@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.5

package/node_modules/@oscharko-dev/keiko-cli/dist/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AASA,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAIzF,OAAO,EAML,KAAK,cAAc,EAGpB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC9C;AA4ID,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,GAAE,SAAc,EACnB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AASA,OAAO,EAQL,KAAK,SAAS,EAGf,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAML,KAAK,cAAc,EAGpB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC9C;AA4ID,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,GAAE,SAAc,EACnB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/node_modules/@oscharko-dev/keiko-cli/dist/evaluate.js

@@ -6,7 +6,7 @@
 // applicable dimensions pass AND surface parity passes; 1 on dimension/parity failure or runtime
 // error; 2 on usage error (unknown flag, mutual exclusion, unknown suite/fixture name).
 import { writeFileSync } from "node:fs";
-import { GatewayError, redact } from "@oscharko-dev/keiko-model-gateway";
+import { ConfigInvalidError, GatewayError, assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, loadConfigFromFile, redact, } from "@oscharko-dev/keiko-model-gateway";
 import { createAuditRedactor, deepRedactStrings } from "@oscharko-dev/keiko-evidence";
 import { keikoApiKeySecretValues } from "@oscharko-dev/keiko-security";
 import { parseRunRequest } from "@oscharko-dev/keiko-server";
@@ -156,10 +156,14 @@ export async function runEvaluateCli(args, io, env = {}, deps = {}) {
 }
 async function runSuite(parsed, fixtures, io, env, deps) {
     try {
+        const liveModelId = resolveLiveModelId(parsed, io, env);
+        if (typeof liveModelId === "number") {
+            return liveModelId;
+        }
         const scorecard = await runEvaluationSuite({
             mode: parsed.live ? "live" : "offline",
             fixtures,
-            ...(parsed.model === undefined ? {} : { modelIdOverride: parsed.model }),
+            ...(liveModelId === undefined ? {} : { modelIdOverride: liveModelId }),
             ...(parsed.config === undefined ? {} : { configPath: parsed.config }),
         }, 
         // Provide Date.now as the default wall-clock so a real `keiko evaluate` prints the actual
@@ -185,6 +189,61 @@ async function runSuite(parsed, fixtures, io, env, deps) {
         return handleRunError(error, parsed, io);
     }
 }
+function resolveLiveModelId(parsed, io, env) {
+    if (!parsed.live) {
+        return parsed.model;
+    }
+    try {
+        const path = parsed.config ?? env.KEIKO_CONFIG_FILE;
+        if (path === undefined) {
+            throw new ConfigInvalidError("no config source; pass --config PATH or set KEIKO_CONFIG_FILE");
+        }
+        const config = loadConfigFromFile(path, env);
+        if (parsed.model !== undefined) {
+            assertLiveEvaluationModel(config, parsed.model);
+            return parsed.model;
+        }
+        const modelId = selectLiveEvaluationModel(config);
+        if (modelId === undefined) {
+            io.err("Error: no configured workflow-capable chat model is available.\n");
+            return 1;
+        }
+        return modelId;
+    }
+    catch (error) {
+        if (error instanceof GatewayError) {
+            io.err(`Error: model gateway configuration problem — ${redact(error.message)}\n` +
+                `Provide a gateway config with --config PATH or KEIKO_CONFIG_FILE.\n`);
+            return 1;
+        }
+        throw error;
+    }
+}
+function isLiveEvaluationCapable(capability) {
+    return (capability?.kind === "chat" &&
+        capability.workflowEligible &&
+        capability.toolCalling &&
+        capability.structuredOutput);
+}
+const COST_RANK = { low: 0, medium: 1, high: 2 };
+function selectLiveEvaluationModel(config) {
+    let best;
+    for (const capability of listConfiguredCapabilities(config)) {
+        if (!isLiveEvaluationCapable(capability)) {
+            continue;
+        }
+        if (best === undefined || COST_RANK[capability.costClass] < COST_RANK[best.costClass]) {
+            best = capability;
+        }
+    }
+    return best?.id;
+}
+function assertLiveEvaluationModel(config, modelId) {
+    assertConfiguredModel(config, modelId);
+    if (!isLiveEvaluationCapable(findConfiguredCapability(config, modelId))) {
+        throw new ConfigInvalidError(`model '${modelId}' is not workflow-capable; live evaluation requires chat + tool-calling + structured-output`);
+    }
+}
 function isOutputAlreadyExistsError(error) {
     return (typeof error === "object" &&
         error !== null &&

