@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.4

package/node_modules/@oscharko-dev/keiko-cli/dist/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AASA,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAIzF,OAAO,EAML,KAAK,cAAc,EAGpB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC9C;AA4ID,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,GAAE,SAAc,EACnB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AASA,OAAO,EAQL,KAAK,SAAS,EAGf,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAML,KAAK,cAAc,EAGpB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC9C;AA4ID,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,GAAE,SAAc,EACnB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/node_modules/@oscharko-dev/keiko-cli/dist/evaluate.js

@@ -6,7 +6,7 @@
 // applicable dimensions pass AND surface parity passes; 1 on dimension/parity failure or runtime
 // error; 2 on usage error (unknown flag, mutual exclusion, unknown suite/fixture name).
 import { writeFileSync } from "node:fs";
-import { GatewayError, redact } from "@oscharko-dev/keiko-model-gateway";
+import { ConfigInvalidError, GatewayError, assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, loadConfigFromFile, redact, } from "@oscharko-dev/keiko-model-gateway";
 import { createAuditRedactor, deepRedactStrings } from "@oscharko-dev/keiko-evidence";
 import { keikoApiKeySecretValues } from "@oscharko-dev/keiko-security";
 import { parseRunRequest } from "@oscharko-dev/keiko-server";
@@ -156,10 +156,14 @@ export async function runEvaluateCli(args, io, env = {}, deps = {}) {
 }
 async function runSuite(parsed, fixtures, io, env, deps) {
     try {
+        const liveModelId = resolveLiveModelId(parsed, io, env);
+        if (typeof liveModelId === "number") {
+            return liveModelId;
+        }
         const scorecard = await runEvaluationSuite({
             mode: parsed.live ? "live" : "offline",
             fixtures,
-            ...(parsed.model === undefined ? {} : { modelIdOverride: parsed.model }),
+            ...(liveModelId === undefined ? {} : { modelIdOverride: liveModelId }),
             ...(parsed.config === undefined ? {} : { configPath: parsed.config }),
         }, 
         // Provide Date.now as the default wall-clock so a real `keiko evaluate` prints the actual
@@ -185,6 +189,61 @@ async function runSuite(parsed, fixtures, io, env, deps) {
         return handleRunError(error, parsed, io);
     }
 }
+function resolveLiveModelId(parsed, io, env) {
+    if (!parsed.live) {
+        return parsed.model;
+    }
+    try {
+        const path = parsed.config ?? env.KEIKO_CONFIG_FILE;
+        if (path === undefined) {
+            throw new ConfigInvalidError("no config source; pass --config PATH or set KEIKO_CONFIG_FILE");
+        }
+        const config = loadConfigFromFile(path, env);
+        if (parsed.model !== undefined) {
+            assertLiveEvaluationModel(config, parsed.model);
+            return parsed.model;
+        }
+        const modelId = selectLiveEvaluationModel(config);
+        if (modelId === undefined) {
+            io.err("Error: no configured workflow-capable chat model is available.\n");
+            return 1;
+        }
+        return modelId;
+    }
+    catch (error) {
+        if (error instanceof GatewayError) {
+            io.err(`Error: model gateway configuration problem — ${redact(error.message)}\n` +
+                `Provide a gateway config with --config PATH or KEIKO_CONFIG_FILE.\n`);
+            return 1;
+        }
+        throw error;
+    }
+}
+function isLiveEvaluationCapable(capability) {
+    return (capability?.kind === "chat" &&
+        capability.workflowEligible &&
+        capability.toolCalling &&
+        capability.structuredOutput);
+}
+const COST_RANK = { low: 0, medium: 1, high: 2 };
+function selectLiveEvaluationModel(config) {
+    let best;
+    for (const capability of listConfiguredCapabilities(config)) {
+        if (!isLiveEvaluationCapable(capability)) {
+            continue;
+        }
+        if (best === undefined || COST_RANK[capability.costClass] < COST_RANK[best.costClass]) {
+            best = capability;
+        }
+    }
+    return best?.id;
+}
+function assertLiveEvaluationModel(config, modelId) {
+    assertConfiguredModel(config, modelId);
+    if (!isLiveEvaluationCapable(findConfiguredCapability(config, modelId))) {
+        throw new ConfigInvalidError(`model '${modelId}' is not workflow-capable; live evaluation requires chat + tool-calling + structured-output`);
+    }
+}
 function isOutputAlreadyExistsError(error) {
     return (typeof error === "object" &&
         error !== null &&

