kira-wallet 0.1.3 → 0.1.5

package/README.md

@@ -43,11 +43,12 @@ For a viewer without wallet or research actions, use `kira start --read-only`.
 Prefer an archive? [GitHub releases](https://github.com/realproject7/kira-wallet/releases/tag/v0.1.2)
 include the same package and its checksum.
 
-1. **Add a watching wallet.** Paste a public address and give it a name. Add more
-   wallets whenever you need them.
-2. **Set up discovery.** In **Workspace settings**, connect an indexer for broad
+1. **Set up discovery.** In **Workspace settings**, connect an indexer for broad
    ERC20 discovery. Public RPC alone has limited discovery; incomplete coverage
-   stays visible.
+   stays visible. An AI or browser wallet connection does not enable an indexer.
+2. **Add a watching wallet.** Paste a public address and give it a name. Add more
+   wallets whenever you need them. Without discovery, the form explicitly
+   offers limited research of native and Mint Club assets.
 3. **Connect your AI.** Install and sign in to the
    [Codex CLI](https://developers.openai.com/codex/cli) or
    [Claude Code](https://code.claude.com/docs/en/quickstart), then choose your
@@ -117,6 +118,12 @@ package. Use `--data-dir /absolute/private/directory` before a command to choose
 another workspace. For connection, model or provider help, see the
 [CLI guide](docs/CLI.md) and [viewer guide](viewer/README.md).
 
+From 0.1.4, a partial wallet analysis explains disabled discovery, missing
+credentials and network failures directly beside the holdings. After connecting
+discovery, use **Refresh holdings** to create a new analysis. **Refresh prices**
+does not discover missing tokens. Existing workspace provider settings and
+published snapshots are preserved.
+
 ## Build and contribute
 
 ```sh

package/docs/CLI.md

@@ -10,8 +10,9 @@ npm install -g kira-wallet
 kira setup
 ```
 
-The npm registry currently offers version 0.1.2. The same archive and checksum
-are available from the [GitHub release](https://github.com/realproject7/kira-wallet/releases/tag/v0.1.2).
+The operator published npm version 0.1.4. Version 0.1.5 is a preparation candidate. GitHub v0.1.3 remains
+a draft; the previous archive and checksum are available from the
+[0.1.2 GitHub release](https://github.com/realproject7/kira-wallet/releases/tag/v0.1.2).
 Registry publication remains an operator action. The code and original character assets use the MIT license.
 
 ## Lifecycle
@@ -33,7 +34,7 @@ read-only and control modes requires an explicit stop and restart. Starting
 an already-running app in the same mode reuses its URL. The old `--controls`
 option remains accepted for existing scripts but is no longer needed.
 
-These startup defaults apply from 0.1.3. In the published 0.1.2 package, use
+These startup defaults apply from published 0.1.3. In the older 0.1.2 package, use
 `kira setup` or `kira start --controls` for the full app.
 
 The 0.1.2 GitHub release starts with a wallet checklist. Add a public EVM
@@ -41,17 +42,22 @@ address or use the browser wallet picker. Registration starts one explicit
 research job; follow it in Activity and read the saved portfolio report.
 No signature, seed phrase or private key is needed.
 
+Published 0.1.4 explains limited discovery before wallet registration and beside
+holdings. Missing coverage keeps the portfolio estimate partial. Existing snapshots require a holdings refresh after connecting
+an indexer; a price refresh does not discover missing tokens.
+
 Public RPC checks known assets and Mint Club. For broader ERC20 discovery,
-open Research connections, select Alchemy and name the private environment
-variable holding its key. Never paste the key into the browser. `kira doctor`
+open Data provider connection, select Alchemy and follow its local key guide.
+The 0.1.5 candidate uses one save for Alchemy RPC and discovery; chain overrides
+remain under Advanced. Never paste the key into the browser. `kira doctor`
 checks whether the configured key is available. Configuration alone does not
 prove complete coverage; inspect the recorded results and gaps.
 
 Connecting Codex or Claude is optional. Use Connect your AI when ready, verify
 a generic response and explicitly choose context permissions. Assistant answers
 render a safe Markdown subset; raw HTML, images and links remain inert text.
-Install the 0.1.1 GitHub archive for this wallet-first setup. The npm registry's
-0.1.0 package continues to use the earlier account-first setup.
+The wallet-first setup is included in published npm 0.1.3. The historical
+0.1.0 package uses the earlier account-first setup.
 
 ## Your model account
 
@@ -62,8 +68,12 @@ authentication. Verified adapter versions are Codex 0.158.x and Claude Code
 verified. This is a native CLI connection, with no Kira account, API-key proxy or
 hosted portfolio backend.
 
