what does lulu setup do?
Store one key and prove it works, with nothing to decide on the way. It reads which engine the key belongs to off the key, offers it to the OS keychain, falls back to a file with owner-only permissions when the keychain will not take it, says which of the two happened and why, and then spends about a cent proving that the key works.
how do you run it?
In the parser’s own words, store an API key and prove it works, in one command with no questions. Every flag this build accepts, on one line:
lulu setup [--provider PROVIDER]
lulu setup ± paste the key when it askspbpaste | lulu setup ± or pipe it in
why does it ask nothing?
This replaces a wizard that asked three questions, and it exists because the person it was written for could not finish it. Every question was a decision the tool was better placed to make than the customer, and every one of them was a place to stop. A setup step that offers options fails on whichever option the reader picks wrong.
So the engine is read off the key, the safest storage the machine has is used without a menu, and the check call runs in the same breath. What is left to the person is the part only they can do, which is having a key.
where does the key end up?
The fallback is not decoration. A Mac whose default keychain is locked or missing answers the store request with a dialog and then with nothing, so "macOS" and "a key can be stored right now" are two different facts, and this command only believes the second one after it has asked. Whichever way it goes it prints the place and the command to read the key back yourself.
The OS keychain is the macOS one. Everywhere else the key goes to a file with owner-only permissions, which the command says out loud and prints the path of. The key is never printed, never put in shell history, and never written into the repository.
what does the check call prove?
That the key works, that the search tool is switched on for your account, and that a search actually comes back with pages.
That call is billed, so it is written down. It lands in ./ledger under a name beginning diagnostic__, and the command says the path on the way past. A round of its own, because a call made to test an account is not a measurement of a brand: it is priced by lulu usage like any other spend, and refused by everything that scores an answer.