@zenera/cli 1.1.29 → 1.1.30

package/dist/commands/key.js

@@ -4,7 +4,7 @@ import { parse } from "../args.js";
 import { ensureHome } from "../home.js";
 import { ambient, ambientId, assertNotEmpty, checkRegion, describe, envNames, envOf, formOf, GATEWAYS, isGateway, keyId, KeyStore, mask, MODES, OWNERS, parseRef, SHAPES, } from "../keys.js";
 import { probe, probeAll } from "../liveness.js";
-import { ago, ask, askSecret, badge, bold, confirm, credentialError, cyan, dim, green, isInteractive, json, note, progress, readStdin, red, table, usageError, write, writeAll, yellow, } from "../term.js";
+import { ago, ask, askSecret, badge, bold, confirm, credentialError, cyan, dim, green, isInteractive, json, note, progress, readStdin, red, table, usageError, warn, write, writeAll, yellow, } from "../term.js";
 const USAGE = 'zen key <ls|add|use|mode|check|rm|show|env> [ref] [options]';
 // ---------------------------------------------------------------------------
 // Display
@@ -54,15 +54,28 @@ function placed(store, entry) {
  * intent — it can be listed and probed, not chosen or forgotten.
  */
 function asEntry(cred) {
+    const url = isGateway(cred.provider) ? envUrl() : undefined;
     return {
         provider: cred.provider,
         name: cred.env ? `$${cred.env}` : 'adc',
         holds: cred.holds,
         value: cred.value,
         env: cred.env,
+        ...(url ? { url } : {}),
         addedAt: new Date().toISOString(),
     };
 }
+const envUrl = () => process.env[GATEWAY_URL_ENV]?.trim() || undefined;
+/** Where a gateway mode sends runs, and with which key: the environment beats the keyring. */
+function route(store, mode) {
+    const entry = store.active(mode);
+    const shell = envNames(mode).find((name) => process.env[name]);
+    return {
+        url: envUrl() ?? entry?.url,
+        key: shell ? `$${shell}` : entry ? keyId(entry) : undefined,
+    };
+}
+const FROM_ENV = `set by $${GATEWAY_URL_ENV} in the environment`;
 function rows(store, borrowed) {
     const out = [
         [bold(''), bold('KEY'), bold('VALUE'), bold('WHERE'), bold('STATE'), bold('CHECKED')],
@@ -131,10 +144,12 @@ function modeLine(store) {
         }
         return;
     }
-    const gateway = store.active(mode);
-    note(`${cyan(badge(`⇄ ${mode.toUpperCase()} MODE`))} ${bold(gateway?.url ?? 'no url stored')}`);
-    note(dim(`every model goes through the gateway with ${gateway ? keyId(gateway) : 'no key'}; ` +
-        'vendor keys are not used — zen key mode direct to stop'));
+    const { url, key } = route(store, mode);
+    note(`${cyan(badge(`⇄ ${mode.toUpperCase()} MODE`))} ${bold(url ?? 'no url stored')}`);
+    note(dim(`every model goes through the gateway with ${key ?? 'no key'}; vendor keys are not used — ` +
+        (store.modeFrom === 'env'
+            ? `${FROM_ENV}, unset it to stop`
+            : 'zen key mode direct to stop')));
     note('');
 }
 /**
@@ -189,7 +204,7 @@ const ls = async (ctx, args) => {
         });
         return;
     }
-    if (store.entries.length === 0 && borrowed.length === 0) {
+    if (store.entries.length === 0 && borrowed.length === 0 && store.mode === 'direct') {
         note('the keyring is empty');
         note(dim('add one: zen key add openai'));
         return;
@@ -392,27 +407,44 @@ const mode = async (ctx, args) => {
         if (!MODES.includes(wanted)) {
             throw usageError(`unknown mode "${wanted}"`, `one of: ${MODES.join(', ')}`);
         }
-        store.setMode(wanted);
-        store.save();
+        // Already on through the environment: storing it as well needs a gateway key of its own.
+        const viaEnv = store.modeFrom === 'env' && wanted === store.mode;
+        if (!viaEnv || store.active(store.mode)?.url) {
+            store.setMode(wanted);
+            store.save();
+        }
+        if (store.modeFrom === 'env' && wanted !== store.mode) {
+            warn(`saved, but ${FROM_ENV} wins: unset it to call vendors directly`);
+        }
     }
     const now = store.mode;
-    const gateway = now === 'direct' ? undefined : store.active(now);
+    const from = store.modeFrom;
+    const { url, key } = now === 'direct' ? {} : route(store, now);
     if (ctx.json) {
-        json({ mode: now, ...(gateway ? { key: keyId(gateway), url: gateway.url } : {}) });
+        json({ mode: now, from, ...(key ? { key } : {}), ...(url ? { url } : {}) });
         return;
     }
-    if (!gateway) {
+    if (now === 'direct') {
         note(`${cyan('direct')} ${dim('— each provider is called with its own key')}`);
         return;
     }
-    note(`${cyan(now)} ${dim('— every model goes through')} ${gateway.url} ` +
-        dim(`with ${keyId(gateway)}`));
+    note(`${cyan(now)} ${dim('— every model goes through')} ${url ?? 'no url stored'} ` +
+        dim(`with ${key ?? 'no key'}`));
+    if (from === 'env') {
+        note(dim(FROM_ENV));
+    }
 };
 const check = async (ctx, args) => {
     const { positionals } = parse(args, {}, 'zen key check [provider[/name]]');
     const store = await KeyStore.open();
-    assertNotEmpty(store);
-    const targets = positionals[0] ? select(store, positionals[0]) : store.entries;
+    // Checked like stored keys, never recorded: `store.record` finds no entry for them.
+    const borrowed = ambient(store).map(asEntry);
+    const targets = positionals[0]
+        ? select(store, positionals[0], borrowed)
+        : [...store.entries, ...borrowed];
+    if (targets.length === 0) {
+        assertNotEmpty(store);
+    }
     const checks = await checkAll(ctx, store, targets);
     for (const [entry, result] of checks) {
         store.record(entry, result);
@@ -441,12 +473,13 @@ const check = async (ctx, args) => {
         throw credentialError('at least one key authenticated but cannot be used');
     }
 };
-function select(store, ref) {
+function select(store, ref, borrowed = []) {
     const { provider, name } = parseRef(ref);
     if (!name) {
-        return store.for(provider);
+        return [...store.for(provider), ...borrowed.filter((e) => e.provider === provider)];
     }
-    const entry = store.find(provider, name);
+    const entry = store.find(provider, name) ??
+        borrowed.find((e) => e.provider === provider && e.name === name);
     if (!entry) {
         throw usageError(`no key ${ref}`, 'see: zen key ls');
     }

