@zenera/cli 1.1.29 → 1.1.31

package/dist/catalog.js

@@ -463,10 +463,6 @@ const store = () => new Cache(CATALOG_KIND, { mode: 0o644 });
  * to both. A project left to the service-account file is not seen here.
  */
 function scope(provider) {
-    const at = gatewayOf();
-    if (at) {
-        return cacheKey(GATEWAY_NAME, at.baseURL);
-    }
     if (provider !== 'vertex') {
         return undefined;
     }
@@ -483,6 +479,29 @@ function readCache(provider) {
         ? file
         : undefined;
 }
+/**
+ * Through a gateway nothing is cached on disk: the gateway caches its own
+ * listing, one request serves every provider, and a stale copy outlives the
+ * gateway's providers or the virtual key that was allowed to see them.
+ */
+async function loadGatewayCatalog(provider, at) {
+    const via = { via: { name: GATEWAY_NAME, url: at.baseURL } };
+    try {
+        const entries = await fetchGatewayCatalog(provider, at);
+        return { provider, entries, origin: 'live', fetchedAt: new Date().toISOString(), ...via };
+    }
+    catch (err) {
+        // No built-in list: it names vendor models the gateway may not serve at all.
+        return {
+            provider,
+            entries: [],
+            origin: 'curated',
+            fetchedAt: new Date(0).toISOString(),
+            problem: classify(err),
+            ...via,
+        };
+    }
+}
 /**
  * The listing for one provider, from the cheapest source that can answer.
  *
@@ -494,9 +513,9 @@ function readCache(provider) {
  */
 export async function loadCatalog(provider, opts = {}) {
     const at = gatewayOf();
-    const via = at ? { via: { name: GATEWAY_NAME, url: at.baseURL } } : {};
-    // The built-in list names vendor models the gateway may not serve at all.
-    const fallback = () => (at ? [] : curated(provider));
+    if (at) {
+        return loadGatewayCatalog(provider, at);
+    }
     const cached = readCache(provider);
     const fresh = cached && Date.now() - new Date(cached.fetchedAt).getTime() < CATALOG_TTL_MS
         ? cached
@@ -507,17 +526,14 @@ export async function loadCatalog(provider, opts = {}) {
             entries: fresh.entries,
             origin: 'cache',
             fetchedAt: fresh.fetchedAt,
-            ...via,
         };
     }
     if (!opts.offline) {
         try {
-            const entries = at
-                ? await fetchGatewayCatalog(provider, at)
-                : await fetchCatalog(provider);
+            const entries = await fetchCatalog(provider);
             const fetchedAt = new Date().toISOString();
             store().put(catalogKey(provider), { provider, fetchedAt, entries });
-            return { provider, entries, origin: 'live', fetchedAt, ...via };
+            return { provider, entries, origin: 'live', fetchedAt };
         }
         catch (err) {
             const problem = classify(err);
@@ -528,16 +544,14 @@ export async function loadCatalog(provider, opts = {}) {
                     origin: 'stale',
                     fetchedAt: cached.fetchedAt,
                     problem,
-                    ...via,
                 };
             }
             return {
                 provider,
-                entries: fallback(),
+                entries: curated(provider),
                 origin: 'curated',
                 fetchedAt: new Date(0).toISOString(),
                 problem,
-                ...via,
             };
         }
     }
@@ -547,15 +561,13 @@ export async function loadCatalog(provider, opts = {}) {
             entries: cached.entries,
             origin: 'stale',
             fetchedAt: cached.fetchedAt,
-            ...via,
         };
     }
     return {
         provider,
-        entries: fallback(),
+        entries: curated(provider),
         origin: 'curated',
         fetchedAt: new Date(0).toISOString(),
-        ...via,
     };
 }
 // ---------------------------------------------------------------------------

