help: "unic-decision lane endpoint. Empty UKIT_DECISION_BASE_URL = default https://openai.unicjsc.com + shared UNIC token. UKIT_DECISION_SCHEME: 'auth-token' (Bearer) or 'api-key' (x-api-key).",
+  UKIT_DECISION_BASE_URL: '',
+  UKIT_DECISION_API_KEY: '',
+  UKIT_DECISION_SCHEME: 'auth-token',
+};
+
+const VALID_SCHEMES = new Set(['auth-token', 'api-key']);
+const HELP_FLAGS = new Set(['--help', '-h', 'help']);
+
+function printUsage(stream = console.log) {
+  stream('Usage: ukit decision --status');
+  stream('       ukit decision --base-url <url> --key <key> [--scheme auth-token|api-key]');
+  stream('       ukit decision --key <key>');
+  stream('       ukit decision --set-unic | --clear');
+  stream('');
+  stream('Configure the decision-lane gateway (unic-decision plane), stored in');
+  stream(`~/${GATEWAY_FILE.replaceAll(path.sep, '/')}. The decision`);
+  stream('lane is independent of the engine LLM endpoint (ANTHROPIC_BASE_URL etc.) —');
+  stream('point it at UNIC even when Claude/Codex/omp run on another provider.');
+}
+
+function parseArgs(argv) {
+  const out = { setUnic: false, clear: false, status: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--base-url') out.baseUrl = argv[++i];
+    else if (a === '--key') out.key = argv[++i];
+    else if (a === '--scheme') out.scheme = argv[++i];
+    else if (a === '--set-unic') out.setUnic = true;
+    else if (a === '--clear') out.clear = true;
+    else if (a === '--status') out.status = true;
+    else return { error: `unknown flag: ${a}` };
+  }
+  return out;
+}
+
+async function readGatewayFile(filePath) {
+  try {
+    return JSON.parse(await fs.readFile(filePath, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+async function writeGatewayFile(filePath, json) {
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+  const tmp = `${filePath}.tmp-${process.pid}`;
+  await fs.writeFile(tmp, JSON.stringify(json, null, 2) + '\n', { mode: 0o600 });
+  await fs.rename(tmp, filePath);
+}
+
+function redact(value) {
+  if (!value) return null;
+  return value.length <= 8 ? '***' : `${value.slice(0, 4)}…${value.slice(-4)}`;
+}
+
+async function printStatus(projectRoot, homeDir = os.homedir()) {
+  const base = resolveDecisionBaseUrl({ homeDir });
+  const key = await resolveDecisionApiKey({ projectRoot, homeDir });
+  console.log(JSON.stringify({
+    baseUrl: base.baseUrl,
+    baseUrlSource: base.source,
+    apiKey: redact(key.value),
+    apiKeySource: key.source,
+    scheme: key.scheme,
+    overrideFile: path.join(homeDir, GATEWAY_FILE),
+  }, null, 2));
+}
+
+export async function runDecision({ projectRoot, argv, homeDir = os.homedir() }) {
+  if (argv.some((a) => HELP_FLAGS.has(a))) {
+    printUsage();
+    return;
+  }
+  const args = parseArgs(argv);
+  if (args.error) {
+    console.error(args.error);
+    printUsage(console.error);
+    process.exitCode = 1;
+    return;
+  }
+  if (args.scheme && !VALID_SCHEMES.has(args.scheme)) {
+    console.error(`--scheme must be one of: ${[...VALID_SCHEMES].join(', ')}`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const filePath = path.join(homeDir, GATEWAY_FILE);
+
+  if (args.status || (!args.baseUrl && !args.key && !args.setUnic && !args.clear)) {
+    await printStatus(projectRoot, homeDir);
+    return;
+  }
+
+  const json = await readGatewayFile(filePath);
+
+  if (args.clear || args.setUnic) {
+    // Reset to the full template block — the file always keeps its complete
+    // key set so the user only has to fill in values.
+    const out = { ...TEMPLATE_BLOCK };
+    if (args.setUnic) out.UKIT_DECISION_BASE_URL = UNIC_DEFAULT;
+    for (const key of Object.keys(json)) if (!(key in out)) out[key] = json[key];
+    await writeGatewayFile(filePath, out);
+    await printStatus(projectRoot, homeDir);
+    return;
+  }
+
+  if (!args.baseUrl && !args.key && !args.scheme) {
+    console.error('nothing to set — pass --base-url, --key and/or --scheme');
+    process.exitCode = 1;
+    return;
+  }
+  const out = { ...TEMPLATE_BLOCK, ...json };
+  if (args.baseUrl) out.UKIT_DECISION_BASE_URL = args.baseUrl;
+  if (args.key) out.UKIT_DECISION_API_KEY = args.key;
+  if (args.scheme) out.UKIT_DECISION_SCHEME = args.scheme;
+
+  await writeGatewayFile(filePath, out);
+  await printStatus(projectRoot, homeDir);
+}

