@zenera/cli 1.1.2 → 1.1.4

package/dist/commands/init.js

@@ -1,9 +1,12 @@
+import { readProjectConfig } from '@zenera/neo';
 import { existsSync, readdirSync } from 'node:fs';
 import { basename, resolve } from 'node:path';
 import { one, parse } from "../args.js";
 import { ensureHome } from "../home.js";
-import { isProvider, keyId, KeyStore, PROVIDERS, SHAPES } from "../keys.js";
+import { resolveBuild } from "../image.js";
+import { envNames, isProvider, keyId, KeyStore, PROVIDERS } from "../keys.js";
 import { probeAll } from "../liveness.js";
+import { ensurePodmanReady } from "../podman.js";
 import { isProjectDir, Registry } from "../projects.js";
 import { scaffold } from "../scaffold.js";
 import { bold, cyan, dim, green, invalidError, json, note, progress, usageError, write, yellow, } from "../term.js";
@@ -55,7 +58,7 @@ const DEFAULT_MODEL = {
  * the wifi is down.
  */
 async function reachableProvider(store) {
-    const fromEnv = PROVIDERS.find((p) => process.env[SHAPES[p].env]);
+    const fromEnv = PROVIDERS.find((p) => envNames(p).some((name) => process.env[name]));
     if (fromEnv) {
         return fromEnv;
     }
@@ -64,7 +67,8 @@ async function reachableProvider(store) {
         return undefined;
     }
     const bar = progress();
-    const checks = await probeAll(store, active, (entry, index, total) => bar.update(dim(`checking ${keyId(entry)} … ${index + 1}/${total}`)));
+    bar.update(dim(`checking ${active.length} key${active.length === 1 ? '' : 's'} …`));
+    const checks = await probeAll(store, active, (entry, done, total) => bar.update(dim(`checked ${keyId(entry)} … ${done}/${total}`)));
     bar.done();
     for (const [entry, check] of checks) {
         store.record(entry, check);
@@ -86,7 +90,7 @@ async function reachableProvider(store) {
  * `init`.
  */
 function hasExa(store) {
-    return Boolean(process.env[SHAPES.exa.env]) || store.active('exa') !== undefined;
+    return envNames('exa').some((name) => process.env[name]) || store.active('exa') !== undefined;
 }
 export const init = {
     summary: 'Create a project here, or in <dir>, and register it.',
@@ -101,6 +105,9 @@ export const init = {
         '`exa:*` when the keyring holds an Exa key. Without --model, the',
         'keyring is checked and the model is picked from a credential the',
         'provider accepts.',
+        '',
+        'The sandbox image is built here too, so the first run does not have',
+        'to. A machine without a container engine is told, and carries on.',
     ],
     run: async (ctx) => {
         const { values, positionals } = parse(ctx.args, {
@@ -126,19 +133,31 @@ export const init = {
             : DEFAULT_MODEL[provider ?? 'openai'];
         const model = choice.ref;
         const web = hasExa(store);
-        const files = scaffold({ dir, model, modelOptions: choice.options, web });
+        const written = scaffold({ dir, model, modelOptions: choice.options, web });
         const registry = await Registry.open();
         registry.add(name, dir);
         registry.save();
+        if (!ctx.json) {
+            note(`${green('created')} ${bold(name)} ${dim(dir)}`);
+            for (const file of written.files.filter((f) => !f.startsWith('.'))) {
+                note(`  ${dim(file)}`);
+            }
+            note();
+        }
+        const sandbox = await prepareSandbox(dir, ctx.json);
         if (ctx.json) {
-            json({ name, path: dir, model, files, credential: provider ?? null, web });
+            json({
+                name,
+                path: dir,
+                model,
+                files: written.files,
+                editor: written.editor,
+                credential: provider ?? null,
+                web,
+                sandbox,
+            });
             return;
         }
-        note(`${green('created')} ${bold(name)} ${dim(dir)}`);
-        for (const file of files) {
-            note(`  ${dim(file)}`);
-        }
-        note();
         if (web) {
             note(`${green('exa key found')} ${dim('— the default agent gets web search')}`);
             note();
@@ -154,4 +173,45 @@ export const init = {
         write(dir);
     },
 };
+/**
+ * Builds the sandbox image the project was just given, here rather than on the
+ * first run.