package/node_modules/@oscharko-dev/keiko-cli/dist/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAQA,OAAO,EAQL,KAAK,aAAa,EAGnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AA0DD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,MAAM,CAuBR"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAQA,OAAO,EAQL,KAAK,aAAa,EAGnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AAmID,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,MAAM,CA2BR"}

package/node_modules/@oscharko-dev/keiko-cli/dist/evidence.js

@@ -13,19 +13,65 @@ const USAGE = `Usage:
 Lists or shows redacted evidence manifests written by \`keiko run\`. Reads only the
 evidence base dir (default $KEIKO_EVIDENCE_DIR or ./.keiko/evidence; override with --evidence-dir).
 `;
-function flagValue(args, name) {
-    const i = args.indexOf(name);
-    if (i === -1) {
-        return undefined;
+function parseSubcommand(value) {
+    return value === "list" || value === "show" ? value : undefined;
+}
+function parseFlags(args, startIndex) {
+    let json = false;
+    let evidenceDir;
+    let index = startIndex;
+    while (index < args.length) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            index += 1;
+            continue;
+        }
+        if (arg !== "--evidence-dir") {
+            return { ok: false };
+        }
+        const value = args[index + 1];
+        if (value === undefined || value.startsWith("--")) {
+            return { ok: false };
+        }
+        evidenceDir = value;
+        index += 2;
     }
-    const value = args[i + 1];
-    return value === undefined || value.startsWith("--") ? undefined : value;
+    return { ok: true, json, evidenceDir };
 }
-function resolveStore(args, deps) {
+function invalidArgs(message) {
+    return { ok: false, error: message };
+}
+function resolveStore(evidenceDir, deps) {
     if (deps.store !== undefined) {
         return deps.store;
     }
-    return createNodeEvidenceStore(resolveEvidenceDir(flagValue(args, "--evidence-dir"), deps.env));
+    return createNodeEvidenceStore(resolveEvidenceDir(evidenceDir, deps.env));
+}
+function parseEvidenceArgs(args) {
+    const subcommand = parseSubcommand(args[0]);
+    if (subcommand === undefined) {
+        const sub = args[0];
+        return invalidArgs(sub === undefined ? USAGE : `keiko evidence: unknown subcommand: ${sub}\n${USAGE}`);
+    }
+    let index = 1;
+    let runId;
+    if (subcommand === "show") {
+        runId = args[index];
+        if (runId === undefined || runId.startsWith("--")) {
+            return invalidArgs(`keiko evidence: show requires a <runId>.\n${USAGE}`);
+        }
+        index += 1;
+    }
+    const flags = parseFlags(args, index);
+    if (!flags.ok) {
+        return invalidArgs(`keiko evidence: invalid arguments.\n${USAGE}`);
+    }
+    return {
+        ok: true,
+        error: "",
+        parsed: { subcommand, runId, evidenceDir: flags.evidenceDir, json: flags.json === true },
+    };
 }
 function renderListText(entries) {
     if (entries.length === 0) {
@@ -59,22 +105,20 @@ function exitForAuditError(error, io) {
     return error instanceof InvalidRunIdError ? 2 : 1;
 }
 export function runEvidenceCli(args, io, deps = {}) {
-    const sub = args[0];
-    const json = args.includes("--json");
+    const parsed = parseEvidenceArgs(args);
+    if (!parsed.ok || parsed.parsed === undefined) {
+        io.err(parsed.error);
+        return 2;
+    }
     try {
-        if (sub === "list") {
-            return runList(resolveStore(args, deps), json, io);
+        if (parsed.parsed.subcommand === "list") {
+            return runList(resolveStore(parsed.parsed.evidenceDir, deps), parsed.parsed.json, io);
         }
-        if (sub === "show") {
-            const runId = args[1];
-            if (runId === undefined || runId.startsWith("--")) {
-                io.err(`keiko evidence: show requires a <runId>.\n${USAGE}`);
-                return 2;
-            }
-            return runShow(resolveStore(args, deps), runId, json, io);
+        if (parsed.parsed.runId === undefined) {
+            io.err(`keiko evidence: show requires a <runId>.\n${USAGE}`);
+            return 2;
         }
-        io.err(sub === undefined ? USAGE : `keiko evidence: unknown subcommand: ${sub}\n${USAGE}`);
-        return 2;
+        return runShow(resolveStore(parsed.parsed.evidenceDir, deps), parsed.parsed.runId, parsed.parsed.json, io);
     }
     catch (error) {
         if (error instanceof AuditError) {