package/node_modules/@oscharko-dev/keiko-cli/dist/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAQA,OAAO,EAQL,KAAK,aAAa,EAGnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AA0DD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,MAAM,CAuBR"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAQA,OAAO,EAQL,KAAK,aAAa,EAGnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AAmID,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,MAAM,CA2BR"}

package/node_modules/@oscharko-dev/keiko-cli/dist/evidence.js

@@ -13,19 +13,65 @@ const USAGE = `Usage:
 Lists or shows redacted evidence manifests written by \`keiko run\`. Reads only the
 evidence base dir (default $KEIKO_EVIDENCE_DIR or ./.keiko/evidence; override with --evidence-dir).
 `;
-function flagValue(args, name) {
-    const i = args.indexOf(name);
-    if (i === -1) {
-        return undefined;
+function parseSubcommand(value) {
+    return value === "list" || value === "show" ? value : undefined;
+}
+function parseFlags(args, startIndex) {
+    let json = false;
+    let evidenceDir;
+    let index = startIndex;
+    while (index < args.length) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            index += 1;
+            continue;
+        }
+        if (arg !== "--evidence-dir") {
+            return { ok: false };
+        }
+        const value = args[index + 1];
+        if (value === undefined || value.startsWith("--")) {
+            return { ok: false };
+        }
+        evidenceDir = value;
+        index += 2;
     }
-    const value = args[i + 1];
-    return value === undefined || value.startsWith("--") ? undefined : value;
+    return { ok: true, json, evidenceDir };
 }
-function resolveStore(args, deps) {
+function invalidArgs(message) {
+    return { ok: false, error: message };
+}
+function resolveStore(evidenceDir, deps) {
     if (deps.store !== undefined) {
         return deps.store;
     }
-    return createNodeEvidenceStore(resolveEvidenceDir(flagValue(args, "--evidence-dir"), deps.env));
+    return createNodeEvidenceStore(resolveEvidenceDir(evidenceDir, deps.env));
+}
+function parseEvidenceArgs(args) {
+    const subcommand = parseSubcommand(args[0]);
+    if (subcommand === undefined) {
+        const sub = args[0];
+        return invalidArgs(sub === undefined ? USAGE : `keiko evidence: unknown subcommand: ${sub}\n${USAGE}`);
+    }
+    let index = 1;
+    let runId;
+    if (subcommand === "show") {
+        runId = args[index];
+        if (runId === undefined || runId.startsWith("--")) {
+            return invalidArgs(`keiko evidence: show requires a <runId>.\n${USAGE}`);
+        }
+        index += 1;
+    }
+    const flags = parseFlags(args, index);
+    if (!flags.ok) {
+        return invalidArgs(`keiko evidence: invalid arguments.\n${USAGE}`);
+    }
+    return {
+        ok: true,
+        error: "",
+        parsed: { subcommand, runId, evidenceDir: flags.evidenceDir, json: flags.json === true },
+    };
 }
 function renderListText(entries) {
     if (entries.length === 0) {
@@ -59,22 +105,20 @@ function exitForAuditError(error, io) {
     return error instanceof InvalidRunIdError ? 2 : 1;
 }
 export function runEvidenceCli(args, io, deps = {}) {
-    const sub = args[0];
-    const json = args.includes("--json");
+    const parsed = parseEvidenceArgs(args);
+    if (!parsed.ok || parsed.parsed === undefined) {
+        io.err(parsed.error);
+        return 2;
+    }
     try {
-        if (sub === "list") {
-            return runList(resolveStore(args, deps), json, io);
+        if (parsed.parsed.subcommand === "list") {
+            return runList(resolveStore(parsed.parsed.evidenceDir, deps), parsed.parsed.json, io);
         }
-        if (sub === "show") {
-            const runId = args[1];
-            if (runId === undefined || runId.startsWith("--")) {
-                io.err(`keiko evidence: show requires a <runId>.\n${USAGE}`);
-                return 2;
-            }
-            return runShow(resolveStore(args, deps), runId, json, io);
+        if (parsed.parsed.runId === undefined) {
+            io.err(`keiko evidence: show requires a <runId>.\n${USAGE}`);
+            return 2;
         }
-        io.err(sub === undefined ? USAGE : `keiko evidence: unknown subcommand: ${sub}\n${USAGE}`);
-        return 2;
+        return runShow(resolveStore(parsed.parsed.evidenceDir, deps), parsed.parsed.runId, parsed.parsed.json, io);
     }
     catch (error) {
         if (error instanceof AuditError) {

