fix: npx regression + version drift; add standalone @hanzo/kms package

Two real bugs:
- npx @hanzo/helper broke when the kms bin was added — a package with TWO bins
  can't be run by 'npx <pkg>' (could not determine executable). Reverted helper
  to its single 'hanzo' bin; kms stays as 'hanzo kms' AND as its own package.
- version.ts was hardcoded '1.0.0' — 'hanzo --version' always lied. Now injected
  from package.json at build (tsup define __HANZO_VERSION__), one source of truth.

- packages/kms: new standalone @hanzo/kms (single 'kms' bin) that re-runs the
  helper's kms CLI via the new ./kms-cli export. npm i -g @hanzo/kms → 'kms'.
- exports: add ./kms-cli so the standalone package imports it cleanly.

Published: @hanzo/helper@1.0.5, @hanzo/kms@1.0.5, @luxfi/@zenlm/@zooai/helper@1.0.5.

forks/lux/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luxfi/helper",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Lux CLI helper — sign in to Lux and use its AI models in Claude Code, Codex, and more",
   "type": "module",
   "bin": {
@@ -28,6 +28,6 @@
   },
   "homepage": "https://lux.network",
   "dependencies": {
-    "@hanzo/helper": "^1.0.3"
+    "@hanzo/helper": "^1.0.5"
   }
 }

forks/zen/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zenlm/helper",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Zen CLI helper — sign in to Zen and use its AI models in Claude Code, Codex, and more",
   "type": "module",
   "bin": {
@@ -29,6 +29,6 @@
   },
   "homepage": "https://zenlm.org",
   "dependencies": {
-    "@hanzo/helper": "^1.0.3"
+    "@hanzo/helper": "^1.0.5"
   }
 }

forks/zoo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zooai/helper",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Zoo CLI helper — sign in to Zoo and use its AI models in Claude Code, Codex, and more",
   "type": "module",
   "bin": {
@@ -28,6 +28,6 @@
   },
   "homepage": "https://zoo.ngo",
   "dependencies": {
-    "@hanzo/helper": "^1.0.3"
+    "@hanzo/helper": "^1.0.5"
   }
 }

package.json

@@ -1,19 +1,19 @@
 {
   "name": "@hanzo/helper",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Hanzo CLI helper for API access, cloud services, MCP, and plugins",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
-    "hanzo": "./dist/cli.js",
-    "kms": "./dist/kms-cli.js"
+    "hanzo": "dist/cli.js"
   },
   "exports": {
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
-    "./cli": "./dist/cli.js"
+    "./cli": "./dist/cli.js",
+    "./kms-cli": "./dist/kms-cli.js"
   },
   "files": [
     "dist",
@@ -48,7 +48,7 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/hanzoai/helper"
+    "url": "git+https://github.com/hanzoai/helper.git"
   },
   "bugs": {
     "url": "https://github.com/hanzoai/helper/issues"

packages/kms/README.md

@@ -0,0 +1,22 @@
+# @hanzo/kms
+
+> Standalone `kms` CLI — sign in with IAM and pull environment secrets for local dev.
+
+Same engine and token store as [`@hanzo/helper`](https://www.npmjs.com/package/@hanzo/helper)
+(so `kms` and `hanzo kms` are interchangeable), packaged as its own `kms` command.
+
+```bash
+npm i -g @hanzo/kms        # or: npx @hanzo/kms login
+
+kms login                  # IAM device login (shared with `hanzo login`)
+kms pull --env devnet      # write .env for local dev
+kms list --env devnet      # secret names only
+```
+
+Environments: `devnet` (default), `testnet`, `mainnet`, `production`. Your org
+comes from your login (`--org` to override). Secrets are read from KMS over the
+canonical `/v1/kms/orgs/{org}/secrets` API; KMS gates access per env.
+
+## License
+
+Apache-2.0

packages/kms/bin/kms.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+/**
+ * @hanzo/kms — the standalone `kms` command.
+ *
+ * One implementation: it runs @hanzo/helper's kms CLI (which is also reachable
+ * as `hanzo kms`). Installing this package gives you `kms` on its own; the
+ * engine, auth, and token store are shared with `hanzo`.
+ */
+await import('@hanzo/helper/kms-cli');

packages/kms/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@hanzo/kms",
+  "version": "1.0.5",
+  "description": "Standalone `kms` CLI — sign in with IAM and pull environment secrets for local dev",
+  "type": "module",
+  "bin": {
+    "kms": "bin/kms.js"
+  },
+  "files": [
+    "bin",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "hanzo",
+    "kms",
+    "secrets",
+    "cli",
+    "iam"
+  ],
+  "author": "Hanzo AI",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hanzoai/helper.git"
+  },
+  "homepage": "https://hanzo.ai",
+  "dependencies": {
+    "@hanzo/helper": "^1.0.5"
+  }
+}

src/lib/version.ts

@@ -1 +1,9 @@
-export const version = '1.0.0';
+/**
+ * The CLI's version. Injected at build time from package.json (tsup `define`
+ * replaces __HANZO_VERSION__), so it can never drift from the published version.
+ * The fallback keeps `tsx`/dev runs working when the define isn't set.
+ */
+declare const __HANZO_VERSION__: string | undefined;
+
+export const version =
+  typeof __HANZO_VERSION__ === 'string' ? __HANZO_VERSION__ : '0.0.0-dev';

tsup.config.ts

@@ -1,4 +1,7 @@
 import { defineConfig } from 'tsup';
+import { readFileSync } from 'node:fs';
+
+const { version } = JSON.parse(readFileSync('./package.json', 'utf-8')) as { version: string };
 
 export default defineConfig({
   entry: ['src/index.ts', 'src/cli.ts', 'src/kms-cli.ts'],
@@ -10,6 +13,8 @@ export default defineConfig({
   splitting: false,
   bundle: true,
   noExternal: [],
+  // Single source of truth for the CLI version: package.json, inlined at build.
+  define: { __HANZO_VERSION__: JSON.stringify(version) },
   esbuildOptions(options) {
     options.banner = {
       js: '// @hanzo/helper - Hanzo CLI for API access, cloud services, MCP, and plugins',