-In setup, choose the CLI account and an optional model ID. The blank model field
-uses the CLI default. Choose no automatic wallet context, one registered wallet,
+In the 0.1.5 candidate, setup opens the existing Account / Permissions / Ready
+modal directly. Choose Codex or Claude, then Use default model or a readable
+model choice. Codex choices come from bounded native metadata; Claude offers
+Sonnet, Opus and Haiku aliases. A catalog is not proof of account access.
+Advanced accepts a custom identifier and preserves saved identifiers absent
+from the catalog. Workspace settings reopens the same selector and permissions. Choose no automatic wallet context, one registered wallet,
 or the whole recorded portfolio. A generic response check sends no wallet data
 and must pass before these settings are saved.
 
@@ -73,7 +83,10 @@ and contract identities, timestamps, unknown prices and coverage. Credentials,
 RPC endpoints, raw provider errors and local paths are excluded. Changing the
 provider, model, context or selected wallet creates a new conversation.
 
-Kira-local history is opt-in and uses private `conversations/` files. With history
+New setup in 0.1.5 recommends saving history and preselects it. Existing saved
+true and false choices are restored exactly. Saving lets you reopen chats after
+restart; it does not expand model memory or wallet access. The choice and
+research permission remain editable in Workspace settings. Kira-local history uses private `conversations/` files. With history
 off, conversations and drafts stay in memory. A new server process starts a fresh
 conversation; saved files remain available locally and are not automatically
 replayed. Native CLI, administrator policy and provider data policies remain a
@@ -129,8 +142,8 @@ kira config import-env --file /absolute/private/rpc.env --key-env ALCHEMY_API_KE
 ```
 
 The import references the file instead of copying keys. It configures Alchemy
-RPC and portfolio discovery separately, with public fallback enabled to match
-the historical engine. Environment overrides the file. Missing files or keys
+RPC and portfolio discovery together, preserving existing custom chain overrides
+and explicit fallback preferences. New configurations allow public fallback. Environment overrides the file. Missing files or keys
 produce limited coverage; malformed configuration fails with safe errors.
 The import does not contact providers. Private settings are never served.
 

package/docs/JOB_CONTRACT.md

@@ -8,7 +8,8 @@ this contract. Chat interruption never cancels an engine job.
 Mutations use `{schema_version: 1, operation, input, idempotency_key}`.
 Supported operations are `wallet.add` (address, exact tag), `wallet.refresh`
 (wallet address or exact tag), `prices.refresh` (same), `wallet.setTags`
-(wallet, exact tags), `job.resume` and `job.cancel` (job_id).
+(wallet, exact tags), `settings.rpc`, `settings.discovery`, `settings.provider`,
+`job.resume` and `job.cancel` (job_id).
 Read operations are `job.read`, `job.list`, `snapshot.read`, and
 `snapshots.compare`. The portfolio projection retains its existing schema.
 
@@ -21,6 +22,17 @@ the same job without rerunning providers. Resume requeues the same job ID and
 increments its attempt on execution. Retain the key until the job is removed
 by a future explicit retention policy. Version mismatches fail closed.
 
+`settings.provider` accepts exactly `{provider: "public" | "alchemy", key_env}`.
+The key reference is a bounded environment variable name, never a credential.
+One writer-locked atomic replacement changes RPC mode and discovery together.
+Alchemy updates generated network references while preserving explicit custom
+chain overrides, unrelated chains, explorer choice and public fallback policy.
+A missing local key fails before replacement. Public mode keeps inactive custom
+references for later use. A detected key is not a validated provider or complete
+holdings result. Existing settings.rpc and settings.discovery requests remain
+compatible. The browser waits for terminal settings results; retrying a lost
+result checks the same accepted job instead of submitting another change.
+
 ## Envelope
 
 Each private `jobs/<uuid>.json` records schema_version, job_id, operation,

package/docs/KIRA_DISCOVERY_ACCEPTANCE.md

@@ -0,0 +1,95 @@
+# Token discovery patch acceptance
+
+Version: 0.1.4 candidate. Published npm 0.1.3 remains immutable.
+
+## Problem and correction
+
+A new personal data directory defaults to public RPC and no general ERC20
+indexer. The installed app does not inherit discovery settings from a separate
+research workspace. Public RPC reads native balances and enumerates Mint Club
+assets, but cannot identify arbitrary ERC20 contracts for a wallet. Previously,
+a finished analysis could show only native holdings without explaining this
+configuration at the point of use.
+
+The wallet registration dialog now explains limited discovery and offers a
+connection action before research. The wallet overview explains disabled
+discovery, missing credentials, stale analysis or incomplete provider checks.
+It labels incomplete portfolio estimates as partial. Network details retain
+separate discovery, RPC and registry coverage. Read-only and sample views do
+not acquire research permissions.
+
+RPC and candidate-balance failures now receive an explicit warning with
+expanded affected-network details. Retry holdings starts the existing gated
+research action; Review RPC settings opens the existing connection dialog.
+The warning says to wait briefly before retrying and review the connection
+or choose another provider if failures persist. Missing balances remain
+unknown. Successful discovery alone cannot mark failed balance reads complete,
+and old snapshots can project their fixed balance-failure note safely.
+
+Connecting an indexer does not change an immutable saved analysis. Refresh
+holdings runs discovery again. Refresh prices only updates existing holdings.
+Discovery settings preserve existing explorer preferences, and the UI rereads
+readiness after the settings job succeeds.
+
+Registry diagnostics now retain up to five redacted error examples and numeric