package/src/cli/commands/install.js

@@ -2,6 +2,7 @@ import { buildPathConfig } from '../../core/paths.js';
 import { runInstallPipeline } from '../../core/runInstallPipeline.js';
 import { formatRepairReport } from '../../core/repairBrokenHooks.js';
 import { formatGatewayResilienceReport } from '../../core/gatewayResilienceEnv.js';
+import { resolveDecisionApiKey, resolveDecisionBaseUrl } from '../../core/gatewayProbe.js';
 import { buildCodeIndex, buildDerivedIndexArtifacts } from '../../index/buildIndex.js';
 import { installIndexRefreshHooks } from '../../index/gitHooks.js';
 import fs from 'node:fs/promises';
@@ -339,6 +340,29 @@ export async function runInstall({ packageRoot, projectRoot, packageVersion, arg
     console.log(`[UKit] ${line}`);
   }
 
+  // Decision-lane credential check: warn (bold red) when no dedicated key is
+  // configured. Resolution: env UKIT_DECISION_API_KEY →
+  // ~/.ukit/storage/gatewayDecision.json → config.json decisionGateway →
+  // shared UNIC token. Tell the user exactly how to set it.
+  try {
+    const decisionKey = await resolveDecisionApiKey({ projectRoot });
+    const decisionBase = resolveDecisionBaseUrl({});
+    const R = '';
+    const X = '';
+    if (!decisionKey?.value) {
+      console.warn(`${R}[UKit] WARNING — decision lane (unic-decision) has NO API key configured.${X}`);
+      console.warn(`${R}[UKit] The typed-decision features will report 'unavailable' and fall back to deterministic rules.${X}`);
+      console.warn(`${R}[UKit] Set it with:  ukit decision --base-url https://openai.unicjsc.com --key <YOUR_KEY>${X}`);
+      console.warn(`${R}[UKit] Or edit ~/.ukit/storage/gatewayDecision.json -> UKIT_DECISION_API_KEY, or export UKIT_DECISION_API_KEY=<key>.${X}`);
+    } else if (decisionKey.source === 'shared-unic-token') {
+      console.log(`[UKit] Decision lane: using shared UNIC token at ${decisionBase.baseUrl} (no dedicated key needed).`);
+    } else {
+      console.log(`[UKit] Decision lane: key configured (${decisionKey.source}) at ${decisionBase.baseUrl}.`);
+    }
+  } catch {
+    // advisory only — never fail install on the check
+  }
+
   const docsLabels = [
     'docs/PROJECT.md',
     'docs/MEMORY.md',

package/src/cli/index.js

@@ -11,7 +11,7 @@ import { runMetrics } from './commands/metrics.js';
 import { runTelemetry } from './commands/telemetry.js';
 import { runFeedback } from './commands/feedback.js';
 import { runPlaybook } from './commands/playbook.js';
-
+import { runDecision } from './commands/decision.js';
 const GLOBAL_FLAGS = new Set(['--help', '-h', '--version', '-v']);
 
 export async function runCli({ argv, packageRoot, projectRoot, packageVersion }) {
@@ -94,6 +94,11 @@ export async function runCli({ argv, packageRoot, projectRoot, packageVersion })
     return;
   }
 