+ *
+ * It has to happen once either way, and the two moments are not equally good:
+ * a build during `init` is a command that is visibly setting a project up,
+ * while the same minutes during `zen run` land in the middle of a question
+ * somebody asked and read as a hung model.
+ *
+ * Never fatal. A machine with no container engine has a perfectly good project
+ * on it — one whose agent cannot start a shell yet — and refusing to finish
+ * `init` over that would throw away everything already written.
+ */
+async function prepareSandbox(dir, quiet) {
+    let image;
+    try {
+        const { root, config } = readProjectConfig(dir);
+        const build = resolveBuild(root, config.sandbox);
+        image = build?.tag ?? config.sandbox?.image;
+        if (!build && !image) {
+            return false;
+        }
+        // Nothing to answer: `init` is not the place to be asked whether to
+        // install a package manager's worth of software.
+        await ensurePodmanReady({ image, build, yes: true });
+        if (!quiet) {
+            note(`${green('sandbox ready')} ${dim(image ?? '')}`);
+            note();
+        }
+        return true;
+    }
+    catch (err) {
+        if (!quiet) {
+            const why = err instanceof Error ? err.message : String(err);
+            note(`${yellow('sandbox not ready')} ${dim(`— ${why}`)}`);
+            note(`  ${cyan('zen sandbox up')} ${dim('— or the first run will try again')}`);
+            note();
+        }
+        return false;
+    }
+}
 //# sourceMappingURL=init.js.map

package/dist/commands/key.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { parse } from "../args.js";
 import { ensureHome } from "../home.js";
-import { assertNotEmpty, describe, keyId, KeyStore, mask, OWNERS, parseRef, SHAPES, } from "../keys.js";
+import { ambient, ambientId, assertNotEmpty, describe, envNames, envOf, keyId, KeyStore, mask, OWNERS, parseRef, SHAPES, } from "../keys.js";
 import { probe, probeAll } from "../liveness.js";
 import { ago, ask, askSecret, bold, confirm, credentialError, cyan, dim, green, isInteractive, json, note, progress, readStdin, red, table, usageError, write, writeAll, yellow, } from "../term.js";
 const USAGE = 'zen key <ls|add|use|check|rm|show|env> [ref] [options]';
@@ -11,40 +11,65 @@ const USAGE = 'zen key <ls|add|use|check|rm|show|env> [ref] [options]';
 const MARK = {
     live: green('live'),
     dead: red('dead'),
+    blocked: yellow('blocked'),
     unknown: dim('unknown'),
 };
 function state(entry) {
     return entry.check ? MARK[entry.check.state] : dim('unchecked');
 }
-function rows(store) {
+/**
+ * An ambient credential borrowed into the shape the rest of this file works
+ * in. It is not in the store and never will be: `store.find` misses it, so
+ * `store.record` drops its check and nothing is written to disk. That is the
+ * intent — it can be listed and probed, not chosen or forgotten.
+ */
+function asEntry(cred) {
+    return {
+        provider: cred.provider,
+        name: cred.env ? `$${cred.env}` : 'adc',
+        holds: cred.holds,
+        value: cred.value,
+        env: cred.env,
+        addedAt: new Date().toISOString(),
+    };
+}
+function rows(store, borrowed) {
     const out = [
         [bold(''), bold('KEY'), bold('VALUE'), bold('STATE'), bold('CHECKED')],
     ];
     for (const provider of OWNERS) {
         for (const entry of store.for(provider)) {
-            const shadowed = Boolean(process.env[SHAPES[provider].env]);
+            const shadow = envNames(provider).find((name) => process.env[name]);
             out.push([
                 store.isActive(entry) ? green('*') : ' ',
                 keyId(entry),
                 dim(describe(store, entry)),
                 state(entry),
                 dim(entry.check ? ago(entry.check.at) : '—') +
-                    (shadowed && store.isActive(entry)
-                        ? yellow(`  shadowed by $${SHAPES[provider].env}`)
-                        : ''),
+                    (shadow && store.isActive(entry) ? yellow(`  shadowed by $${shadow}`) : ''),
+            ]);
+        }
+        for (const [cred, entry] of borrowed.filter(([c]) => c.provider === provider)) {
+            out.push([
+                dim('~'),
+                dim(ambientId(cred)),
+                dim(describe(store, entry)),
+                state(entry),
+                dim(cred.env ? 'from the environment' : 'from gcloud'),
             ]);
         }
     }
     return table(out);
 }
 /**
- * Checking is a network round trip per key, so it says which one it is waiting
- * on. Silence for ten seconds is indistinguishable from a hang.