package/dist/commands/key.js

@@ -4,7 +4,7 @@ import { parse } from "../args.js";
 import { ensureHome } from "../home.js";
 import { ambient, ambientId, assertNotEmpty, checkRegion, describe, envNames, envOf, formOf, GATEWAYS, isGateway, keyId, KeyStore, mask, MODES, OWNERS, parseRef, SHAPES, } from "../keys.js";
 import { probe, probeAll } from "../liveness.js";
-import { ago, ask, askSecret, badge, bold, confirm, credentialError, cyan, dim, green, isInteractive, json, note, progress, readStdin, red, table, usageError, write, writeAll, yellow, } from "../term.js";
+import { ago, ask, askSecret, badge, bold, confirm, credentialError, cyan, dim, green, isInteractive, json, note, progress, readStdin, red, table, usageError, warn, write, writeAll, yellow, } from "../term.js";
 const USAGE = 'zen key <ls|add|use|mode|check|rm|show|env> [ref] [options]';
 // ---------------------------------------------------------------------------
 // Display
@@ -54,15 +54,28 @@ function placed(store, entry) {
  * intent — it can be listed and probed, not chosen or forgotten.
  */
 function asEntry(cred) {
+    const url = isGateway(cred.provider) ? envUrl() : undefined;
     return {
         provider: cred.provider,
         name: cred.env ? `$${cred.env}` : 'adc',
         holds: cred.holds,
         value: cred.value,
         env: cred.env,
+        ...(url ? { url } : {}),
         addedAt: new Date().toISOString(),
     };
 }
+const envUrl = () => process.env[GATEWAY_URL_ENV]?.trim() || undefined;
+/** Where a gateway mode sends runs, and with which key: the environment beats the keyring. */
+function route(store, mode) {
+    const entry = store.active(mode);
+    const shell = envNames(mode).find((name) => process.env[name]);
+    return {
+        url: envUrl() ?? entry?.url,
+        key: shell ? `$${shell}` : entry ? keyId(entry) : undefined,
+    };
+}
+const FROM_ENV = `set by $${GATEWAY_URL_ENV} in the environment`;
 function rows(store, borrowed) {
     const out = [
         [bold(''), bold('KEY'), bold('VALUE'), bold('WHERE'), bold('STATE'), bold('CHECKED')],
@@ -131,10 +144,12 @@ function modeLine(store) {
         }
         return;
     }
-    const gateway = store.active(mode);
-    note(`${cyan(badge(`⇄ ${mode.toUpperCase()} MODE`))} ${bold(gateway?.url ?? 'no url stored')}`);
-    note(dim(`every model goes through the gateway with ${gateway ? keyId(gateway) : 'no key'}; ` +
-        'vendor keys are not used — zen key mode direct to stop'));
+    const { url, key } = route(store, mode);
+    note(`${cyan(badge(`⇄ ${mode.toUpperCase()} MODE`))} ${bold(url ?? 'no url stored')}`);
+    note(dim(`every model goes through the gateway with ${key ?? 'no key'}; vendor keys are not used — ` +
+        (store.modeFrom === 'env'
+            ? `${FROM_ENV}, unset it to stop`
+            : 'zen key mode direct to stop')));
     note('');
 }
 /**
@@ -189,7 +204,7 @@ const ls = async (ctx, args) => {
         });
         return;
     }
-    if (store.entries.length === 0 && borrowed.length === 0) {
+    if (store.entries.length === 0 && borrowed.length === 0 && store.mode === 'direct') {
         note('the keyring is empty');
         note(dim('add one: zen key add openai'));
         return;
@@ -392,27 +407,44 @@ const mode = async (ctx, args) => {
         if (!MODES.includes(wanted)) {
             throw usageError(`unknown mode "${wanted}"`, `one of: ${MODES.join(', ')}`);
         }
-        store.setMode(wanted);
-        store.save();
+        // Already on through the environment: storing it as well needs a gateway key of its own.
+        const viaEnv = store.modeFrom === 'env' && wanted === store.mode;
+        if (!viaEnv || store.active(store.mode)?.url) {
+            store.setMode(wanted);
+            store.save();
+        }
+        if (store.modeFrom === 'env' && wanted !== store.mode) {
+            warn(`saved, but ${FROM_ENV} wins: unset it to call vendors directly`);
+        }
     }
     const now = store.mode;
-    const gateway = now === 'direct' ? undefined : store.active(now);
+    const from = store.modeFrom;
+    const { url, key } = now === 'direct' ? {} : route(store, now);
     if (ctx.json) {
-        json({ mode: now, ...(gateway ? { key: keyId(gateway), url: gateway.url } : {}) });
+        json({ mode: now, from, ...(key ? { key } : {}), ...(url ? { url } : {}) });
         return;
     }
-    if (!gateway) {
+    if (now === 'direct') {
         note(`${cyan('direct')} ${dim('— each provider is called with its own key')}`);
         return;
     }
-    note(`${cyan(now)} ${dim('— every model goes through')} ${gateway.url} ` +
-        dim(`with ${keyId(gateway)}`));
+    note(`${cyan(now)} ${dim('— every model goes through')} ${url ?? 'no url stored'} ` +
+        dim(`with ${key ?? 'no key'}`));
+    if (from === 'env') {
+        note(dim(FROM_ENV));
+    }
 };
 const check = async (ctx, args) => {
     const { positionals } = parse(args, {}, 'zen key check [provider[/name]]');
     const store = await KeyStore.open();
-    assertNotEmpty(store);
-    const targets = positionals[0] ? select(store, positionals[0]) : store.entries;
+    // Checked like stored keys, never recorded: `store.record` finds no entry for them.
+    const borrowed = ambient(store).map(asEntry);
+    const targets = positionals[0]
+        ? select(store, positionals[0], borrowed)
+        : [...store.entries, ...borrowed];
+    if (targets.length === 0) {
+        assertNotEmpty(store);
+    }
     const checks = await checkAll(ctx, store, targets);
     for (const [entry, result] of checks) {
         store.record(entry, result);
@@ -441,12 +473,13 @@ const check = async (ctx, args) => {
         throw credentialError('at least one key authenticated but cannot be used');
     }
 };
-function select(store, ref) {
+function select(store, ref, borrowed = []) {
     const { provider, name } = parseRef(ref);
     if (!name) {
-        return store.for(provider);
+        return [...store.for(provider), ...borrowed.filter((e) => e.provider === provider)];
     }
-    const entry = store.find(provider, name);
+    const entry = store.find(provider, name) ??
+        borrowed.find((e) => e.provider === provider && e.name === name);
     if (!entry) {
         throw usageError(`no key ${ref}`, 'see: zen key ls');
     }