package/dist/keys.d.ts

@@ -164,7 +164,9 @@ export declare class KeyStore {
     remove(provider: KeyOwner, name: string): boolean;
     use(provider: KeyOwner, name: string): KeyEntry;
     record(entry: KeyEntry, check: KeyCheck): void;
+    /** A `BIFROST_BASE_URL` in the environment wins over the keyring, as it does for the runtime. */
     get mode(): KeyMode;
+    get modeFrom(): 'env' | 'keyring';
     /** Refuses a gateway mode with no gateway to send anything to. */
     setMode(mode: KeyMode): void;
     save(): void;

package/dist/keys.js

@@ -380,8 +380,12 @@ export class KeyStore {
             hit.check = check;
         }
     }
+    /** A `BIFROST_BASE_URL` in the environment wins over the keyring, as it does for the runtime. */
     get mode() {
-        return this.#file.mode ?? 'direct';
+        return this.modeFrom === 'env' ? 'bifrost' : (this.#file.mode ?? 'direct');
+    }
+    get modeFrom() {
+        return process.env[GATEWAY_URL_ENV]?.trim() ? 'env' : 'keyring';
     }
     /** Refuses a gateway mode with no gateway to send anything to. */
     setMode(mode) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/cli",
-    "version": "1.1.29",
+    "version": "1.1.30",
     "description": "Command-line front end for @zenera/neo: agentic projects you can run, share and commit.",
     "keywords": [
         "agents",
@@ -54,8 +54,8 @@
         "@google/genai": "^2.30.0",
         "@inkjs/ui": "^2.0.0",
         "@openrouter/sdk": "^1.4.25",
-        "@zenera/neo": "^1.1.29",
-        "@zenera/view": "^1.1.29",
+        "@zenera/neo": "^1.1.30",
+        "@zenera/view": "^1.1.30",
         "google-auth-library": "^10.0.0",
         "ink": "^7.1.1",
         "openai": "^6.0.0",

package/templates/editor/.github/skills/zen-cli/references/keys.md

@@ -73,7 +73,9 @@ Declared providers are rerouted too. `zen check` then reports
 `BIFROST_API_KEY`, not the vendor variables, as the credential in use.
 
 The switch is `BIFROST_BASE_URL` itself, so exporting it in a shell or a `.env`
-turns gateway mode on without the keyring. In this mode `zen models` lists only
+turns gateway mode on without the keyring - and `zen key mode`/`ls`/`check`
+report and probe it (`bifrost/$BIFROST_API_KEY`), with nothing stored. In this
+mode `zen models` lists only
 what the gateway serves - see `models.md`. The full guide is
 [docs/gateway.md](https://github.com/andreyryabov/ZeneraNeo/blob/main/docs/gateway.md).