+ * Checking is a network round trip per key, so it says which ones have come
+ * back. Silence for ten seconds is indistinguishable from a hang.
  */
 async function checkAll(ctx, store, targets) {
     const bar = ctx.json ? undefined : progress();
+    bar?.update(dim(`checking ${targets.length} key${targets.length === 1 ? '' : 's'} …`));
     try {
-        return await probeAll(store, targets, (entry, index, total) => bar?.update(dim(`checking ${keyId(entry)} … ${index + 1}/${total}`)));
+        return await probeAll(store, targets, (entry, done, total) => bar?.update(dim(`checked ${keyId(entry)} … ${done}/${total}`)));
     }
     finally {
         bar?.done();
@@ -53,29 +78,47 @@ async function checkAll(ctx, store, targets) {
 const ls = async (ctx, args) => {
     const { values } = parse(args, { check: { type: 'boolean' } }, USAGE);
     const store = await KeyStore.open();
+    const borrowed = ambient(store).map((cred) => [cred, asEntry(cred)]);
     if (values.check) {
-        const checks = await checkAll(ctx, store, store.entries);
+        // Ambient credentials are checked alongside the stored ones and, unlike
+        // them, forgotten again: there is nowhere to write the result, and a
+        // variable that changes between runs would make a cached one a lie.
+        const checks = await checkAll(ctx, store, [
+            ...store.entries,
+            ...borrowed.map(([, entry]) => entry),
+        ]);
         for (const [entry, check] of checks) {
             store.record(entry, check);
+            entry.check = check;
         }
         store.save();
     }
     if (ctx.json) {
-        json(store.entries.map((e) => ({
-            ...e,
-            value: e.holds === 'file' ? store.fileOf(e) : mask(e.value),
-            active: store.isActive(e),
-            env: SHAPES[e.provider].env,
-        })));
+        json({
+            keys: store.entries.map((e) => ({
+                ...e,
+                value: e.holds === 'file' ? store.fileOf(e) : mask(e.value),
+                active: store.isActive(e),
+                env: envOf(e),
+            })),
+            ambient: borrowed.map(([cred, entry]) => ({
+                provider: cred.provider,
+                id: ambientId(cred),
+                env: cred.env ?? null,
+                holds: cred.holds,
+                value: cred.holds === 'file' ? cred.value : mask(cred.value),
+                check: entry.check,
+            })),
+        });
         return;
     }
-    if (store.entries.length === 0) {
+    if (store.entries.length === 0 && borrowed.length === 0) {
         note('the keyring is empty');
         note(dim('add one: zen key add openai'));
         return;
     }
-    writeAll(rows(store));
-    const missing = OWNERS.filter((p) => !store.active(p) && !process.env[SHAPES[p].env]);
+    writeAll(rows(store, borrowed));
+    const missing = OWNERS.filter((p) => !store.active(p) && !borrowed.some(([c]) => c.provider === p));
     if (missing.length) {
         note('');
         note(dim(`no key for: ${missing.join(', ')}`));
@@ -87,7 +130,12 @@ const ls = async (ctx, args) => {
  * Piped stdin or an echo-off prompt are the only two ways in.