package/node_modules/@oscharko-dev/keiko-cli/dist/launcher-platforms.js

@@ -7,7 +7,7 @@
 // any executable path or port that has not been validated by `validateExecPath` /
 // `validatePort`. The validators are deliberately strict allow-lists: a `keiko` executable
 // path that contains a space, a shell metacharacter, or any character outside
-// `[A-Za-z0-9_\-./\\:]` is rejected. Spaces in the bin location are a documented
+// `[A-Za-z0-9_@\-./\\:]` is rejected. Spaces in the bin location are a documented
 // unsupported edge case for this release (ADR-0024 D8 / spec §"Per-platform content rules").
 //
 // PLATFORMS:
@@ -23,7 +23,7 @@ import { posix as posixPath, win32 as win32Path } from "node:path";
 // `&`, `|`, `(`, `)`, `<`, `>`, `*`, `?`, `~`, `#`, `!`, `,`, `=`, `+`, control chars —
 // is rejected. The intent is defense-in-depth even though XDG `.desktop` and `.bat`
 // have their own quoting rules: no metacharacter ever reaches the file content.
-const EXEC_PATH_RE = /^[A-Za-z0-9_\-./\\:]+$/;
+const EXEC_PATH_RE = /^[A-Za-z0-9_@\-./\\:]+$/;
 export const MIN_PORT = 1024;
 export const MAX_PORT = 65535;
 export class LauncherError extends Error {
@@ -42,7 +42,7 @@ export function validateExecPath(path) {
         throw new LauncherError("EXEC_PATH_TOO_LONG", "keiko launcher: resolved executable path exceeds 4096 chars.");
     }
     if (!EXEC_PATH_RE.test(path)) {
-        throw new LauncherError("EXEC_PATH_UNSAFE", `keiko launcher: resolved executable path contains disallowed characters: ${path}\nOnly [A-Za-z0-9_\\-./\\\\:] are permitted. Re-install keiko under a path without spaces or shell metacharacters.`);
+        throw new LauncherError("EXEC_PATH_UNSAFE", `keiko launcher: resolved executable path contains disallowed characters: ${path}\nOnly [A-Za-z0-9_@\\-./\\\\:] are permitted. Re-install keiko under a path without spaces or shell metacharacters.`);
     }
     return path;
 }

package/node_modules/@oscharko-dev/keiko-cli/dist/run.d.ts

@@ -1,8 +1,10 @@
+import { type EnvSource } from "@oscharko-dev/keiko-model-gateway";
+import { type ModelPort } from "@oscharko-dev/keiko-harness";
 import { type EvidenceStore } from "@oscharko-dev/keiko-evidence";
-import type { EnvSource } from "@oscharko-dev/keiko-model-gateway";
 import type { CliIo } from "./runner.js";
 export interface RunDeps {
     readonly store?: EvidenceStore | undefined;
+    readonly model?: ModelPort | undefined;
 }
 export declare function runAgentCli(args: readonly string[], io: CliIo, env?: EnvSource, deps?: RunDeps): Promise<number>;
 //# sourceMappingURL=run.d.ts.map

