The claude-code target listed a hardcoded HANZO_MODELS set (glm-5.2,
deepseek-v4-flash, deepseek-v4-pro, zen5-max — all verified routable) but
dropped the user's actual selection if it wasn't among them. Merge creds.model
in and dedupe so the picker never omits the chosen default, while keeping the
short curated list (the live catalog carries 60+ ids). Also add the missing
ClaudeSettings.model type and drop the redundant 'ultra' effort alias (== max).
v1.0.7
Live infra drift (gateway redeploy): api.hanzo.ai/v1/kms is NOT proxied (404),
and the bare /health path moved (/health 404, /v1/health 200). Two fixes:
- KMS runs on its dedicated host kms.<brand> (kms.hanzo.ai, per IAM's per-brand
KMSHost). Added brand.kms + endpoints.kms (HANZO_KMS_URL override); KMS client
targets it instead of api.hanzo.ai/v1/kms. Verified live: kms.hanzo.ai/v1/kms/
orgs/hanzo/secrets → 401 (gated, live).
- doctor now probes the STABLE endpoints the tool actually depends on — IAM
/.well-known/openid-configuration + api /v1/models — not a bare /health that
varies by gateway config. Both 200.
- kms-secrets action base-url default → kms.hanzo.ai.
Release 1.0.6 (helper + @hanzo/kms + lux/zoo/zen forks).
Two real bugs:
- npx @hanzo/helper broke when the kms bin was added — a package with TWO bins
can't be run by 'npx <pkg>' (could not determine executable). Reverted helper
to its single 'hanzo' bin; kms stays as 'hanzo kms' AND as its own package.
- version.ts was hardcoded '1.0.0' — 'hanzo --version' always lied. Now injected
from package.json at build (tsup define __HANZO_VERSION__), one source of truth.
- packages/kms: new standalone @hanzo/kms (single 'kms' bin) that re-runs the
helper's kms CLI via the new ./kms-cli export. npm i -g @hanzo/kms → 'kms'.
- exports: add ./kms-cli so the standalone package imports it cleanly.
Published: @hanzo/helper@1.0.5, @hanzo/kms@1.0.5, @luxfi/@zenlm/@zooai/helper@1.0.5.
Three live-verified endpoint bugs, all where a call hit the wrong host/path:
- readApiKey + fetchUser hit api.hanzo.ai/v1/get-account (404). The account read
lives on the IAM issuer: {iam}/get-account (…/v1/iam/get-account, 200). Same
base as mint/revoke. Added IAM_PATHS.account.
- fetchUser also parsed the account at the top level, but GetAccount wraps it in
a { status, sub, name, data, data2 } envelope — email/owner are under data, so
org came back EMPTY (which kms pull needs). Now reads data.{email,owner,...}.
- doctor: api /v1/health (404) -> /health (200); iam /api/health -> /health
(drop the /api/ prefix per house style).
Verified live: hanzo doctor now green (IAM 200, Cloud API 200); models table,
--tiers, and detail all work. Release 1.0.3.
A developer's `hanzo login` already mints an IAM OIDC token; `kms pull --env
devnet` exchanges it for a short-lived KMS token and writes a local .env. Clean
orthogonal separation — IAM is a pure issuer (/v1/iam), KMS owns secrets/envs/
authz (/v1/kms); they compose through the token, neither imports the other. No
broker, no /api/, no compound words (oidc, not oidc-auth).
- src/lib/kms.ts: kmsLogin + kmsSecrets + pullSecrets over /v1/kms/oidc/login
and /v1/kms/secrets; tolerant of {K:V} or [{secretKey,secretValue}] shapes.
- src/commands/kms.ts + src/kms-cli.ts: `hanzo kms` and standalone `kms` bin —
one implementation, two entry points. pull/list, env devnet|testnet|mainnet|
production (default devnet), dotenv out.
- CI shares the SAME mechanism: .github/actions/kms-secrets loads secrets via a
GitHub OIDC token through /v1/kms/*; reusable .github/workflows/npm-release.yml
publishes any package with NPM_TOKEN from KMS (self-hosted runners, no
long-lived token in GitHub); release.yml ships helper + forks on tag.
- DRY: dev and CI use one /v1/kms exchange; one login, one token store.
The forks (@luxfi/@zenlm/@zooai/helper) re-run our CLI with HANZO_BRAND set,
but exports only published '.', so import('@hanzo/helper/dist/cli.js') failed
with ERR_PACKAGE_PATH_NOT_EXPORTED. Add a stable './cli' export and point the
forks at @hanzo/helper/cli (not a deep dist path). Bump fork deps to ^1.0.1.
Fix stale zoo.id → zoolabs.id comment.
Published: @hanzo/helper@1.0.1, @luxfi/helper@1.0.0, @zenlm/helper@1.0.0,
@zooai/helper@1.0.0.
Verified against the actual Hanzo sources (iam, ai, console2, login):
- Device login (RFC 8628) against hanzo.id /oauth/device + /oauth/token,
form-encoded, client_id hanzo-app, body-keyed pending/slow_down handling.
- API key = the per-user IAM accessKey (hk-): read via /v1/get-account,
self-minted via /v1/iam/mint-user-keys (authorized as self by the login JWT).
- CodingTarget abstraction: one interface, Claude Code (settings.json env) and
Codex (config.toml provider) implementations. Verified round-trip preserves
all unrelated user config.
- Commands: login, use/unuse, auth (status/key/rotate/revoke/logout),
status, models, install (dev/mcp/extension), doctor.
- Endpoints overridable for white-label (HANZO_IAM_URL/API_URL/CLIENT_ID).
- TypeScript 6, tsup bundle, clean typecheck.
Hanzo Dev