  */
 const add = async (ctx, args) => {
-    const { values, positionals } = parse(args, { name: { type: 'string' }, 'no-check': { type: 'boolean' } }, 'zen key add <provider>[/name] [--name <name>] [--no-check]');
+    const { values, positionals } = parse(args, {
+        name: { type: 'string' },
+        'no-check': { type: 'boolean' },
+        project: { type: 'string' },
+        location: { type: 'string' },
+    }, 'zen key add <provider>[/name] [--name <name>] [--project <id>] [--location <region>] [--no-check]');
     const ref = positionals[0];
     if (!ref) {
         throw usageError('which provider?', `one of: ${OWNERS.join(', ')}`);
@@ -96,6 +144,9 @@ const add = async (ctx, args) => {
     const provider = parsed.provider;
     const name = values.name ?? parsed.name ?? 'default';
     const shape = SHAPES[provider];
+    if ((values.project || values.location) && provider !== 'vertex') {
+        throw usageError(`--project and --location mean nothing to ${shape.label}`, 'they configure a Vertex service account');
+    }
     ensureHome();
     const store = await KeyStore.open();
     if (store.find(provider, name) && isInteractive()) {
@@ -103,14 +154,20 @@ const add = async (ctx, args) => {
             throw usageError('cancelled');
         }
     }
-    const raw = (await readStdin()) ?? (await promptFor(shape.holds, shape.label, shape.where));
+    const raw = (await readStdin()) ?? (await promptFor(shape));
     if (!raw) {
         throw usageError('no value given');
     }
-    if (shape.holds === 'file' && !existsSync(raw)) {
+    // A provider with one form can say up front that a path is wrong. One with
+    // two cannot: a value that is not a path is not a mistake there, it is the
+    // other kind of credential, and `add` decides which by looking.
+    if (shape.forms.length === 1 && shape.forms[0].holds === 'file' && !existsSync(raw)) {
         throw usageError(`no such file: ${raw}`);
     }
-    const entry = store.add(provider, name, raw);
+    const entry = store.add(provider, name, raw, {
+        project: values.project,
+        location: values.location,
+    });
     // Verified before it is trusted, but stored either way: a key that cannot
     // be checked right now — offline, behind a proxy — is not a key that is
     // wrong, and refusing to save it would make `zen key add` fail on a plane.
@@ -123,25 +180,48 @@ const add = async (ctx, args) => {
         if (check.state === 'dead') {
             note(`${red('rejected')} ${check.detail ?? 'the provider refused this key'}`);
         }
+        else if (check.state === 'blocked') {
+            note(`${yellow('blocked')} ${check.detail ?? 'the account cannot use this key'}`);
+            if (check.fix) {
+                note(dim(`  ${check.fix}`));
+            }
+        }
     }
     store.save();
     if (ctx.json) {
         json({
             key: keyId(entry),
-            env: shape.env,
+            env: envOf(entry),
             active: store.isActive(entry),
             check: entry.check,
         });
         return;
     }
-    note(`${green('added')} ${bold(keyId(entry))} ${dim(describe(store, entry))} ${state(entry)}`);
-    if (process.env[shape.env]) {
-        note(yellow(`$${shape.env} is set and will win over this`));
+    note(`${green('added')} ${bold(keyId(entry))} ${dim(describe(store, entry))} ` +
+        `${dim(`→ $${envOf(entry)}`)} ${state(entry)}`);
+    if (process.env[envOf(entry)]) {
+        note(yellow(`$${envOf(entry)} is set and will win over this`));
+    }
+    if (provider === 'vertex' && entry.holds === 'file' && !entry.project) {
+        note(dim('no --project given; the project_id inside the file will be used'));
     }
 };
-async function promptFor(holds, label, where) {
-    note(dim(`${label} — ${where}`));
-    return holds === 'file'
+/**
+ * A provider with two forms cannot ask for one of them. It asks with the echo
+ * off, because one of the two answers is a secret and there is no way to know
+ * which is coming until it arrives.
