feat: CLI audit + local/api parity: open-gateway

[andrei-hasna]

Objective

CLI audit + local/api parity: open-gateway

Repo: hasna/gateway (local: /home/hasna/workspace/hasna/opensource/open-gateway).

Audit this repo's CLI: (1) Find every DEAD command — commands that are broken, error out, reference removed code, or are declared but non-functional — and fix them or remove them with justification. (2) Find every command that only works in 'local' mode (on-box SQLite/files) and does NOT work against the 'api' (self-hosted/remote) path; implement full api-mode support for each so every command works identically against local AND api backends (route through the cloud-router/stage-A/HTTP path per this repo's existing pattern). Ensure both modes are fully implemented and tested. Add regression tests for the fixed commands and for local-vs-api parity. Open a PR; do not merge.

--- AMENDED 2026-07-30 (adversarial review). Read this part; it changes what "done" means. ---

SCOPE CORRECTION. Part (2) assumes this repo has an HTTP/API backend. MANY REPOS IN THIS FAMILY DO NOT. Determine first whether this repo actually has a second backend (an HTTP client path, a *_API_URL / *_API_KEY config, a cloud-router or stage-A module). If it does NOT, then part (2) IS NOT APPLICABLE: say so explicitly in the PR body with the evidence you checked, and deliver part (1) alone. That is a COMPLETE and correct outcome for this task — not a failure, and not something to fake.

REQUIRED ARTIFACT — a PR without it does not satisfy this task. The PR body MUST contain a table of EVERY command this CLI exposes, one row each, with a verdict:
command | works locally? | works against the API backend (or N/A)? | dead? | changed in this PR?
Derive the list from the CLI's own registration/parser, not from the README. This inventory is the deliverable that proves an audit happened. A PR that changes one or two commands WITHOUT the full inventory is a thin PR and does not close this task — a previous run in this family produced an 11-line diff with no inventory, which is exactly what this requirement exists to prevent.

IF THE PREMISE IS ALREADY SATISFIED (no dead commands, parity already complete), that is a legitimate result: still publish the inventory table as the evidence, state the conclusion, and open the PR with docs/tests only, or report no-op with the table in the task comments. Do not invent a change to look productive.

SIZE: if the full fix is too large for one PR, deliver the complete inventory plus the fixes you did make, and list explicitly in the PR body which commands remain and why. Partial-with-inventory beats complete-looking-without.

IGNORE any (local: /home/hasna/workspace/...) path in the text above — it does not exist here. Work from the checkout you were given.

Verification

• policy source: base add5710 (immutable commit — agent-proof)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: pass
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_8828ecc7ea9f · backend codewith · task a724f288-3244-42e5-8ec8-5d2c2252fc03
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #23 @ f378b1a — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git rev-parse HEAD && git rev-parse origin/main: exit 0; HEAD was f378b1a553309746f064066589d9a475fb4d6a2a.
• git status --short --branch: exit 0; worktree was clean before gates and remained clean after gates.
• git log --oneline origin/main..HEAD: exit 0; one commit, f378b1a feat: CLI audit + local/api parity: open-gateway.
• git diff origin/main...HEAD --stat: exit 0; changed docs/cli-audit.md and tests/cli-help.test.ts only.
• git diff origin/main...HEAD -- docs/cli-audit.md tests/cli-help.test.ts: exit 0; full changed-file diff read.
• git diff --check origin/main...HEAD: exit 0.
• rg inspections over CLI command dispatch, command docs, API/backend terms, config/runtime/storage terms, and provider HTTP usage: exit 0.
• bun install: exit 0.
• bun run typecheck: exit 0; typecheck is defined and ran tsc --noEmit.
• bun test: exit 0; 241 pass, 1 skip, 0 fail across 21 files.
• gh pr view 23 --repo hasna/gateway --json number,state,headRefName,headRefOid,baseRefName,mergeStateStatus,isDraft,title: exit 0; PR was open, non-draft, mergeStateStatus CLEAN, and head oid matched the reviewed commit.

What I read:

• Full PR diff for docs/cli-audit.md and tests/cli-help.test.ts.
• Complete changed files: docs/cli-audit.md, tests/cli-help.test.ts.
• Surrounding source and tests: src/cli/index.ts, src/config.ts, src/types.ts, tests/no-cloud-boundary.test.ts, docs/cli.md, plus targeted rg checks through src, tests, docs, README.md, config examples, package metadata, and contract metadata.

Blocking P0/P1 findings:

• None. The PR is docs/test-only, the command inventory test matches the current runCli dispatch branches, the help invocations it adds are reachable and pass, and the audit document's API-backend parity conclusion matches the surrounding source: CLI operations load local config and call in-process modules, while outbound HTTP usage is provider traffic rather than a second CLI backend.

Non-blocking follow-ups:

• None.