Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/run_full_benchmark.py`:
- Around line 41-43: MODELS and the _detect_provider() function advertise
"moonshot/kimi-k2" but the client factory only supports Anthropic/OpenAI
prefixes, so either remove the Moonshot entry or implement Moonshot provider
wiring; to fix, delete the "moonshot" entry from the MODELS mapping (and any
corresponding entries in the same block around lines 53-65) and ensure
_detect_provider() no longer returns a "moonshot" provider, or alternatively add
proper provider detection and client creation for the "moonshot" prefix in the
client factory so that _detect_provider(), MODELS, and the client creation logic
(client factory function) are consistent.
- Around line 117-121: The interactive prompt currently uses input() to read the
API key (variable key when env_key is missing), which echoes the secret; replace
input(f"\nEnter {env_key}: ").strip() with a secure prompt using
getpass.getpass() so the entered API key is not echoed or stored in shell
history, and add an import for getpass at the top of the script; keep the
existing empty-check and sys.exit(1) behavior unchanged, and ensure you still
call .strip() on the returned value.
- Around line 105-106: The public helpers and entry point lack precise type
hints: update _ensure_api_key to use Optional for api_key and a precise mapping
return type (change def _ensure_api_key(model: str, api_key: str | None) -> dict
to def _ensure_api_key(model: str, api_key: str | None) -> dict[str, str]), add
an explicit return annotation to main (e.g., def main(...) -> None or -> int
depending on the script's exit behavior), and replace any other unparameterised
dict occurrences with parameterised types like dict[str, str] (and use
Optional[str] or str | None for nullable strings) so all public helpers and the
entry point have full, concrete type hints.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/run_full_benchmark.py`:
- Around line 129-135: The _run function currently calls subprocess.run(cmd,
env=env, check=False) with no timeout, so a stalled vera-bench process can hang
the full-suite runner; update _run to pass a timeout (e.g.,
timeout=DEFAULT_TIMEOUT or a passed-in parameter) to subprocess.run and wrap the
call in a try/except that catches subprocess.TimeoutExpired, logs the timeout
(including the cmd), terminates/cleans up if needed, and returns a non-zero
error code; reference the _run function, the cmd and env variables, and the
subprocess.TimeoutExpired exception when implementing this change.
- Around line 231-242: The report generation step currently calls
_run(["vera-bench", "report", "results/"], env) but ignores its return code,
allowing the script to exit 0 even if report generation failed; modify the block
around the _run call (the report generation section) to capture the return value
(e.g., rc = _run(...)), check if rc != 0, print a clear error message including
the rc, and return that non-zero code (or increment the failed count) before
proceeding to count test failures so the script exits non-zero when report
generation fails.
- Line 27: The script currently imports and uses argparse; replace that with
click-based CLI: remove the argparse import and any ArgumentParser usage and
instead create a click-decorated function (e.g., `@click.command`() def main(...))
with click.option()s that map to the former parser arguments (the variables
referenced as args in the script), update calls that read args.<name> to use the
function parameters, and replace the if __name__ == "__main__": block to call
main() so the CLI uses click. Target identifiers to change: the top-level import
argparse, the ArgumentParser/parse_args usage, the args.* references, and the
script entrypoint (main or the current entry function).

In `@vera_bench/models.py`:
- Around line 49-50: Update the ValueError message in vera_bench/models.py to
include the missing accepted prefixes so it matches create_client's supported
list: add "anthropic/*" and "openai/*" to the string that currently reads
"Expected claude-*, gpt-*, o1-*, o3-*, or moonshot/* prefix." Locate the error
message near the model validation (the ValueError raised for unknown model) and
adjust the text to enumerate all accepted prefixes exactly as implemented in
create_client.
- Around line 181-203: The complete method currently only catches
openai.APITimeoutError; add retry-on-rate-limit logic with exponential backoff
inside MoonshotClient.complete: wrap the
_client.with_options(...).chat.completions.create call in a retry loop (e.g.,
3-5 attempts), catch openai.error.RateLimitError and
openai.APIError/requests-like 429 responses, sleep with exponential backoff +
jitter between retries, and rethrow the last error if attempts exhausted; ensure
the timeout exception handling for openai.APITimeoutError remains. Also update
the earlier user-facing error message (the one referencing allowed provider
prefixes) to include the accepted prefixes "anthropic/" and "openai/" so it
reads correctly for users.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CITATION.cff`:
- Around line 5-6: Update CITATION.cff so the version metadata is complete and
correct: change the date-released value to "2026-04-07" to match the v0.0.7
release and add a doi field pointing to the published benchmark results (e.g.,
doi: "10.xxxx/xxxxx") following standard CFF syntax; also verify the file
includes authors and title fields alongside version and date to comply with the
project citation policy.

In `@scripts/run_full_benchmark.py`:
- Around line 154-157: Remove the command-line flag that accepts secrets: stop
adding "--api-key" via parser.add_argument and instead read the API key from a
secure source (environment variable or prompt via getpass/STDIN) where
parser.add_argument("--api-key", ...) is currently defined; update any code that
reads args.api_key to fall back to os.environ["API_KEY"] (or call
getpass.getpass() for interactive prompts) and ensure no new CLI flags accept
secrets (also remove/replace the similar flag referenced at the other
occurrence).
- Around line 111-113: The current env_key check (if not env_key) only prints a
warning and returns os.environ, allowing the benchmark to continue; change this
to fail-fast by terminating execution when an unknown provider/model prefix is
encountered: in the block that checks env_key (the condition referencing env_key
and model), replace the silent return with an immediate exit (e.g., call
sys.exit(1) or raise SystemExit with a clear message mentioning model) so the
script stops instead of proceeding with a doomed full run.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@CITATION.cff`:
- Around line 5-6: CITATION.cff was updated with version and date-released but
is missing the required DOI and possibly other mandatory fields; update the
CITATION.cff to include a doi field with the published benchmark DOI string and
verify presence of authors and title entries (ensure fields named authors,
title, version, date-released, doi appear in the file) so the citation conforms
to standard CFF metadata requirements.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/test_models.py`:
- Around line 144-148: The test should assert the returned model identifier from
OpenAIClient.complete to close the response-contract gap: update the assertion
block after calling client.complete("system", "user") to include an assertion on
result.model (e.g., assert result.model == <expected_model_identifier>), where
<expected_model_identifier> is the model string used by your test mock or
fixture; reference the client.complete call and the result.model property when
making this change.