+ */
+async function promptFor(shape) {
+    const [first, ...rest] = shape.forms;
+    if (rest.length) {
+        note(dim(`${shape.label} — ${first.where},`));
+        for (const form of rest) {
+            note(dim(`  or ${form.where}`));
+        }
+        return askSecret('Paste the key, or a path to the file:');
+    }
+    note(dim(`${shape.label} — ${first.where}`));
+    return first.holds === 'file'
         ? ask('Path to the credentials file:')
         : askSecret('Paste the key (it will not be shown):');
 }
@@ -159,7 +239,7 @@ const use = async (ctx, args) => {
     const entry = store.use(provider, name);
     store.save();
     if (ctx.json) {
-        json({ key: keyId(entry), env: SHAPES[provider].env });
+        json({ key: keyId(entry), env: envOf(entry) });
         return;
     }
     note(`${green('using')} ${bold(keyId(entry))} for ${SHAPES[provider].label}`);
@@ -183,9 +263,19 @@ const check = async (ctx, args) => {
         MARK[result.state],
         dim(result.detail ?? ''),
     ])));
+    for (const [entry, result] of checks) {
+        if (result.fix) {
+            note(dim(`${keyId(entry)}: ${result.fix}`));
+        }
+    }
     if (checks.some(([, r]) => r.state === 'dead')) {
         throw credentialError('at least one key was refused');
     }
+    // Separately, because the action is not the same one: these authenticated,
+    // and a replacement key would be refused for exactly the same reason.
+    if (checks.some(([, r]) => r.state === 'blocked')) {
+        throw credentialError('at least one key authenticated but cannot be used');
+    }
 };
 function select(store, ref) {
     const { provider, name } = parseRef(ref);
@@ -242,7 +332,7 @@ const show = async (ctx, args) => {
     if (ctx.json) {
         json({
             key: keyId(entry),
-            env: SHAPES[entry.provider].env,
+            env: envOf(entry),
             value,
             revealed: Boolean(values.reveal),
         });
@@ -256,9 +346,12 @@ const show = async (ctx, args) => {
     }
     writeAll(table([
         [dim('key'), keyId(entry)],
-        [dim('env'), SHAPES[entry.provider].env],
+        [dim('env'), envOf(entry)],
         [dim('value'), value],
+        ...(entry.project ? [[dim('project'), entry.project]] : []),
+        ...(entry.location ? [[dim('location'), entry.location]] : []),
         [dim('state'), state(entry)],
+        ...(entry.check?.fix ? [[dim('fix'), entry.check.fix]] : []),
         [dim('added'), ago(entry.addedAt)],
     ]));
     note(dim('--reveal prints the secret itself'));
@@ -278,8 +371,18 @@ const env = async (ctx, args) => {
     const vars = {};
     for (const provider of only ?? OWNERS) {
         const entry = store.active(provider);
-        if (entry) {
-            vars[SHAPES[provider].env] = store.reveal(entry);
+        if (!entry) {
+            continue;
+        }
+        vars[envOf(entry)] = store.reveal(entry);
+        // A service account says which project it belongs to but not which
+        // region to call, and a shell that has the file and not the region is
+        // still a shell that cannot reach a model.
+        if (entry.project) {
+            vars.GOOGLE_CLOUD_PROJECT = entry.project;
+        }
+        if (entry.location) {
+            vars.GOOGLE_CLOUD_LOCATION = entry.location;
         }
     }
     if (ctx.json) {
@@ -306,11 +409,16 @@ export const key = {
     usage: USAGE,
     details: [
         'Keys live in ~/.zenera/neo/keys.json (0600) and are materialised into',
-        'the environment before a run. A real environment variable always wins.',
+        'the environment before a run. A real environment variable always wins,',
+        'and is listed as ~ so it is clear where a working provider comes from.',
         '',
         'Model providers: openai, anthropic, google, vertex, openrouter.',
         'Services the tools call: exa.',
         '',
+        'Vertex takes either shape: a service-account JSON file, which wants',
+        '--project and --location too, or an express-mode API key, which wants',
+        'neither. Which one you gave is read off the value.',
+        '',
         '  zen key ls [--check]              Everything stored, and its state.',
         '  zen key add <provider>[/name]     Read a key from stdin, or ask for it.',
         '  zen key use <provider>/<name>     Choose which one a run uses.',

package/dist/commands/models.d.ts

@@ -1,9 +1,3 @@
 import type { Command } from '../command.ts';
-/**
- * Everything a run would resolve, resolved — and nothing called. Loading a
- * project constructs the model clients, so a config that names an impossible
- * provider or an agent that hands off to nobody fails here, in a command that
- * costs nothing, instead of three seconds into a run that costs money.
- */
 export declare const models: Command;
 //# sourceMappingURL=models.d.ts.map