+HTTP or RPC codes in local evidence. The public model exposes only status and
+counts. Oversized multicalls split at the same observed block, including errors
+that viem converts into failed result rows. Transport outages and throttling
+remain bounded instead of retrying every contract separately.
+
+## Verification
+
+- Required `npm test` suite passed: 152 Python tests, required Node behavior
+  checks and browser script syntax checks.
+- `scripts/check-install.py` passed with a fresh 73-member package installation
+  and startup/shutdown lifecycle in a temporary synthetic workspace.
+- The tracked-source privacy scan passed with the active private data directory
+  included. The full-history scan retains the previously recorded non-noreply
+  merge identity at `2ed52a2`; no new finding was introduced. That historical
+  identity is not reproduced here and public history was not rewritten.
+- Actual viem with an in-memory aggregate3 transport: eight calls rejected
+  above two calls per batch succeed in seven requests, all at block 103.
+  Independent review also checked that HTTP 429 and 503 stay at one request
+  and isolated contract failures remain isolated. No live RPC is used by this
+  regression.
+- Missing, unreadable and disabled discovery credentials produce explicit
+  coverage status without exposing credentials or attempting discovery.
+- Viewer projection keeps raw provider diagnostics private and preserves
+  unknown prices. UI behavior checks cover disabled discovery, missing
+  credentials, stale analysis after connection, read-only actions and
+  partially successful explorer coverage.
+- RPC recovery regressions cover unavailable chains, registry failures,
+  non-Mint candidate-balance failures, mixed missing connections, unknown
+  valuations, read-only controls and removal after a successful analysis.
+- Chrome fixture checks at 1440 x 900 and 390 x 844: partial estimate and
+  discovery notice render without horizontal overflow. Both connection actions
+  open Research connections. The add-wallet dialog says Add with limited
+  discovery when the provider is absent. Fixture actions submitted no research,
+  account authorization or provider requests.
+- RPC-failure fixtures at the same desktop/mobile sizes show expanded Base
+  and BNB Chain details, both recovery actions and a partial estimate without
+  horizontal overflow. Review RPC settings opens the connection dialog.
+
+The design references were Mixpanel's dashboard connection guidance and
+Databricks' inline data-check failure state, retrieved
+with [Lazyweb](https://www.lazyweb.com/agentic-search/51280761-491a-4a3f-a78e-ed2dcd427ee8).
+No operator wallet information or screenshots were submitted to that service.
+
+Independent review found a viem failed-result handling defect during
+implementation. The correction and actual-client regression were reviewed
+again and the finding was closed. Screenshots and operator test evidence
+remain in the ignored local ticket ledger.
+
+## Acceptance limits and release boundary
+
+Operator-approved reuse of an existing discovery connection recovered
+non-native holdings in a new saved analysis. Some provider and network gaps
+remain; this does not establish complete holdings or verify every expected
+token. Those limits remain visible in coverage. The existing operator server
+was not restarted or globally upgraded during patch verification.
+
+The source/package privacy scan is required before preparation.
+`scripts/prepare-release.py`
+pins the clean source commit and archive checksum. Registry publication
+remains operator-only. No npm publication, GitHub release publication or PR
+merge is part of preparing this candidate.

package/docs/ONBOARDING_CHAT_CONTRACT.md

@@ -4,6 +4,27 @@ Kira connects the user's installed, unmodified Codex or Claude Code CLI. It does
 
 The setup flow separates account readiness, model choice, context permission, and confirmation. The conversation composer remains visible. It shows the connected CLI, automatic context scope, response state, cancellation, and a new conversation action. Enter sends; Shift+Enter adds a line; composition events never send.
 
+`kira setup` opens the existing Account, Permissions and Ready modal directly
+after the local session and workspace are available. Opening setup does not run
+a model response check, save permissions or start wallet research. Existing
+settings are loaded when setup is reopened. Closing the modal consumes that
+page's setup request, so background polling does not reopen it. Ordinary
+`kira start` keeps the normal workspace entry behavior.
+
+The 0.1.5 selector defaults to Use default model. Codex uses a bounded stdio
+app-server handshake and model/list request; it never starts a thread or turn.
+The subprocess has an eight-second metadata deadline and 256 KB output bound.
+Metadata failures leave the default and Advanced identifier entry available.
+Only installed supported CLI versions are queried. Claude uses its documented
+Sonnet, Opus and Haiku aliases. Every chosen model still requires a deliberate
+generic response test. Vendor account and managed policies may restrict access.
+Workspace settings reuses this modal for both providers and all permissions.
+Fresh setup preselects local history; existing false values remain false.
+History permits reopening chats, without extending model memory or scope.
+No wallet context permits general chat and manual wallet management while
+wallet context and research tools remain unavailable. Any effective model or
+permission change starts a fresh conversation.
+
 Automatic context is none, one explicitly selected registered wallet, or the whole recorded portfolio. An allowlisted projection preserves exact balances, contract and chain identities, timestamps, unknown values, and coverage gaps. It excludes credentials, RPC endpoints, paths, raw errors, jobs, and provider payloads. User-entered text is also sent to the selected provider. Scope, wallet, provider, or model changes start a new conversation and never replay old messages. Only a bounded current conversation is replayed.
 
 Approved wallet context can include validated historical full-balance Mint Club