+  if (command === 'decision') {
+    await runDecision({ projectRoot, argv: commandArgv });
+    return;
+  }
+
   if (command === 'build' && (commandArgv[0] ?? '').toLowerCase() === 'index') {
     await runIndexTools({ projectRoot, argv: ['build', ...commandArgv.slice(1)] });
     return;

package/src/core/gatewayProbe.js

@@ -26,45 +26,61 @@ const SETTINGS_RELATIVE_PROBE_PATH = path.join('.claude', 'settings.json');
 // --- Decision-plane gateway resolution (UNIC_DECISION_MIGRATION backlog) -----
 // The decision plane is a SEPARATE lane from the host's LLM endpoint: it must
 // reach the UNIC OpenAI-compatible provider no matter what Claude Code/omp is
-// configured to. Chain: ~/.ukit/storage/gateway.json {decision:{baseUrl,
-// apiKey, scheme}} → env UKIT_DECISION_BASE_URL / UKIT_DECISION_API_KEY →
-// DEFAULT_DECISION_BASE_URL + the shared UNIC token (ANTHROPIC_*) so a host
-// already pointed at UNIC works with zero extra config. Missing key → the
-// caller surfaces 'unavailable' and deterministic policy stays authoritative.
+// configured to. Override chain (first hit wins, per field):
+//   1. env UKIT_DECISION_BASE_URL / UKIT_DECISION_API_KEY / UKIT_DECISION_SCHEME
+//   2. ~/.ukit/storage/gatewayDecision.json — fields are named exactly like
+//      the env vars ({UKIT_DECISION_BASE_URL, UKIT_DECISION_API_KEY,
+//      UKIT_DECISION_SCHEME}); one file per lane: gateway<Lane>.json.
+//   3. ~/.ukit/storage/config.json -> "decisionGateway" (same env-style names)
+//   4. DEFAULT_DECISION_BASE_URL + the shared UNIC token (ANTHROPIC_*).
+// Missing key → the caller surfaces 'unavailable' and deterministic policy
+// stays authoritative.
 export const DEFAULT_DECISION_BASE_URL = 'https://openai.unicjsc.com';
-const USER_GATEWAY_REL = path.join('.ukit', 'storage', 'gateway.json');
+const USER_GATEWAY_REL = path.join('.ukit', 'storage', 'gatewayDecision.json');
+const USER_CONFIG_REL = path.join('.ukit', 'storage', 'config.json');
 
-function readUserGatewayDecision(homeDir) {
-  if (!homeDir) return null;
-  const json = safeReadJson(path.join(homeDir, USER_GATEWAY_REL));
-  const decision = json?.decision;
-  return decision && typeof decision === 'object' ? decision : null;
+function readUserDecisionBlock(homeDir) {
+  if (!homeDir) return {};
+  const g = safeReadJson(path.join(homeDir, USER_GATEWAY_REL));
+  const c = safeReadJson(path.join(homeDir, USER_CONFIG_REL))?.decisionGateway;
+  const gj = g && typeof g === 'object' ? g : null;
+  const cj = c && typeof c === 'object' ? c : null;
+  // Field-level merge — the lane file wins field-by-field over the config
+  // block (env still outranks both, applied by the resolvers below).
+  return {
+    baseUrl: pickString(gj?.UKIT_DECISION_BASE_URL, cj?.UKIT_DECISION_BASE_URL),
+    apiKey: pickString(gj?.UKIT_DECISION_API_KEY, cj?.UKIT_DECISION_API_KEY),
+    scheme: pickString(gj?.UKIT_DECISION_SCHEME, cj?.UKIT_DECISION_SCHEME),
+    source: gj ? 'gatewayDecision-json' : (cj ? 'ukit-config-json' : null),
+  };
 }
 
 // Endpoint for the decision lane. Never throws; file and env malformed values
 // are ignored, the default is the final fallback (not ANTHROPIC_BASE_URL —
-// that env may point at a non-decision gateway).
+// that env may point at a non-decision gateway). Env wins over the user files.
 export function resolveDecisionBaseUrl({ homeDir = os.homedir(), env = process.env } = {}) {
-  const file = readUserGatewayDecision(homeDir);
-  const fromFile = pickString(file?.baseUrl);
-  if (fromFile) return { baseUrl: fromFile, source: 'ukit-gateway-json' };
   const fromEnv = pickString(env?.UKIT_DECISION_BASE_URL);
   if (fromEnv) return { baseUrl: fromEnv, source: 'env' };
+  const block = readUserDecisionBlock(homeDir);
+  if (block.baseUrl) return { baseUrl: block.baseUrl, source: block.source };
   return { baseUrl: DEFAULT_DECISION_BASE_URL, source: 'default' };
 }
 
