feat(scripts): pnpm smoke — batch model/prompt API tester

.changeset/smoke-fail-fast-unknown-provider.md

@@ -0,0 +1,8 @@
+---
+"open-codesign": patch
+---
+
+Make the `scripts/smoke-models.ts` harness fail fast when the smoke config
+references a provider not registered in `ENV_KEY`. Previously the script
+silently skipped the model (treating it as "no API key set"), masking config
+typos and producing false-green smoke runs.

.changeset/smoke-models-cli.md

@@ -0,0 +1,13 @@
+---
+'open-codesign': minor
+---
+
+feat(scripts): add `pnpm smoke` batch model/prompt tester
+
+`scripts/smoke-models.ts` runs a (provider × model × prompt) matrix through the same `generate()` code path the desktop app uses, saves each artifact to `/tmp/smoke/`, and prints a colored report with quality flags (multiple `<main>` elements, emoji icons, missing EDITMODE block, JS syntax errors via acorn).
+
+API keys come from environment variables (`OPENROUTER_API_KEY`, `ANTHROPIC_API_KEY`, etc.) — never stored in the repo. Models and prompts live in `scripts/smoke-models.toml`.
+
+CLI flags: `--model`, `--prompt`, `--only-failed`, `--config`.
+
+Sanitize TOML prompt names against path traversal — model/prompt slugs now collapse any non-`[a-zA-Z0-9._-]` character to `_`, and the resolved artifact path is verified to stay inside `/tmp/smoke/` before write.

.gitignore

@@ -27,6 +27,7 @@ test-results/
 .env
 .env.*
 !.env.example
+scripts/.smoke-keys.env
 
 # Editor
 .vscode/*

package.json

@@ -28,14 +28,21 @@
     "docs:dev": "pnpm --filter open-codesign-website dev",
     "docs:build": "pnpm --filter open-codesign-website build",
     "docs:preview": "pnpm --filter open-codesign-website preview",
+    "smoke": "tsx scripts/smoke-models.ts",
     "changeset": "changeset",
     "version-packages": "changeset version",
     "release": "turbo run build && changeset publish"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
     "@changesets/cli": "^2.27.11",
+    "@iarna/toml": "^2.2.5",
+    "@open-codesign/core": "workspace:*",
+    "@open-codesign/shared": "workspace:*",
+    "@types/node": "^22.10.2",
+    "acorn": "^8.14.0",
     "husky": "^9.1.7",
+    "tsx": "^4.19.2",
     "turbo": "^2.3.3",
     "typescript": "^5.7.2"
   }