@@ -53,7 +74,7 @@ in Activity and also appear in the chat tray. Unanalysed wallets show a sidebar
 spinner and open Activity while their first holdings job is active.
 
 History is capped at 100 memory sessions and reads up to 200 validated local
-files. Saving remains opt-in. Memory sessions disappear when the process stops.
+files. Saving is recommended for fresh setup and remains an editable choice. Memory sessions disappear when the process stops.
 A previous session can continue only with exactly the same model and context
 configuration. Reading history does not expand model access. Old saved files
 remain readable. No missing memory-only conversations are reconstructed.
@@ -65,3 +86,15 @@ The receipt is consumed only on success. This does not enable history retention.
 The Kira system voice is concise, composed and practical. It leads with findings
 and preserves evidence, unknown values and signing boundaries. Personality is
 prompt guidance; response quality still depends on the selected model.
+
+## 0.1.5 preparation evidence
+
+The combined settings and model-selection tests cover catalog failures, stale
+responses, custom identifiers, fresh retention defaults, saved opt-outs,
+atomic provider changes, preference preservation, missing keys, cancellation
+and ambiguous receipts. Desktop 1440 × 900 and mobile 390 × 844 checks used an
+empty disposable workspace. Codex 0.158.0 and Claude Code 2.1.293 completed
+native default-model response checks with no wallet data. The provider save
+used a synthetic local key reference and made no provider research request.
+Real extension approval, personal OWS passphrases and live holdings coverage
+are separate operator acceptance. Published 0.1.4 snapshots are not rewritten.

package/docs/RELEASE.md

@@ -5,7 +5,9 @@
 GitHub version releases and npm registry publication are separate. The GitHub
 0.1.2 release provides the reviewed `kira-wallet-0.1.2.tgz`, its SHA-256 file and
 release manifest. Its tag pins the source used to create those assets. Install
-that archive from GitHub or use `npm install -g kira-wallet`; npm also serves 0.1.2.
+that archive from GitHub. The operator published npm 0.1.3 on 2026-10-06;
+its archive and installed bytes were verified separately. GitHub v0.1.3
+remains a draft. GitHub and registry status must not be inferred from each other.
 Version 0.1.2 was published to GitHub on 2026-10-05 from
 `f994e99acb4e2d778fb4c95479f04355c88c00b3`. Its archive SHA-256 is
 `866b7f1ad543bff1ff59d3bf840eca6313eb6e206e78b8611186e5a971153f28`.
@@ -21,7 +23,7 @@ their invented wallet addresses, balances and seeded chat are documented in
 
 ## npm publication preparation
 
-The next candidate is **0.1.3**, which makes `kira start` open the full local
+Published **0.1.3** makes `kira start` open the full local
 app by default. `--read-only` preserves the viewer-only mode, `--no-open`
 supports terminal-only use, and `--controls` remains compatible with existing
 scripts. A running instance never changes modes silently. Local session,
@@ -30,9 +32,31 @@ creation now identifies Open Wallet Standard with its official locally served
 logo and explains encrypted local storage and public-account research. The
 OWS integration and wallet-operation permissions are unchanged.
 
-This candidate requires PR review and operator publication. It is not yet
-available from the registry. The showcase HTML animation is deployed separately
-and requires no npm release. Keep the published 0.1.2 archive and tag immutable.
+Published **0.1.4** makes incomplete token discovery visible
+before registration and beside wallet holdings, separates disabled discovery
+from missing credentials and provider failures, and offers a connection or
+holdings-refresh action. Registry failures retain bounded redacted examples
+and RPC error codes. Oversized multicalls split into smaller batches while
+transport outages remain bounded. Existing explorer preferences are preserved
+when discovery settings are saved. Connecting an indexer and refreshing
+holdings are still required to recover tokens absent from an older snapshot.
+RPC failures show affected networks, retry guidance and a settings action.
+Failed candidate balance reads keep the saved result and valuation partial
+even when general token discovery succeeded.
+
+The next candidate is **0.1.5**. It opens the existing setup modal directly,
+adds readable Codex and Claude model choices, and exposes model and permission
+changes in Workspace settings. New setup recommends local history; upgrades
+preserve explicit opt-outs. Watching wallet methods use individual buttons.
+Data provider connection offers one atomic Alchemy RPC and discovery save,
+with custom overrides under Advanced. A missing key keeps prior settings.
+The wallet draft survives a connection detour. Connecting still requires an
+explicit holdings refresh before missing assets can appear in saved evidence.
+
+Version 0.1.5 requires independent review and operator registry publication.
+It is not yet available from the registry. Keep published 0.1.4 and earlier
+package bytes immutable. The showcase remains a separate deployment.
+See [discovery acceptance](KIRA_DISCOVERY_ACCEPTANCE.md).
 
 The operator published npm **0.1.2** on 2026-10-05. Its registry archive was
 downloaded and matched the reviewed GitHub archive above, including SHA-256,
@@ -54,8 +78,7 @@ The earlier unpublished 0.1.2 candidate is preserved in the ignored
 `dist/preserved-0.1.2-bad8f02/` directory. Use the current `dist/release.json`
 and its matching archive for publication; do not mix manifests from candidates.
 
-Keep GitHub v0.1.1, its tag and its released archive immutable. Version 0.1.2
-is also released and immutable. Do not rebuild it from later documentation
+Keep GitHub v0.1.1, its tag and its released archive immutable. Versions 0.1.2, 0.1.3 and 0.1.4 are also published and immutable. Do not rebuild them from later documentation
 commits. Future package changes need a new version. Release preparation does not
 publish a GitHub release, merge PR 19, promote the website or publish to npm.
 Registry publication remains operator-only. The coding agent never publishes.
@@ -70,12 +93,12 @@ python3 scripts/prepare-release.py
 ```
 