-// API key for the decision lane. `scheme`: 'auth-token' → Authorization: Bearer
-// (UNIC OpenAI-compatible default) | 'api-key' → x-api-key. Falls back to the
+// API key for the decision lane. `scheme` (env UKIT_DECISION_SCHEME or the
+// file field of the same name): 'auth-token' → Authorization: Bearer (UNIC
+// OpenAI-compatible default) | 'api-key' → x-api-key. Falls back to the
 // host's UNIC token so existing installs need no duplicate credential.
 export function resolveDecisionApiKey({ projectRoot, homeDir = os.homedir(), env = process.env } = {}) {
-  const file = readUserGatewayDecision(homeDir);
-  const fileKey = pickString(file?.apiKey);
-  if (fileKey) {
-    const scheme = file?.scheme === 'api-key' ? 'api-key' : 'auth-token';
-    return { value: fileKey, scheme, source: 'ukit-gateway-json' };
-  }
   const envKey = pickString(env?.UKIT_DECISION_API_KEY);
-  if (envKey) return { value: envKey, scheme: 'auth-token', source: 'env' };
+  if (envKey) {
+    const envScheme = env?.UKIT_DECISION_SCHEME === 'api-key' ? 'api-key' : 'auth-token';
+    return { value: envKey, scheme: envScheme, source: 'env' };
+  }
+  const block = readUserDecisionBlock(homeDir);
+  if (block.apiKey) {
+    const scheme = block.scheme === 'api-key' ? 'api-key' : 'auth-token';
+    return { value: block.apiKey, scheme, source: block.source };
+  }
   const shared = resolveGatewayApiKey({ projectRoot, homeDir, env });
   if (shared?.value) return { ...shared, source: 'shared-unic-token' };
   return { value: null, scheme: null, source: null };

package/src/decision/client.js

@@ -210,7 +210,7 @@ export function createDecisionClient({
   }
 
   async function resolveEndpoint() {
-    // Decision lane resolves its own endpoint (user-level gateway.json →
+    // Decision lane resolves its own endpoint (gatewayDecision.json →
     // env → openai.unicjsc.com default), independent of the host's LLM
     // endpoint — the UNIC provider is used even when the engine points
     // elsewhere.

package/template_project/.claude/ukit/index/unic-decision.mjs

@@ -332,37 +332,49 @@ function pickString(...candidates) {
 
 // --- Decision-plane gateway resolution -------------------------------------
 // The decision lane is independent of the host's LLM endpoint: default is the
-// UNIC OpenAI-compatible provider; ~/.ukit/storage/gateway.json {decision:
-// {baseUrl, apiKey, scheme}} overrides; env UKIT_DECISION_BASE_URL /
-// UKIT_DECISION_API_KEY next; the shared UNIC token (ANTHROPIC_*) is the
-// credential fallback so existing installs need nothing extra.
+// UNIC OpenAI-compatible provider. Override chain (first hit wins per field):
+//   1. env UKIT_DECISION_BASE_URL / UKIT_DECISION_API_KEY / UKIT_DECISION_SCHEME
+//   2. ~/.ukit/storage/gatewayDecision.json — fields named exactly like the
+//      env vars; one file per lane: gateway<Lane>.json.
+//   3. ~/.ukit/storage/config.json -> "decisionGateway" (same env-style names)
+//   4. shared UNIC token (ANTHROPIC_*) — existing installs need nothing extra.
 const DEFAULT_DECISION_BASE_URL = 'https://openai.unicjsc.com';
-const USER_GATEWAY_REL = () => path.join('.ukit', 'storage', 'gateway.json');
-
-function readUserGatewayDecision(homeDir) {
-  if (!homeDir) return null;
-  const json = safeReadJson(path.join(homeDir, USER_GATEWAY_REL()));
-  const decision = json?.decision;
-  return decision && typeof decision === 'object' ? decision : null;
+const USER_GATEWAY_REL = () => path.join('.ukit', 'storage', 'gatewayDecision.json');
+const USER_CONFIG_REL = () => path.join('.ukit', 'storage', 'config.json');
+
+function readUserDecisionBlock(homeDir) {
+  if (!homeDir) return {};
+  const g = safeReadJson(path.join(homeDir, USER_GATEWAY_REL()));
+  const c = safeReadJson(path.join(homeDir, USER_CONFIG_REL()))?.decisionGateway;
+  const gj = g && typeof g === 'object' ? g : null;
+  const cj = c && typeof c === 'object' ? c : null;
+  return {
+    baseUrl: pickString(gj?.UKIT_DECISION_BASE_URL, cj?.UKIT_DECISION_BASE_URL),
+    apiKey: pickString(gj?.UKIT_DECISION_API_KEY, cj?.UKIT_DECISION_API_KEY),
+    scheme: pickString(gj?.UKIT_DECISION_SCHEME, cj?.UKIT_DECISION_SCHEME),
+    source: gj ? 'gatewayDecision-json' : (cj ? 'ukit-config-json' : null),
+  };
 }
 
