lantern 0.1.2

lantern 0.1.2

Ten model providers behind one preset table, and a setup wizard that turns
"which endpoint, which model, which key" into three questions asked once.

Providers

id	endpoint	key variable	default model
deepseek	https://api.deepseek.com	DEEPSEEK_API_KEY	deepseek-flash
openai	https://api.openai.com/v1	OPENAI_API_KEY	gpt-4o-mini
anthropic	https://api.anthropic.com	ANTHROPIC_API_KEY	claude-sonnet-4-5
gemini	https://generativelanguage.googleapis.com/v1beta/openai	GEMINI_API_KEY	gemini-2.5-flash
openrouter	https://openrouter.ai/api/v1	OPENROUTER_API_KEY	deepseek/deepseek-chat
groq	https://api.groq.com/openai/v1	GROQ_API_KEY	llama-3.3-70b-versatile
mistral	https://api.mistral.ai/v1	MISTRAL_API_KEY	mistral-small-latest
xai	https://api.x.ai/v1	XAI_API_KEY	grok-4
ollama	http://127.0.0.1:11434/v1	none (local)	first model it lists
custom	your own URL	LANTERN_LLM_API_KEY (optional)	you name it

A preset carries the endpoint, the key variable and a model shortlist, so
switching providers means naming an id instead of memorising a URL. Order of
precedence is environment, then the wizard's files, then the preset — a preset
only supplies what the operator did not, and a key saved for one provider is
never sent to another.

Nine presets speak chat completions; anthropic speaks the Messages API, which
needed a second client: system turns move to a top-level field, tool results
become tool_result blocks inside one user turn (consecutive turns merge,
because the endpoint requires strict alternation), and tool_use input arrives
as an object rather than a string.

Setup asks three questions

lantern setup now opens with the model half, because that is the part only
you can answer:

1. provider — all ten listed with their endpoints, current one marked;
2. model — the endpoint's own model list is fetched live, so the menu shows
   what that account can actually call; the preset's shortlist is the fallback
   when it will not answer, and m lets you type any other name;
3. key — read with the input hidden, then checked with one real 16-token
   completion. A key that cannot reach its endpoint is not worth storing, and
   the check costs one call instead of a failed flow later.

The key lands in ~/.config/lantern/credentials at mode 0600 — pinned again
after every write, because an existing file keeps whatever mode it was created
with. Provider, model and endpoint go to config.json beside it, which holds
no secret. Both files sit outside the data root, so neither is ever in the
database, a log, a trace or an artifact, and LANTERN_CONFIG_DIR relocates
them.

With no terminal attached the wizard prints one line and stands down, so a
scripted lantern setup still provisions and never blocks. lantern doctor
now reports provider / model @ endpoint [where the key came from] without
printing the key.

Also in this window

• The development-only judgement client is gone from the product: config, env
  vars, doctor row and README rows deleted; the reflector does a plain review
  and reports reviewed N finding(s) (or no findings to review).
• The device profile no longer has a SoC vendor in its CPU whitelist — such a
  host would have been reported as if the SoC were the CPU. It gets the neutral
  core-and-architecture line instead.
• lantern --version reports the real number: 0.1.1 shipped a binary that
  called itself lantern 0.1.0.

Verified

• 198 tests pass, 1 ignored (the live NVD query), 0 warnings — up from 166 at
  0.1.1.
• The whole wizard was driven through a real pty: provider menu, model list,
  masked key input, a live 401 from the endpoint with the key redacted in the
  message, save anyway, then files on disk — credentials at 0600,
  config.json free of secrets.
• Two mutation checks: the cross-provider key test and the Anthropic turn
  merging test both fail with their fix removed and pass with it.
• Precedence spot-checked on the built binary: LANTERN_LLM_PROVIDER=groq
  overrides the saved file and pulls Groq's preset defaults; doctor labels
  credentials file vs GROQ_API_KEY (environment).
• lantern setup < /dev/null prints the skip line and provisions anyway.
• run --dry-run: 0.635 s, report written. lantern doctor exits 0 in 35–37 ms
  (5 runs) with 18.8 MB peak RSS and 12 native tools.
• The intermediate commit builds on its own: clean-worktree cargo check,
  exit 0.

Upgrade

git pull
cargo build --release          # ~/.cargo/bin/cargo if it is not on PATH
./target/release/lantern doctor

Nothing for existing setups to migrate: DEEPSEEK_API_KEY in the environment
still works exactly as before, since deepseek remains the default preset, and a
fresh clone still boots with no configuration at all. The database schema is
untouched, so flows recorded on 0.1.0 and 0.1.1 still render. No new CLI flags —
lantern setup still takes none.

Attached: lantern-v0.1.2-aarch64-linux-gnu (8,546,696 bytes), built on Debian
13 / glibc 2.41 / aarch64. For anything else, build from source as above.