 `prepare-release.py` scans the package boundary and creates
-`dist/kira-wallet-0.1.3.tgz`. The ignored `dist/release.json` records its source
+`dist/kira-wallet-0.1.5.tgz`. The ignored `dist/release.json` records its source
 commit, SHA-256 and member count. It never publishes. After reviewing that
 manifest, the operator's final command from the project root is:
 
 ```sh
-npm publish ./dist/kira-wallet-0.1.3.tgz --access public
+npm publish ./dist/kira-wallet-0.1.5.tgz --access public
 ```
 
 Use the operator's npm account and complete authentication or OTP personally.

package/kira_agent.py

@@ -251,6 +251,7 @@ class AgentStore:
         self.root = Path(root);self.path = self.root/'.kira-agent.json';self.runner=runner;self.detector=detector
         self.lock=threading.RLock();self.turns={};self.active=None;self.epoch=0;self.messages=[];self.conversation=str(uuid.uuid4());self.tested=set();self.config=None;self.workers=[];self.tool_status=None
         self._capabilities=None;self._checked=0
+        self._model_lock=threading.Lock();self._model_cache={}
         self.sessions={};self.started_at=datetime.now(timezone.utc).isoformat();self.updated_at=self.started_at
         if self.path.exists():
             try: self.config=config_input(json.loads(self.path.read_text()),self.root)
@@ -344,6 +345,19 @@ class AgentStore:
             self._capabilities=self.detector();self._checked=time.monotonic()
         with self.lock:return {'config':self.config,'providers':self._capabilities,'conversation_id':self.conversation,'messages':self.messages.copy(),'active_turn':self.active,'tool_status':self.tool_status}
 
+    def models(self, provider, recheck=False):
+        if provider not in PROVIDERS:raise JobError('invalid_provider','Choose Codex or Claude.')
+        with self._model_lock:
+            row=next((row for row in self.status(recheck)['providers'] if row['id']==provider),None)
+            if not row or not row['installed'] or not row['supported']:
+                return {'models':[], 'note':'Install a supported CLI to load model choices. The default model remains available.'}
+            cached=self._model_cache.get(provider)
+            if not recheck and cached and time.monotonic()-cached[0]<60:return cached[1]
+            from kira_models import catalog
+            result=catalog(provider)
+            self._model_cache[provider]=(time.monotonic(),result)
+            return result
+
     def fingerprint(self,config):return hashlib.sha256(json.dumps(config,sort_keys=True).encode()).hexdigest()
 
     def stop(self):

package/kira_cli.py

@@ -232,10 +232,9 @@ def main():
             if args.command=='config':
                 file=Path(args.file).expanduser().resolve()
                 if not file.is_file():raise ValueError('Secret environment file does not exist.')
-                from wallet import ALCHEMY
-                cfg['secret_env_file']=str(file);cfg['discovery']={'provider':'alchemy','key_env':args.key_env,'explorers':True}
-                cfg['rpc']={'mode':'custom','allow_public_fallback':True,
-                    'chains':{str(cid):{'url_env':args.key_env,'alchemy_network':name} for cid,name in ALCHEMY.items()}}
+                from kira_config import provider_config
+                cfg=provider_config(cfg,'alchemy',args.key_env)
+                cfg['secret_env_file']=str(file);cfg['discovery']['explorers']=True
             elif args.command=='discovery':cfg['discovery']={'provider':args.provider,'key_env':args.key_env,'explorers':args.explorers}
             elif args.setting=='public':cfg['rpc']['mode']='public'
             else:

package/kira_config.py

@@ -19,6 +19,19 @@ def default_config():
     return {'schema_version':1,'rpc':{'mode':'public','allow_public_fallback':True,'chains':{}},
             'discovery':{'provider':'none','key_env':'ALCHEMY_API_KEY','explorers':False}}
 
+def provider_config(config, provider, key_env):
+    """One settings transition. Preserve explicit fallback and custom overrides."""
+    result={**config,'rpc':{**config['rpc'],'chains':{cid:dict(row) for cid,row in config['rpc']['chains'].items()}},
+            'discovery':{**config['discovery'],'provider':'alchemy' if provider=='alchemy' else 'none','key_env':key_env}}
+    result['rpc']['mode']='custom' if provider=='alchemy' else 'public'
+    if provider=='alchemy':
+        from wallet import ALCHEMY
+        for cid,network in ALCHEMY.items():
+            previous=result['rpc']['chains'].get(str(cid))
+            if not previous or previous.get('alchemy_network'):
+                result['rpc']['chains'][str(cid)]={'url_env':key_env,'alchemy_network':network}
+    return result
+
 def load_config():
     path=config_path()
     if not path.exists():return default_config()

package/kira_jobs.py

@@ -19,7 +19,7 @@ import uuid
 
 ASSETS = Path(__file__).resolve().parent
 State = Literal['queued', 'running', 'interrupted', 'succeeded', 'partial', 'failed', 'cancelled']
-Operation = Literal['wallet.add','wallet.refresh','prices.refresh','wallet.setTags','settings.rpc','settings.discovery']
+Operation = Literal['wallet.add','wallet.refresh','prices.refresh','wallet.setTags','settings.rpc','settings.discovery','settings.provider']
 TERMINAL = {'succeeded', 'partial', 'failed', 'cancelled', 'interrupted'}
 ADDRESS = re.compile(r'0x[0-9a-fA-F]{40}')
 
@@ -124,10 +124,10 @@ class JobStore:
         if not isinstance(job,dict) or type(job.get('schema_version')) is not int or job.get('schema_version') != 1: raise JobError('unsupported_version', 'Unsupported persisted job version.')
         required={'schema_version','job_id','operation','input','state','attempt','sequence','result','previous_result','key_hash','request_hash','created_at','updated_at','cancel_requested','checkpoint','stage','events','errors','chains'}
         optional={'raw_hash','control_receipts','control_raw','provider_configuration','started_at'}
-        if required-set(job) or set(job)-required-optional or job['job_id']!=job_id or job['checkpoint']!='snapshots/jobs/'+job_id or not isinstance(job['operation'],str) or job['operation'] not in {'wallet.add','wallet.refresh','prices.refresh','wallet.setTags','settings.rpc','settings.discovery'} or not isinstance(job['state'],str) or job['state'] not in TERMINAL|{'queued','running'} or any(type(job[k]) is not int or job[k]<0 for k in ('attempt','sequence')) or type(job['cancel_requested']) is not bool or not isinstance(job['input'],dict) or any(not isinstance(job[k],list) for k in ('events','errors')) or not isinstance(job['chains'],dict):
+        if required-set(job) or set(job)-required-optional or job['job_id']!=job_id or job['checkpoint']!='snapshots/jobs/'+job_id or not isinstance(job['operation'],str) or job['operation'] not in {'wallet.add','wallet.refresh','prices.refresh','wallet.setTags','settings.rpc','settings.discovery','settings.provider'} or not isinstance(job['state'],str) or job['state'] not in TERMINAL|{'queued','running'} or any(type(job[k]) is not int or job[k]<0 for k in ('attempt','sequence')) or type(job['cancel_requested']) is not bool or not isinstance(job['input'],dict) or any(not isinstance(job[k],list) for k in ('events','errors')) or not isinstance(job['chains'],dict):
             raise JobError('invalid_envelope','Persisted job validation failed. Preserve the file for recovery.')
         names={'wallet.add':['address','tag'],'wallet.refresh':['wallet'],'prices.refresh':['wallet'],'wallet.setTags':['wallet','tags'],
-            'settings.rpc':['mode','chains','allow_public_fallback'],'settings.discovery':['provider','key_env']}[job['operation']]
+            'settings.rpc':['mode','chains','allow_public_fallback'],'settings.discovery':['provider','key_env'],'settings.provider':['provider','key_env']}[job['operation']]
         fields(job['input'],names)
         wallet=job['input'].get('wallet') or job['input'].get('address')
         if wallet is not None and (not isinstance(wallet,str) or not ADDRESS.fullmatch(wallet)):raise JobError('invalid_envelope','Persisted wallet identity is invalid.')
@@ -154,6 +154,11 @@ class JobStore:
         return matches[0]
 