package/node_modules/@oscharko-dev/keiko-cli/dist/launcher-platforms.js

@@ -7,7 +7,7 @@
 // any executable path or port that has not been validated by `validateExecPath` /
 // `validatePort`. The validators are deliberately strict allow-lists: a `keiko` executable
 // path that contains a space, a shell metacharacter, or any character outside
-// `[A-Za-z0-9_\-./\\:]` is rejected. Spaces in the bin location are a documented
+// `[A-Za-z0-9_@\-./\\:]` is rejected. Spaces in the bin location are a documented
 // unsupported edge case for this release (ADR-0024 D8 / spec §"Per-platform content rules").
 //
 // PLATFORMS:
@@ -23,7 +23,7 @@ import { posix as posixPath, win32 as win32Path } from "node:path";
 // `&`, `|`, `(`, `)`, `<`, `>`, `*`, `?`, `~`, `#`, `!`, `,`, `=`, `+`, control chars —
 // is rejected. The intent is defense-in-depth even though XDG `.desktop` and `.bat`
 // have their own quoting rules: no metacharacter ever reaches the file content.
-const EXEC_PATH_RE = /^[A-Za-z0-9_\-./\\:]+$/;
+const EXEC_PATH_RE = /^[A-Za-z0-9_@\-./\\:]+$/;
 export const MIN_PORT = 1024;
 export const MAX_PORT = 65535;
 export class LauncherError extends Error {
@@ -42,7 +42,7 @@ export function validateExecPath(path) {
         throw new LauncherError("EXEC_PATH_TOO_LONG", "keiko launcher: resolved executable path exceeds 4096 chars.");
     }
     if (!EXEC_PATH_RE.test(path)) {
-        throw new LauncherError("EXEC_PATH_UNSAFE", `keiko launcher: resolved executable path contains disallowed characters: ${path}\nOnly [A-Za-z0-9_\\-./\\\\:] are permitted. Re-install keiko under a path without spaces or shell metacharacters.`);
+        throw new LauncherError("EXEC_PATH_UNSAFE", `keiko launcher: resolved executable path contains disallowed characters: ${path}\nOnly [A-Za-z0-9_@\\-./\\\\:] are permitted. Re-install keiko under a path without spaces or shell metacharacters.`);
     }
     return path;
 }

package/node_modules/@oscharko-dev/keiko-cli/dist/ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAczC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,KAAK,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;AAa/C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,aAAa,CAAC;KAC5B,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAI7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAG3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,EAAE,YAAY,KACf,YAAY,CAAC;AA8DlB,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAYlE;AAkFD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAGxD;AAWD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7D;AA0BD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB7F;AAgED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CA2BjB"}
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAmBzC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,KAAK,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;AAa/C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,aAAa,CAAC;KAC5B,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAI7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAG3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,EAAE,YAAY,KACf,YAAY,CAAC;AA8DlB,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAYlE;AAkFD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAGxD;AAWD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7D;AA0BD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB7F;AAqGD,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/node_modules/@oscharko-dev/keiko-cli/dist/ui.js