package/node_modules/@oscharko-dev/keiko-cli/dist/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAuBzC,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC5C;AA8JD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,GAAE,SAAc,EACnB,IAAI,GAAE,OAAY,GACjB,OAAO,CAAC,MAAM,CAAC,CA+BjB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAUA,OAAO,EASL,KAAK,SAAS,EACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAQ/F,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAyBzC,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACxC;AAsMD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,GAAE,SAAc,EACnB,IAAI,GAAE,OAAY,GACjB,OAAO,CAAC,MAAM,CAAC,CAsCjB"}

package/node_modules/@oscharko-dev/keiko-cli/dist/run.js

@@ -1,13 +1,14 @@
-// `keiko run` — the dry-run task command. It builds an AgentSession wired to deterministic mocked
-// model/tool fixtures (no provider call, no real tools) and renders the HarnessEvent stream to
-// CliIo. Since ADR-0010 it ALSO writes a redacted evidence manifest by default (evidence is the
-// product value): a tee EventSink forwards every event to BOTH a MemoryEventSink (which retains raw
-// content to assemble the replay manifest) and the existing CliEventSink (whose summarisers never
-// print sensitive fields). After the run resolves, the audit layer builds + redacts + persists the
-// manifest and the EvidenceReport is printed. Writing is on by default; --no-evidence disables it,
-// --evidence-dir relocates it. Tests inject an in-memory EvidenceStore via deps so no write ever
-// touches the repository tree.
-import { DryRunToolPort } from "@oscharko-dev/keiko-harness";
+// `keiko run` — the dry-run task command. It builds an AgentSession with the configured model
+// gateway and a dry-run tool port (provider call is real, tools are non-mutating) and renders the
+// HarnessEvent stream to CliIo. Since ADR-0010 it ALSO writes a redacted evidence manifest by
+// default (evidence is the product value): a tee EventSink forwards every event to BOTH a
+// MemoryEventSink (which retains raw content to assemble the replay manifest) and the existing
+// CliEventSink (whose summarisers never print sensitive fields). After the run resolves, the audit
+// layer builds + redacts + persists the manifest and the EvidenceReport is printed. Writing is on by
+// default; --no-evidence disables it, --evidence-dir relocates it. Tests inject an in-memory
+// EvidenceStore via deps so no write ever touches the repository tree.
+import { ConfigInvalidError, Gateway, GatewayError, assertConfiguredModel, loadConfigFromFile, redact, resolveCostClass, selectConfiguredModel, } from "@oscharko-dev/keiko-model-gateway";
+import { DryRunToolPort, GatewayModelPort } from "@oscharko-dev/keiko-harness";
 import { createSession, HARNESS_VERSION } from "@oscharko-dev/keiko-harness";
 import { CliEventSink, MemoryEventSink } from "@oscharko-dev/keiko-harness";
 import { DEFAULT_LIMITS } from "@oscharko-dev/keiko-harness";
@@ -15,8 +16,6 @@ import { persistEvidence } from "@oscharko-dev/keiko-evidence";
 import { renderEvidenceReport } from "@oscharko-dev/keiko-evidence";
 import { createNodeEvidenceStore, resolveEvidenceDir, } from "@oscharko-dev/keiko-evidence";
 import { AuditError } from "@oscharko-dev/keiko-evidence";
-import { redact } from "@oscharko-dev/keiko-model-gateway";
-import { resolveCostClass } from "@oscharko-dev/keiko-model-gateway";
 const TASK_TYPES = new Set([
     "generate-unit-tests",
     "investigate-bug",
@@ -32,8 +31,10 @@ const USAGE = `Usage:
     --evidence-dir PATH      Write evidence under PATH (default $KEIKO_EVIDENCE_DIR or ./.keiko/evidence).
     --include-reasoning      Include redacted reasoning entries in the manifest.
     --include-diff           Include the redacted proposed diff in the manifest.
+    --config PATH            Gateway config file (or set KEIKO_CONFIG_FILE).
+    --model MODEL_ID         Configured model id to use.
 
-All tasks run in dry-run mode: a patch is proposed as an event, never written to disk.
+All tasks run in dry-run mode for tools/files: a patch is proposed as an event, never written to disk.
 `;
 function flag(args, name) {
     const i = args.indexOf(name);
@@ -49,24 +50,8 @@ function parseEvidenceFlags(args) {
         evidenceDirFlag: flag(args, "--evidence-dir"),
         includeReasoning: args.includes("--include-reasoning"),
         includeDiff: args.includes("--include-diff"),
-    };
-}
-// A deterministic, dependency-free canned final response. It never requests tools, so the dry-run
-// path is reproducible regardless of task type.
-function cannedResponse() {
-    return {
-        modelId: "mock-model",
-        content: "--- a/file\n+++ b/file\n+// dry-run proposed change\n",
-        finishReason: "stop",
-        toolCalls: [],
-        structuredOutput: null,
-        usage: {
-            requestId: "dry-run",
-            promptTokens: 0,
-            completionTokens: 0,
-            latencyMs: 1,
-            costClass: "low",
-        },
+        model: flag(args, "--model"),
+        config: flag(args, "--config"),
     };
 }
 function parseTask(taskType, args) {
@@ -102,7 +87,7 @@ function teeSink(sinks) {
         },
     };
 }
-function seedFor(task, result) {
+function seedFor(task, result, modelId) {
     return {
         runId: result.runId,
         fingerprint: result.fingerprint,
@@ -110,7 +95,7 @@ function seedFor(task, result) {
         taskType: task.taskType,
         taskInput: task,
         limits: DEFAULT_LIMITS,
-        modelId: "mock-model",
+        modelId,
         workingDirectory: ".",
         dryRun: true,
         startedAt: new Date(result.startedAt).toISOString(),
@@ -120,9 +105,9 @@ function seedFor(task, result) {
 // correct here (CLAUDE.md): on any failure — typed AuditError or otherwise — print a REDACTED
 // message and return exit 1 rather than rejecting out of runAgentCli as an unhandled rejection (C3).
 // Returns undefined on success so the caller falls through to the run-outcome exit code.
-function writeEvidence(result, memory, task, ctx, io) {
+function writeEvidence(result, memory, task, ctx, io, modelId) {
     try {
-        const manifest = memory.collectManifest(seedFor(task, result));
+        const manifest = memory.collectManifest(seedFor(task, result, modelId));
         const store = ctx.deps.store ??
             createNodeEvidenceStore(resolveEvidenceDir(ctx.flags.evidenceDirFlag, ctx.env));
         const out = persistEvidence({
@@ -142,6 +127,52 @@ function writeEvidence(result, memory, task, ctx, io) {
         return 1;
     }
 }
+function configuredModelId(flags, env) {
+    const path = flags.config ?? env.KEIKO_CONFIG_FILE;
+    if (path === undefined) {
+        return flags.model;
+    }
+    const config = loadConfigFromFile(path, env);
+    if (flags.model !== undefined) {
+        assertConfiguredModel(config, flags.model);
+        return flags.model;
+    }
+    return selectConfiguredModel(config, { kind: "chat" });
+}
+function resolveModel(flags, io, env, deps) {
+    try {
+        if (deps.model !== undefined) {
+            const modelId = configuredModelId(flags, env);
+            if (modelId === undefined) {
+                io.err("Error: no model id available; pass --model MODEL_ID for injected test runs.\n");
+                return 1;
+            }
+            return { port: deps.model, modelId };
+        }
+        const path = flags.config ?? env.KEIKO_CONFIG_FILE;
+        if (path === undefined) {
+            throw new ConfigInvalidError("no config source; pass --config PATH or set KEIKO_CONFIG_FILE");
+        }
+        const config = loadConfigFromFile(path, env);
+        if (flags.model !== undefined) {
+            assertConfiguredModel(config, flags.model);
+        }
+        const modelId = flags.model ?? selectConfiguredModel(config, { kind: "chat" });
+        if (modelId === undefined) {
+            io.err("Error: no configured chat model is available.\n");
+            return 1;
+        }
+        return { port: new GatewayModelPort(new Gateway(config)), modelId };
+    }
+    catch (error) {
+        if (error instanceof GatewayError) {
+            io.err(`Error: model gateway configuration problem — ${redact(error.message)}\n` +
+                `Provide a gateway config with --config PATH or KEIKO_CONFIG_FILE.\n`);
+            return 1;
+        }
+        throw error;
+    }
+}
 function outcomeToExitCode(result, io) {
     if (result.outcome === "completed") {
         io.out(`run ${result.runId} completed (fingerprint ${result.fingerprint})\n`);
@@ -167,19 +198,20 @@ export async function runAgentCli(args, io, env = {}, deps = {}) {
         return 2;
     }
     const flags = parseEvidenceFlags(args);
-    const response = cannedResponse();
+    const model = resolveModel(flags, io, env, deps);
+    if (typeof model === "number") {
+        return model;
+    }
     const memory = new MemoryEventSink();
-    const config = { model: "mock-model", workingDirectory: ".", dryRun: true };
+    const config = { model: model.modelId, workingDirectory: ".", dryRun: true };
     const session = createSession(task, config, {
-        model: {
-            call: (request) => Promise.resolve({ ...response, modelId: request.modelId }),
-        },
+        model: model.port,
         tools: new DryRunToolPort(),
         sink: teeSink([memory, new CliEventSink(io)]),
     });
     const result = await session.result;
     if (flags.write) {
-        const evidenceFailure = writeEvidence(result, memory, task, { flags, env, deps }, io);
+        const evidenceFailure = writeEvidence(result, memory, task, { flags, env, deps }, io, model.modelId);
         if (evidenceFailure !== undefined) {
             return evidenceFailure;
         }