     def normalize(self, operation, value):
+        if operation == 'settings.provider':
+            fields(value,['provider','key_env'])
+            if value['provider'] not in ('public','alchemy') or not isinstance(value['key_env'],str) or not re.fullmatch(r'[A-Z_][A-Z0-9_]{0,99}',value['key_env']):
+                raise JobError('invalid_settings','Choose a data provider and a local credential reference.')
+            return value.copy()
         if operation == 'settings.rpc':
             fields(value,['mode','chains','allow_public_fallback'])
             if value['mode'] not in ('public','custom') or type(value['allow_public_fallback']) is not bool or not isinstance(value['chains'],list) or len(value['chains'])>30:
@@ -403,7 +408,12 @@ class JobStore:
                     previous=config['rpc']['chains'].get(key,{})
                     if row['url_env']==previous.get('url_env') and previous.get('alchemy_network'):row['alchemy_network']=previous['alchemy_network']
                 config['rpc']=updated
-            else:config['discovery']={**job['input'],'explorers':False}
+            elif job['operation']=='settings.discovery':config['discovery']={**job['input'],'explorers':config['discovery'].get('explorers',False)}
+            else:
+                from kira_config import provider_config,secret_values
+                config=provider_config(config,**job['input'])
+                if job['input']['provider']=='alchemy' and not secret_values(config).get(job['input']['key_env']):
+                    raise JobError('connection_key_missing','Kira cannot find the local Alchemy key. Follow the connection guide, then retry. Existing settings are unchanged.')
             atomic(config_path(),config)
             result={'status':'completed','setting':job['operation']};atomic(self.jobs/'results'/(job['job_id']+'.json'),result);return result
         env = {**os.environ, 'KIRA_DATA_DIR': str(self.root), 'KIRA_JOB_ID': job['job_id'], 'KIRA_JOB_SNAPSHOT': job['checkpoint'], 'KIRA_ANALYSIS_FD': str(writer.fileno()), 'PYTHONUNBUFFERED': '1'}

package/kira_models.py

@@ -0,0 +1,86 @@
+"""Bounded native model metadata. No inference, threads or credential copying."""
+import json
+import os
+import re
+import selectors
+import shutil
+import signal
+import subprocess
+import tempfile
+import time
+
+MODEL = re.compile(r'[a-zA-Z0-9._:/-]{1,100}')
+
+def clean_catalog(rows):
+    result=[]; seen=set()
+    if not isinstance(rows,list):return result
+    for row in rows[:100]:
+        if not isinstance(row,dict) or row.get('hidden'):continue
+        model=row.get('model') or row.get('id')
+        if not isinstance(model,str) or not MODEL.fullmatch(model) or model in seen:continue
+        name=row.get('displayName') or model
+        if not isinstance(name,str):name=model
+        name=' '.join(name.split())[:100]
+        result.append({'id':model,'name':name or model});seen.add(model)
+        if len(result)==40:break
+    return result
+
+def codex_catalog(path, env, *, timeout=8):
+    from kira_agent import CODEX_DISABLED
+    argv=[path,'app-server','--listen','stdio://','-c','analytics.enabled=false',
+          '-c','history.persistence="none"','-c','mcp_servers={}', '-c','model_provider="openai"']
+    for feature in CODEX_DISABLED:argv+=['-c',f'features.{feature}=false']
+    with tempfile.TemporaryDirectory(prefix='kira-models-') as cwd:
+        child=subprocess.Popen(argv,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,
+                               cwd=cwd,env=env,start_new_session=True)
+        selector=selectors.DefaultSelector();selector.register(child.stdout,selectors.EVENT_READ)
+        def send(value):
+            child.stdin.write((json.dumps(value)+'\n').encode());child.stdin.flush()
+        try:
+            send({'id':1,'method':'initialize','params':{'clientInfo':{'name':'kira_model_picker','version':'0.1.5'}}})
+            deadline=time.monotonic()+timeout;buffer=b'';received=0;requested=False
+            while time.monotonic()<deadline:
+                for key,_ in selector.select(min(.2,max(0,deadline-time.monotonic()))):
+                    chunk=os.read(key.fileobj.fileno(),65536)
+                    if not chunk:raise ValueError('Catalog ended.')
+                    received+=len(chunk)
+                    if received>262144:raise ValueError('Catalog too large.')
+                    buffer+=chunk
+                    while b'\n' in buffer:
+                        line,buffer=buffer.split(b'\n',1)
+                        try:message=json.loads(line)
+                        except ValueError:continue
+                        if not isinstance(message,dict):continue
+                        if message.get('id')==1 and not requested:
+                            if 'error' in message:raise ValueError('Initialization failed.')
+                            requested=True
+                            send({'method':'initialized'})
+                            send({'id':2,'method':'model/list','params':{'limit':100,'includeHidden':False}})
+                        elif message.get('id')==2 and requested:
+                            if 'error' in message:raise ValueError('Catalog unavailable.')
+                            result=message.get('result')
+                            return clean_catalog(result.get('data')) if isinstance(result,dict) else []
+            raise TimeoutError('Catalog timed out.')
+        finally:
+            selector.close()
+            try:os.killpg(child.pid,signal.SIGTERM)
+            except ProcessLookupError:pass
+            try:child.wait(timeout=2)
+            except subprocess.TimeoutExpired:
+                try:os.killpg(child.pid,signal.SIGKILL)
+                except ProcessLookupError:pass
+                child.wait()
+            child.stdin.close();child.stdout.close()
+
+def catalog(provider):
+    from kira_agent import native_env
+    if provider=='claude':
+        return {'models':[{'id':'sonnet','name':'Sonnet'}, {'id':'opus','name':'Opus'}, {'id':'haiku','name':'Haiku'}],
+                'note':'Claude CLI model choices. Check a response to verify access for your account.'}
+    if provider!='codex':raise ValueError('Unsupported provider.')
+    try:
+        path=shutil.which('codex')
+        models=codex_catalog(path,native_env()) if path else []
+    except (OSError,ValueError,TypeError,TimeoutError):models=[]
+    return {'models':models,'note':'CLI catalog choices. Check a response to verify account access.' if models else
+            'Model choices are unavailable. Use the default model, recheck, or enter an ID under Advanced.'}

package/onchain.cjs

@@ -52,7 +52,12 @@ function safeError(error){
   message=message.replace(/https?:\/\/[^\s"<>]+/g,'[RPC URL]');
   message=message.replace(/(bearer\s+)[^\s,;"<>]+/gi,'$1[redacted]');
   message=message.replace(/(authorization|api[-_]?key|bearer)([\s:=]+)[^\s,;"<>]+/gi,'$1$2[redacted]');
-  return {error_type:error.name,message:message.slice(0,500)};
+  const diagnostic={error_type:error.name,message:message.slice(0,500)};
+  for(let cause=error,depth=0;cause&&depth<6;cause=cause.cause,depth++){
+    if(Number.isInteger(cause.status))diagnostic.http_status=cause.status;
+    if(Number.isInteger(cause.code))diagnostic.rpc_code=cause.code;
+  }
+  return diagnostic;
 }
 function rpcEndpointsUsed(c){return [...(endpointReads.get(c)||[])].filter(i=>i>=0).sort((a,b)=>a-b);}
 module.exports={viem,root,assets,networks,bondAbi,endpoints,client,connect,resilientTransport,rpcEndpointsUsed,serialize,safeError};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kira-wallet",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Manage your wallets with your own AI. Track tokens, research markets and refresh holdings in a local workspace.",
   "license": "MIT",
   "private": false,
@@ -55,7 +55,9 @@
     "kira_research_tools.py",
     "kira_ows.py",
     "ows_bridge.cjs",
-    "docs/KIRA_LIVE_QA.md"
+    "docs/KIRA_LIVE_QA.md",
+    "docs/KIRA_DISCOVERY_ACCEPTANCE.md",
+    "kira_models.py"
   ],
   "scripts": {
     "test": "python3 -m unittest discover -s . -p 'test_*.py' && python3 -m unittest discover -s viewer -p 'test_*.py' && node test-onchain.cjs && node --check viewer/static/app.js && node --check viewer/static/jobs.js && node test-workspace.cjs && node --check viewer/static/workspace.js && node --check viewer/static/workspace-model.js && node test-watching.cjs && node test-watching-ui.cjs && node --check viewer/static/watching.js && node --check viewer/static/watching-model.js && node --check viewer/static/agent.js && node test-agent-ui.cjs && node test-markdown.cjs && node --check viewer/static/report.js && node test-report-ui.cjs && node test-holdings-ui.cjs && node test-rpc-fallback.cjs && node test-ows.cjs && node test-ows-ui.cjs && node --check viewer/static/ows.js && node --check viewer/static/chat-workspace.js && node --check viewer/static/selects.js && node --check site/demo.js"