@@ -19,6 +19,11 @@ import { createUiServer, loadCspHeader, buildUiHandlerDeps, DEFAULT_UI_PORT, UI_
 const ALLOWED_HOSTS = new Set(["127.0.0.1", "localhost"]);
 const SQLITE_FLAG = "--experimental-sqlite";
 const KEIKO_ENV_NAME_RE = /^KEIKO_[A-Z0-9_]+$/;
+// Non-KEIKO names the local .env loader may import. Deliberately a closed allowlist —
+// arbitrary secrets must never be slurped into the server process. FIGMA_ACCESS_TOKEN is
+// part of the documented Figma connector contract (#751): the read-only PAT is configured
+// via .env and consumed server-side only.
+const ENV_NAME_ALLOWLIST = new Set(["FIGMA_ACCESS_TOKEN"]);
 const DEFAULT_STATE_DIR = ".keiko";
 const USAGE = `Usage:
   keiko ui [--port PORT] [--host 127.0.0.1|localhost] [--evidence-dir PATH] [--config PATH] [--ui-db PATH]
@@ -133,7 +138,7 @@ function loadLocalKeikoEnv(cwd, env) {
         if (equals <= 0)
             continue;
         const key = line.slice(0, equals).trim();
-        if (!KEIKO_ENV_NAME_RE.test(key))
+        if (!KEIKO_ENV_NAME_RE.test(key) && !ENV_NAME_ALLOWLIST.has(key))
             continue;
         if (merged[key] !== undefined)
             continue;
@@ -265,12 +270,13 @@ async function maybeReExecForSqlite(env, deps) {
     const spawnFn = deps.spawnFn ?? spawn;
     return reExecWithSqliteFlag(env, spawnFn);
 }
-function buildHandlerDepsOrReport(parsed, effectiveEnv, io) {
+function buildHandlerDepsOrReport(parsed, cwd, effectiveEnv, io) {
     try {
         return buildUiHandlerDeps({
             configPath: resolveUiConfigPath(parsed, effectiveEnv),
             evidenceDir: parsed.evidenceDir,
             uiDbPath: parsed.uiDbPath,
+            initialProjectPath: cwd,
             env: effectiveEnv,
         });
     }
@@ -282,6 +288,19 @@ function buildHandlerDepsOrReport(parsed, effectiveEnv, io) {
         throw error;
     }
 }
+function registerLaunchProjectOrReport(cwd, handlerDeps, io) {
+    try {
+        handlerDeps.store.createProject(cwd);
+        return null;
+    }
+    catch (error) {
+        if (error instanceof UiStoreError) {
+            io.err(`keiko ui: ${error.message}\n`);
+            return 2;
+        }
+        throw error;
+    }
+}
 function ensureStaticRoot(staticRoot, io) {
     if (existsSync(staticRoot)) {
         return true;
@@ -307,6 +326,16 @@ async function maybeWaitForShutdown(server, deps) {
     }
     await waitForShutdown(server);
 }
+async function startUiServer(staticRoot, csp, parsed, handlerDeps, io, deps) {
+    const factory = deps.createServer ?? createUiServer;
+    const server = await factory({ staticRoot, csp, port: parsed.port, handlerDeps });
+    applyServerTimeouts(server);
+    await listen(server, parsed.port);
+    io.out(`Keiko UI listening on http://${UI_HOST}:${String(parsed.port)}\n`);
+    // Block only in the real CLI path (no injected factory). Injected-server tests skip blocking so
+    // they don't hang; the real process must stay alive until signalled.
+    await maybeWaitForShutdown(server, deps);
+}
 export async function runUiCli(args, io, env, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const effectiveEnv = loadLocalKeikoEnv(cwd, env);
@@ -321,16 +350,12 @@ export async function runUiCli(args, io, env, deps = {}) {
         return 1;
     }
     const csp = await loadCspHeader(deps.hashesFile ?? join(staticRoot, "..", "csp-hashes.json"));
-    const handlerDeps = buildHandlerDepsOrReport(parsed, withDefaultLocalRuntimeStateEnv(cwd, parsed, effectiveEnv), io);
+    const handlerDeps = buildHandlerDepsOrReport(parsed, cwd, withDefaultLocalRuntimeStateEnv(cwd, parsed, effectiveEnv), io);
     if (typeof handlerDeps === "number")
         return handlerDeps;
-    const factory = deps.createServer ?? createUiServer;
-    const server = await factory({ staticRoot, csp, port: parsed.port, handlerDeps });
-    applyServerTimeouts(server);
-    await listen(server, parsed.port);
-    io.out(`Keiko UI listening on http://${UI_HOST}:${String(parsed.port)}\n`);
-    // Block only in the real CLI path (no injected factory). Injected-server tests skip blocking so
-    // they don't hang; the real process must stay alive until signalled.
-    await maybeWaitForShutdown(server, deps);
+    const launchProjectResult = registerLaunchProjectOrReport(cwd, handlerDeps, io);
+    if (launchProjectResult !== null)
+        return launchProjectResult;
+    await startUiServer(staticRoot, csp, parsed, handlerDeps, io, deps);
     return 0;
 }

package/node_modules/@oscharko-dev/keiko-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-cli",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.4",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -15,7 +15,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [