feat: custom providers, error handling, internal cleanup

.commandcode/taste/taste.md

@@ -0,0 +1,17 @@
+# Taste (Continuously Learned by [CommandCode][cmd])
+
+[cmd]: https://commandcode.ai/
+
+# git
+- Use short conventional commit messages (type(scope): description) — describe only what changed, no explanations or AI slop. Confidence: 0.70
+- Do not add Co-authored-by or other attribution lines to commit messages. Confidence: 0.75
+
+# audit
+- Always run the /slop audit on changed code before committing, checking for AI-generated slop patterns (obvious comments, TODO placeholders, identity functions, robotic naming). Confidence: 0.85
+
+# code-style
+- Do not write AI-generated slop code — avoid obvious comments that restate the code, redundant doc strings, and architectural trivia in comments. Confidence: 0.85
+- Always follow Google Go style conventions. Confidence: 0.85
+
+# workflow
+- Always run markdownlint-cli2 after modifying markdown files. Confidence: 0.90

cmd/completion.go

@@ -185,7 +185,9 @@ PowerShell:
 
 		if closeOut {
 			if f, ok := out.(*os.File); ok {
-				f.Close()
+				if err := f.Close(); err != nil {
+					cmd.Printf("Error closing completion file: %v\n", err)
+				}
 			}
 		}
 	},

cmd/context.go

@@ -6,31 +6,37 @@ import (
 
 	"github.com/dkmnx/kairo/internal/config"
 	"github.com/dkmnx/kairo/internal/constants"
+	"github.com/dkmnx/kairo/internal/crypto"
 	"github.com/spf13/cobra"
 )
 
 type cliContextKey struct{}
 
+// ConfigDirResolver resolves the default configuration directory.
+type ConfigDirResolver func() (string, error)
+
 // CLIContext holds shared CLI state: config directory, verbosity, config cache,
 // root context, and external dependencies. It is safe for concurrent use.
 type CLIContext struct {
-	configDir   string
-	configDirMu sync.RWMutex
-	verbose     bool
-	verboseMu   sync.RWMutex
-	configCache *config.ConfigCache
-	rootCtx     context.Context
-	deps        *Deps
+	configDir         string
+	configDirMu       sync.RWMutex
+	configDirResolver ConfigDirResolver
+	verbose           bool
+	verboseMu         sync.RWMutex
+	configCache       *config.ConfigCache
+	rootCtx           context.Context
+	deps              *Deps
 
 	defaultProviderExplicit bool
 }
 
 // NewCLIContext creates a CLIContext with default settings.
 func NewCLIContext() *CLIContext {
 	return &CLIContext{
-		configCache: config.NewConfigCache(constants.ConfigCacheTTL),
-		rootCtx:     context.Background(),
-		deps:        NewDeps(),
+		configDirResolver: config.DefaultConfigDir,
+		configCache:       config.NewConfigCache(constants.ConfigCacheTTL),
+		rootCtx:           context.Background(),
+		deps:              NewDeps(),
 	}
 }
 
@@ -43,14 +49,22 @@ func (c *CLIContext) ConfigDir() string {
 		return c.configDir
 	}
 
-	dir, err := config.ConfigDir()
+	dir, err := c.configDirResolver()
 	if err != nil {
 		return ""
 	}
 
 	return dir
 }
 
+// SetConfigDirResolver sets the function used to locate the config directory.
+func (c *CLIContext) SetConfigDirResolver(r ConfigDirResolver) {
+	c.configDirMu.Lock()
+	defer c.configDirMu.Unlock()
+
+	c.configDirResolver = r
+}
+
 // SetConfigDir overrides the configuration directory.
 func (c *CLIContext) SetConfigDir(dir string) {
 	c.configDirMu.Lock()
@@ -90,6 +104,11 @@ func (c *CLIContext) Deps() *Deps {
 	return c.deps
 }
 
+// Crypto returns the crypto service for this CLI session.
+func (c *CLIContext) Crypto() crypto.Service {
+	return c.deps.Crypto
+}
+
 // SetDeps replaces the external dependencies. For use in tests.
 func (c *CLIContext) SetDeps(d *Deps) {
 	c.deps = d

cmd/coverage_test.go

@@ -1,12 +1,15 @@
 package cmd
 
 import (
+	"bytes"
+	stderrors "errors"
 	"os"
 	"strings"
 	"testing"
 