package/node_modules/@oscharko-dev/keiko-cli/dist/ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAczC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,KAAK,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;AAa/C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,aAAa,CAAC;KAC5B,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAI7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAG3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,EAAE,YAAY,KACf,YAAY,CAAC;AA8DlB,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAYlE;AAkFD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAGxD;AAWD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7D;AA0BD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB7F;AAgED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CA2BjB"}
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAmBzC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,KAAK,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;AAa/C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,aAAa,CAAC;KAC5B,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAI7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAG3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,EAAE,YAAY,KACf,YAAY,CAAC;AA8DlB,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAYlE;AAkFD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAGxD;AAWD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7D;AA0BD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB7F;AAqGD,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/node_modules/@oscharko-dev/keiko-cli/dist/ui.js

@@ -19,6 +19,11 @@ import { createUiServer, loadCspHeader, buildUiHandlerDeps, DEFAULT_UI_PORT, UI_
 const ALLOWED_HOSTS = new Set(["127.0.0.1", "localhost"]);
 const SQLITE_FLAG = "--experimental-sqlite";
 const KEIKO_ENV_NAME_RE = /^KEIKO_[A-Z0-9_]+$/;
+// Non-KEIKO names the local .env loader may import. Deliberately a closed allowlist —
+// arbitrary secrets must never be slurped into the server process. FIGMA_ACCESS_TOKEN is
+// part of the documented Figma connector contract (#751): the read-only PAT is configured
+// via .env and consumed server-side only.
+const ENV_NAME_ALLOWLIST = new Set(["FIGMA_ACCESS_TOKEN"]);
 const DEFAULT_STATE_DIR = ".keiko";
 const USAGE = `Usage:
   keiko ui [--port PORT] [--host 127.0.0.1|localhost] [--evidence-dir PATH] [--config PATH] [--ui-db PATH]
@@ -133,7 +138,7 @@ function loadLocalKeikoEnv(cwd, env) {
         if (equals <= 0)
             continue;
         const key = line.slice(0, equals).trim();
-        if (!KEIKO_ENV_NAME_RE.test(key))
+        if (!KEIKO_ENV_NAME_RE.test(key) && !ENV_NAME_ALLOWLIST.has(key))
             continue;
         if (merged[key] !== undefined)
             continue;
@@ -265,12 +270,13 @@ async function maybeReExecForSqlite(env, deps) {
     const spawnFn = deps.spawnFn ?? spawn;
     return reExecWithSqliteFlag(env, spawnFn);
 }
-function buildHandlerDepsOrReport(parsed, effectiveEnv, io) {
+function buildHandlerDepsOrReport(parsed, cwd, effectiveEnv, io) {
     try {
         return buildUiHandlerDeps({
             configPath: resolveUiConfigPath(parsed, effectiveEnv),