 function resolveDecisionBaseUrl({ homeDir, env }) {
-  const fileUrl = pickString(readUserGatewayDecision(homeDir)?.baseUrl);
-  if (fileUrl) return { baseUrl: fileUrl, source: 'ukit-gateway-json' };
   const envUrl = pickString(env?.UKIT_DECISION_BASE_URL);
   if (envUrl) return { baseUrl: envUrl, source: 'env' };
+  const block = readUserDecisionBlock(homeDir);
+  if (block.baseUrl) return { baseUrl: block.baseUrl, source: block.source };
   return { baseUrl: DEFAULT_DECISION_BASE_URL, source: 'default' };
 }
 
 function resolveDecisionApiKey({ projectRoot, homeDir, env }) {
-  const file = readUserGatewayDecision(homeDir);
-  const fileKey = pickString(file?.apiKey);
-  if (fileKey) {
-    const scheme = file?.scheme === 'api-key' ? 'api-key' : 'auth-token';
-    return { value: fileKey, scheme, source: 'ukit-gateway-json' };
-  }
   const envKey = pickString(env?.UKIT_DECISION_API_KEY);
-  if (envKey) return { value: envKey, scheme: 'auth-token', source: 'env' };
+  if (envKey) {
+    const envScheme = env?.UKIT_DECISION_SCHEME === 'api-key' ? 'api-key' : 'auth-token';
+    return { value: envKey, scheme: envScheme, source: 'env' };
+  }
+  const block = readUserDecisionBlock(homeDir);
+  if (block.apiKey) {
+    const scheme = block.scheme === 'api-key' ? 'api-key' : 'auth-token';
+    return { value: block.apiKey, scheme, source: block.source };
+  }
   const shared = resolveGatewayApiKey({ projectRoot, homeDir, env });
   if (shared?.value) return { ...shared, source: 'shared-unic-token' };
   return { value: null, scheme: null, source: null };

package/template_user/storage/config.json

@@ -12,5 +12,11 @@
   "compact": {
     "tokenThreshold": 150000,
     "hardCapTokens": 500000
+  },
+  "decisionGateway": {
+    "_help": "unic-decision lane endpoint — field names mirror the env vars. Fill only to override the default UNIC provider (https://openai.unicjsc.com); the lane file ~/.ukit/storage/gatewayDecision.json takes precedence over this block. Empty = default + shared UNIC token. scheme: 'auth-token' (Bearer) or 'api-key' (x-api-key). Prefer `ukit decision` over manual edits; ukit update never overwrites your values.",
+    "UKIT_DECISION_BASE_URL": "",
+    "UKIT_DECISION_API_KEY": "",
+    "UKIT_DECISION_SCHEME": "auth-token"
   }
 }

package/template_user/storage/gatewayDecision.json

@@ -0,0 +1,6 @@
+{
+  "_help": "unic-decision lane endpoint — field names mirror the env vars. Fill only to override the default UNIC provider (https://openai.unicjsc.com). Empty values = default endpoint + shared UNIC token. UKIT_DECISION_SCHEME: 'auth-token' (Authorization: Bearer) or 'api-key' (x-api-key). Prefer `ukit decision --base-url <url> --key <key> [--scheme s]` over manual edits. UKit update never overwrites your values.",
+  "UKIT_DECISION_BASE_URL": "",
+  "UKIT_DECISION_API_KEY": "",
+  "UKIT_DECISION_SCHEME": "auth-token"
+}