 	"github.com/dkmnx/kairo/internal/config"
 	"github.com/dkmnx/kairo/internal/providers"
+	"github.com/spf13/cobra"
 )
 
 func TestHandleSecretsError(t *testing.T) {
@@ -235,3 +238,17 @@ func TestProviderDefinition(t *testing.T) {
 		t.Errorf("expected 'custom-provider', got %q", def.Name)
 	}
 }
+
+func TestHandleConfigErrorNonBinary(t *testing.T) {
+	cmd := &cobra.Command{}
+	buf := new(bytes.Buffer)
+	cmd.SetOut(buf)
+	cmd.SetErr(buf)
+
+	handleConfigError(cmd, stderrors.New("test error"))
+
+	out := buf.String()
+	if !strings.Contains(out, "Error loading config") {
+		t.Errorf("expected error message, got: %s", out)
+	}
+}

cmd/delete.go

@@ -2,9 +2,7 @@ package cmd
 
 import (
 	"context"
-	stderrors "errors"
 	"fmt"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -25,22 +23,12 @@ var deleteCmd = &cobra.Command{
 	Long:  "Remove a provider from Kairo. If no provider is specified, shows an interactive list of configured providers.",
 	Run: func(cmd *cobra.Command, args []string) {
 		cliCtx := CLIContextFromCmd(cmd)
-		dir := requireConfigDir(cmd)
-		if dir == "" {
-			return
-		}
-
-		cfg, err := config.LoadConfig(cliCtx.RootCtx(), dir)
-		if err != nil {
-			if stderrors.Is(err, fs.ErrNotExist) {
-				printNoProvidersMessage()
-
-				return
-			}
-			handleConfigError(cmd, err)
 
+		cfg, err := loadConfigOrExit(cmd)
+		if err != nil || cfg == nil {
 			return
 		}
+		dir := cliCtx.ConfigDir()
 
 		var target string
 		if len(args) == 0 {
@@ -113,7 +101,7 @@ var deleteCmd = &cobra.Command{
 		secretsPath := filepath.Join(dir, constants.SecretsFileName)
 		keyPath := filepath.Join(dir, constants.KeyFileName)
 
-		if err := deleteProviderSecrets(cliCtx.RootCtx(), secretsPath, keyPath, target); err != nil {
+		if err := deleteProviderSecrets(cliCtx.RootCtx(), cliCtx.Crypto(), secretsPath, keyPath, target); err != nil {
 			tap.Cancel(fmt.Sprintf("Failed to clean up secrets for '%s': %v", target, err))
 
 			return
@@ -123,8 +111,8 @@ var deleteCmd = &cobra.Command{
 	},
 }
 
-func deleteProviderSecrets(ctx context.Context, secretsPath, keyPath, providerName string) error {
-	existingSecrets, err := crypto.DecryptSecretsBytes(ctx, secretsPath, keyPath)
+func deleteProviderSecrets(ctx context.Context, svc crypto.Service, secretsPath, keyPath, providerName string) error {
+	existingSecrets, err := svc.DecryptSecretsBytes(ctx, secretsPath, keyPath)
 	if err != nil {
 		return errors.WrapError(errors.CryptoError,
 			"failed to decrypt secrets for cleanup", err).
@@ -157,7 +145,7 @@ func deleteProviderSecrets(ctx context.Context, secretsPath, keyPath, providerNa
 		return nil
 	}
 
-	if err := crypto.EncryptSecrets(ctx, secretsPath, keyPath, secretsContent); err != nil {
+	if err := svc.EncryptSecrets(ctx, secretsPath, keyPath, secretsContent); err != nil {
 		return errors.WrapError(errors.CryptoError,
 			"could not update secrets", err).
 			WithContext("path", secretsPath)

cmd/delete_test.go

@@ -112,7 +112,7 @@ func TestDeleteCmdDeletesProviderSecrets(t *testing.T) {
 		t.Fatalf("EncryptSecrets() error = %v", err)
 	}
 
-	result, err := LoadSecrets(context.Background(), tmpDir)
+	result, err := LoadSecrets(NewCLIContext(), tmpDir)
 	if err != nil {
 		t.Fatalf("LoadSecrets() error = %v", err)
 	}
@@ -134,7 +134,7 @@ func TestDeleteCmdDeletesProviderSecrets(t *testing.T) {
 		t.Fatalf("EncryptSecrets() error = %v", err)
 	}
 
-	result, err = LoadSecrets(context.Background(), tmpDir)
+	result, err = LoadSecrets(NewCLIContext(), tmpDir)
 	if err != nil {
 		t.Fatalf("LoadSecrets() error = %v", err)
 	}
@@ -189,7 +189,7 @@ func TestDeleteProviderSecretsReturnsErrorOnBadKey(t *testing.T) {
 	secretsPath := filepath.Join(tmpDir, constants.SecretsFileName)
 	keyPath := filepath.Join(tmpDir, "nonexistent.key")
 
-	err := deleteProviderSecrets(context.Background(), secretsPath, keyPath, "testprovider")
+	err := deleteProviderSecrets(context.Background(), NewCLIContext().Crypto(), secretsPath, keyPath, "testprovider")
 	if err == nil {
 		t.Fatal("deleteProviderSecrets should return error when decryption fails")
 	}
@@ -217,7 +217,7 @@ func TestDeleteProviderSecretsPreservesMalformedLines(t *testing.T) {
 		t.Fatalf("EncryptSecrets() error = %v", err)
 	}
 
-	if err := deleteProviderSecrets(context.Background(), secretsPath, keyPath, "PROVIDER_TO_DELETE"); err != nil {
+	if err := deleteProviderSecrets(context.Background(), NewCLIContext().Crypto(), secretsPath, keyPath, "PROVIDER_TO_DELETE"); err != nil {
 		t.Fatalf("deleteProviderSecrets() error = %v", err)
 	}
 

cmd/deps.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"os/exec"
 
+	"github.com/dkmnx/kairo/internal/crypto"
 	"github.com/dkmnx/kairo/internal/ui"
 	"github.com/dkmnx/kairo/internal/update"
 	"github.com/dkmnx/kairo/internal/wrapper"
@@ -65,5 +66,6 @@ func NewDeps() *Deps {
 		Process: osProcessRunner{},
 		Wrapper: prodWrapperService{},
 		Update:  &prodUpdateService{client: update.NewClient()},
+		Crypto:  crypto.DefaultService{},
 	}
 }

cmd/execution_env.go

@@ -84,7 +84,7 @@ func BuildProviderEnv(
 ) (EnvBuildResult, error) {
 	builtIn := BuildBuiltInEnvVars(provider)
 
-	secretsResult, err := LoadSecrets(cliCtx.RootCtx(), configDir)
+	secretsResult, err := LoadSecrets(cliCtx, configDir)
 	if err != nil {
 		if RequiresAPIKey(providerName) {
 			return EnvBuildResult{}, err

cmd/execution_env_test.go

@@ -223,3 +223,45 @@ func TestPiAPIKeyEnvVarMapping(t *testing.T) {
 		})
 	}
 }
+
+func TestHarnessAPIKeyEnvVar(t *testing.T) {
+	tests := []struct {
+		provider string
+		want     string
+	}{
+		{"zai", "ZAI_API_KEY"},
+		{"minimax", "MINIMAX_API_KEY"},
+		{"anthropic", "ANTHROPIC_API_KEY"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.provider, func(t *testing.T) {
+			got := HarnessAPIKeyEnvVar(tt.provider)
+			if got != tt.want {
+				t.Errorf("HarnessAPIKeyEnvVar(%q) = %q, want %q", tt.provider, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestYoloModeFlag(t *testing.T) {
+	tests := []struct {
+		name    string
+		harness string
+		want    string
+	}{
+		{"claude", harnessClaude, "--dangerously-skip-permissions"},
+		{"qwen", harnessQwen, "--yolo"},
+		{"pi", harnessPi, ""},
+		{"crush", harnessCrush, "--yolo"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := yoloModeFlag(tt.harness)
+			if got != tt.want {
+				t.Errorf("yoloModeFlag(%q) = %q, want %q", tt.harness, got, tt.want)
+			}
+		})
+	}
+}

cmd/execution_error.go

@@ -7,25 +7,15 @@ import (
 
 	"github.com/dkmnx/kairo/internal/constants"
 	kairoerrors "github.com/dkmnx/kairo/internal/errors"
+	"github.com/dkmnx/kairo/internal/harness"
 	"github.com/dkmnx/kairo/internal/ui"
 	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v3"
 )
 
-const claudeYoloFlag = "--dangerously-skip-permissions"
-const qwenYoloFlag = "--yolo"
-
-func yoloModeFlag(harness string) string {
-	if harness == harnessQwen || harness == harnessCrush {
-		return qwenYoloFlag
-	}
-	if harness == harnessPi {
-		return ""
-	}
-
-	return claudeYoloFlag
+func yoloModeFlag(h string) string {
+	return harness.YoloFlag(h)
 }
-
 func handleConfigError(cmd *cobra.Command, err error) {
 	if isBinaryOutdatedError(err) {
 		promptUpgrade(cmd, err)