package/dist/keys.d.ts

@@ -164,7 +164,9 @@ export declare class KeyStore {
     remove(provider: KeyOwner, name: string): boolean;
     use(provider: KeyOwner, name: string): KeyEntry;
     record(entry: KeyEntry, check: KeyCheck): void;
+    /** A `BIFROST_BASE_URL` in the environment wins over the keyring, as it does for the runtime. */
     get mode(): KeyMode;
+    get modeFrom(): 'env' | 'keyring';
     /** Refuses a gateway mode with no gateway to send anything to. */
     setMode(mode: KeyMode): void;
     save(): void;

package/dist/keys.js

@@ -380,8 +380,12 @@ export class KeyStore {
             hit.check = check;
         }
     }
+    /** A `BIFROST_BASE_URL` in the environment wins over the keyring, as it does for the runtime. */
     get mode() {
-        return this.#file.mode ?? 'direct';
+        return this.modeFrom === 'env' ? 'bifrost' : (this.#file.mode ?? 'direct');
+    }
+    get modeFrom() {
+        return process.env[GATEWAY_URL_ENV]?.trim() ? 'env' : 'keyring';
     }
     /** Refuses a gateway mode with no gateway to send anything to. */
     setMode(mode) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/cli",
-    "version": "1.1.29",
+    "version": "1.1.31",
     "description": "Command-line front end for @zenera/neo: agentic projects you can run, share and commit.",
     "keywords": [
         "agents",
@@ -54,8 +54,8 @@
         "@google/genai": "^2.30.0",
         "@inkjs/ui": "^2.0.0",
         "@openrouter/sdk": "^1.4.25",
-        "@zenera/neo": "^1.1.29",
-        "@zenera/view": "^1.1.29",
+        "@zenera/neo": "^1.1.31",
+        "@zenera/view": "^1.1.31",
         "google-auth-library": "^10.0.0",
         "ink": "^7.1.1",
         "openai": "^6.0.0",

package/templates/editor/.github/skills/zen-cli/references/keys.md

@@ -73,7 +73,9 @@ Declared providers are rerouted too. `zen check` then reports
 `BIFROST_API_KEY`, not the vendor variables, as the credential in use.
 
 The switch is `BIFROST_BASE_URL` itself, so exporting it in a shell or a `.env`
-turns gateway mode on without the keyring. In this mode `zen models` lists only
+turns gateway mode on without the keyring - and `zen key mode`/`ls`/`check`
+report and probe it (`bifrost/$BIFROST_API_KEY`), with nothing stored. In this
+mode `zen models` lists only
 what the gateway serves - see `models.md`. The full guide is
 [docs/gateway.md](https://github.com/andreyryabov/ZeneraNeo/blob/main/docs/gateway.md).