             evidenceDir: parsed.evidenceDir,
             uiDbPath: parsed.uiDbPath,
+            initialProjectPath: cwd,
             env: effectiveEnv,
         });
     }
@@ -282,6 +288,19 @@ function buildHandlerDepsOrReport(parsed, effectiveEnv, io) {
         throw error;
     }
 }
+function registerLaunchProjectOrReport(cwd, handlerDeps, io) {
+    try {
+        handlerDeps.store.createProject(cwd);
+        return null;
+    }
+    catch (error) {
+        if (error instanceof UiStoreError) {
+            io.err(`keiko ui: ${error.message}\n`);
+            return 2;
+        }
+        throw error;
+    }
+}
 function ensureStaticRoot(staticRoot, io) {
     if (existsSync(staticRoot)) {
         return true;
@@ -307,6 +326,16 @@ async function maybeWaitForShutdown(server, deps) {
     }
     await waitForShutdown(server);
 }
+async function startUiServer(staticRoot, csp, parsed, handlerDeps, io, deps) {
+    const factory = deps.createServer ?? createUiServer;
+    const server = await factory({ staticRoot, csp, port: parsed.port, handlerDeps });
+    applyServerTimeouts(server);
+    await listen(server, parsed.port);
+    io.out(`Keiko UI listening on http://${UI_HOST}:${String(parsed.port)}\n`);
+    // Block only in the real CLI path (no injected factory). Injected-server tests skip blocking so
+    // they don't hang; the real process must stay alive until signalled.
+    await maybeWaitForShutdown(server, deps);
+}
 export async function runUiCli(args, io, env, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const effectiveEnv = loadLocalKeikoEnv(cwd, env);
@@ -321,16 +350,12 @@ export async function runUiCli(args, io, env, deps = {}) {
         return 1;
     }
     const csp = await loadCspHeader(deps.hashesFile ?? join(staticRoot, "..", "csp-hashes.json"));
-    const handlerDeps = buildHandlerDepsOrReport(parsed, withDefaultLocalRuntimeStateEnv(cwd, parsed, effectiveEnv), io);
+    const handlerDeps = buildHandlerDepsOrReport(parsed, cwd, withDefaultLocalRuntimeStateEnv(cwd, parsed, effectiveEnv), io);
     if (typeof handlerDeps === "number")
         return handlerDeps;
-    const factory = deps.createServer ?? createUiServer;
-    const server = await factory({ staticRoot, csp, port: parsed.port, handlerDeps });
-    applyServerTimeouts(server);
-    await listen(server, parsed.port);
-    io.out(`Keiko UI listening on http://${UI_HOST}:${String(parsed.port)}\n`);
-    // Block only in the real CLI path (no injected factory). Injected-server tests skip blocking so
-    // they don't hang; the real process must stay alive until signalled.
-    await maybeWaitForShutdown(server, deps);
+    const launchProjectResult = registerLaunchProjectOrReport(cwd, handlerDeps, io);
+    if (launchProjectResult !== null)
+        return launchProjectResult;
+    await startUiServer(staticRoot, csp, parsed, handlerDeps, io, deps);
     return 0;
 }

package/node_modules/@oscharko-dev/keiko-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-cli",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.5",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -15,7 +15,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [