Agent-driven setup

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

Set up access to Keiro's eb1 models on this machine, on my behalf. Work
through the numbered steps in order. You never see or type the API key
itself: it enters each surface through that surface's hidden interactive
prompt, and verification reads it back only through the exact command
shapes in step 5.

Ground rules
- My API key must never appear in this conversation, in your output, in a
  command argument, in shell history, in an environment variable you
  export, or in any file other than the owner-only credential store each
  setup script writes. Never echo it, log it, or read it back to me. When
  a step needs an authenticated request, compose the command exactly as
  step 5 shows, so the stored credential streams between processes without
  entering an argument list or your transcript.
- Make no changes beyond what the referenced setup pages document. If an
  installer stops or refuses, a step is ambiguous, or existing
  configuration is in the way, stop and ask me instead of working around
  it.
- The setup pages are the source of truth for every mechanical step. Read
  the pages for the selected surfaces before changing anything, and follow
  them instead of improvising. Index of pages for agents:
  https://docs.keirolabs.ai/llms.txt

Step 1 - detect the environment
Identify the operating system and shell, then detect which supported
surfaces are already installed:
- Codex: a `codex` binary on PATH, or a ~/.codex directory.
- Claude Code: a `claude` binary on PATH, or a ~/.claude directory.
- Keiro Python client library: `python3 -m pip show keiro` succeeds, or
  the probe below identifies the library's command (pipx and uv installs
  do not appear in pip).
Two different tools install a command named keiro: the launcher from the
Codex setup page and the Keiro library's own command. Tell them apart with
`keiro --version`, which sends no request: the library's command prints a
line that starts with "keiro", while the Codex launcher hands the flag to
Codex, which reports Codex's own version. Never run any other `keiro`
command before this probe has told you which tool answers, and repeat the
probe after any install that could change which tool owns the name.

Step 2 - confirm surfaces with me
Ask me which surfaces to configure before changing anything. Use your own
question affordance if you have one (a structured multi-select where
available; otherwise ask in plain chat), for example: "Which should I set
up: Codex, Claude Code, the Keiro Python library - or all of them?" Offer
exactly these surfaces, and preselect the ones detected in step 1:
- Codex - setup page: https://docs.keirolabs.ai/codex.md
- Claude Code - setup page: https://docs.keirolabs.ai/claude-code.md
- Keiro Python client library - setup page: https://docs.keirolabs.ai/sdks.md
In the same question, ask whether I want one shared API key for this run
or a dedicated key per surface; the setup pages recommend dedicated keys
so each installation's traffic can be inspected and revoked independently.
If you cannot ask - no question affordance, or the question fails or
returns empty - proceed with the detected-installed surfaces and one
shared key as the default rather than blocking, and say so in the final
report. Configuring eb1 into agents that are already installed is the
default; installing an application that is not already on this machine is
opt-in only and requires my explicit answer.

Step 3 - the keys stay out of your hands
I hold the key or keys from https://console.keirolabs.ai/api-keys. Each
setup path prompts for its key interactively without echoing and stores it
in its documented credential store (an OS keychain or an owner-only file).
Tell me once, before the first installer runs, to have the keys ready to
paste into those hidden prompts. If your shell cannot run an interactive
prompt, do not route a key through yourself: give me the exact documented
command to run in my own terminal (the setup pages and installers print
it) and wait for my confirmation before continuing.

Step 4 - configure each selected surface
Follow each selected surface's setup page exactly. Use the documented
installer scripts as-is (download, inspect, run); do not hand-edit
configuration a script owns, and do not touch unrelated settings. If both
Codex and the Keiro library are selected, configure the library first: the
Codex installer detects an existing keiro command and refuses with
instructions, which surfaces the name conflict for me to resolve, whereas
installing the library after Codex can silently replace the Codex
launcher. Report any refusal and ask me; never work around it.

Step 5 - verify every configured surface
- Send one real request to the model eb1-preview through each configured
  surface and confirm generated text comes back: for Codex, a one-shot
  `keiro exec` prompt, only if the step 1 probe shows the launcher owns
  the keiro name - otherwise report the name collision instead of
  verifying through the wrong tool; for Claude Code, a one-shot
  `claude-keiro -p` prompt; for the Keiro library, the one-line Python
  facade its setup page documents, run with `python3 -c`.
- List the models each stored credential can see. For Codex and Claude
  Code, call the API directly, reading the stored credential with the
  surface's documented reader; `-H @-` makes curl take the Authorization
  header from stdin, so the key never enters an argument list or your
  transcript. Codex:
    curl -sS https://api.keirolabs.ai/v1/models \
      -H "X-Client-Source: keiro-agent-setup/1" \
      -H @- <<<"Authorization: Bearer $(~/.codex/keiro-auth)"
  Claude Code:
    curl -sS https://api.keirolabs.ai/v1/models \
      -H "X-Client-Source: keiro-agent-setup/1" \
      -H @- <<<"Authorization: Bearer $(cat ~/.claude/keiro-api-key)"
  Record each response's X-Request-Id header. For the Keiro library, use
  its documented `keiro models` command instead (after the step 1 probe);
  it reads its own saved credential and asks the same endpoint.
- Expect four public model IDs in each listing: eb1-preview,
  eb1-frontier-preview, eb1-fast-preview, eb1-efficient-preview. Tell me:
  the higher-capability model is exactly `eb1-frontier-preview`; shortened
  spellings are not model IDs and the API rejects them. Model availability
  is account- and key-scoped: if an ID is missing from one credential's
  listing, report which IDs that credential can see and point me at the
  key's restrictions in the console instead of treating the surface as
  broken.

Step 6 - report DONE once, as one checklist
Cover every selected surface in a single report:
- surface, installed application version, and configured or failed;
- where the credential lives (keychain or owner-only file path - the
  location kind only, never the value);
- verification result with the recorded request IDs;
- the surface's one-line revert command from its setup page: for Codex,
  `keiro self uninstall`; for Claude Code, the `rm -f` line under "Remove
  the setup" on its setup page; for the library,
  `python3 -m pip uninstall keiro` plus deleting the ~/.keiro credential
  store;
- anything you could not complete, anything I declined, and whether you
  proceeded on the default (for example "configured 2 installed surfaces
  by default after no response").