kward 0.79.0 → 0.80.0

data/lib/kward/prompt_interface/transcript_buffer.rb

@@ -4,10 +4,14 @@ module Kward
   class PromptInterface
     # Bounded in-memory transcript buffer used by the prompt interface.
     class TranscriptBuffer
+      TRIM_RATIO = 0.9
+      TRIM_BOUNDARY_SEARCH = 1_024
+
       attr_reader :text
 
       def initialize(limit:)
-        @limit = limit
+        @limit = [limit.to_i, 1].max
+        @trim_target = [(@limit * TRIM_RATIO).floor, 1].max
         @text = +""
         @display_rows_cache_width = nil
         @display_rows_cache = nil
@@ -42,7 +46,7 @@ module Kward
 
       def append(text)
         @text << ANSI.sanitize_transcript(text)
-        @text = @text[-@limit, @limit] if @text.length > @limit
+        trim_to_limit if @text.length > @limit
         invalidate_display_rows_cache
         @text
       end
@@ -77,6 +81,24 @@ module Kward
         @display_rows_cache_width = nil
         @display_rows_cache = nil
       end
+
+      private
+
+      def trim_to_limit
+        cutoff = @text.length - @trim_target
+        newline = @text.index("\n", cutoff)
+        cutoff = newline + 1 if newline && newline - cutoff <= TRIM_BOUNDARY_SEARCH
+        cutoff = safe_escape_boundary(cutoff)
+        @text = @text[cutoff..].to_s
+      end
+
+      def safe_escape_boundary(cutoff)
+        escape_start = @text.rindex("\e", cutoff)
+        return cutoff unless escape_start
+
+        escape = ANSI.escape_sequence_at(@text, escape_start)
+        escape && escape_start + escape.length > cutoff ? escape_start + escape.length : cutoff
+      end
     end
   end
 end

data/lib/kward/prompt_interface.rb

@@ -128,12 +128,13 @@ module Kward
       end
     end
 
-    def initialize(input: $stdin, output: $stdout, slash_commands: [], overlay_settings: nil, project_browser_icon_theme: "off", footer: nil, composer_status: nil, busy_help: true, attachment_badges: nil, attachment_parser: nil, banner_message: nil, tab_keybindings: nil, prompt_history: nil, editor_mode: nil, editor_mode_source: nil, editor_auto_indent: true, editor_auto_indent_source: nil, editor_auto_close_pairs: true, editor_auto_close_pairs_source: nil, editor_soft_wrap: true, editor_soft_wrap_source: nil, editor_bar_cursor: true, editor_bar_cursor_source: nil, editor_line_numbers: "absolute", editor_line_numbers_source: nil, diff_view: "auto", diff_view_source: nil)
+    def initialize(input: $stdin, output: $stdout, slash_commands: [], overlay_settings: nil, project_browser_icon_theme: "off", footer: nil, composer_status: nil, busy_help: true, attachment_badges: nil, attachment_parser: nil, banner_message: nil, tab_keybindings: nil, prompt_history: nil, workspace_root: Dir.pwd, editor_mode: nil, editor_mode_source: nil, editor_auto_indent: true, editor_auto_indent_source: nil, editor_auto_close_pairs: true, editor_auto_close_pairs_source: nil, editor_soft_wrap: true, editor_soft_wrap_source: nil, editor_bar_cursor: true, editor_bar_cursor_source: nil, editor_line_numbers: "absolute", editor_line_numbers_source: nil, diff_view: "auto", diff_view_source: nil)
       @input_io = input
       @output_io = output
       @reader = TTY::Reader.new(input: input, output: output, interrupt: :error)
       @mutex = Mutex.new
       @prompt_history = prompt_history
+      @workspace_root = File.expand_path(workspace_root.to_s.empty? ? Dir.pwd : workspace_root)
       @composer = ComposerState.new
       load_history(@prompt_history.values) if @prompt_history
       self.composer_input = @composer.input
@@ -146,7 +147,8 @@ module Kward
       @steered_count = 0
       @spinner_frame_index = 0
       @last_spinner_tick = monotonic_now
-      @last_footer_refresh = monotonic_now
+      @last_footer_refresh = nil
+      @cached_footer_text = nil
       @last_composer_status_refresh = 0.0
       @cached_composer_status_text = nil
       @prompt_label = "You>"
@@ -340,10 +342,23 @@ module Kward
       @mutex.synchronize { editor_active? }
     end
 
-    def edit_file(path, base_dir: Dir.pwd, allow_new: true)
+    def update_workspace_root(root, prompt_history: nil)
+      @mutex.synchronize do
+        expanded_root = File.expand_path(root.to_s.empty? ? Dir.pwd : root)
+        return false if expanded_root == @workspace_root
+
+        @workspace_root = expanded_root
+        @prompt_history = prompt_history if prompt_history
+        load_history(@prompt_history.values) if @prompt_history
+        reset_workspace_file_state_locked
+        true
+      end
+    end
+
+    def edit_file(path, base_dir: nil, allow_new: true)
       start(render: false)
       opened = @mutex.synchronize do
-        open_editor(path, allow_new: allow_new, base_dir: base_dir, restrict_to_workspace: false).tap do
+        open_editor(path, allow_new: allow_new, base_dir: base_dir || prompt_workspace_root, restrict_to_workspace: false).tap do
           render_prompt_locked
         end
       end
@@ -610,9 +625,14 @@ module Kward
 
     def update_tabs(labels:, active_index: 0)
       @mutex.synchronize do
-        @tabs = Array(labels).map { |label| normalize_tab_label(label) }
-        @active_tab_index = active_index.to_i
+        normalized_labels = Array(labels).map { |label| normalize_tab_label(label) }
+        normalized_index = active_index.to_i
+        return false if @tabs == normalized_labels && @active_tab_index == normalized_index
+
+        @tabs = normalized_labels
+        @active_tab_index = normalized_index
         render_prompt_locked if @started && @asking
+        true
       end
     end
 
@@ -625,16 +645,19 @@ module Kward
       end
     end
 
-    def tab_view_snapshot
+    def tab_view_snapshot(include_transcript: true)
       @mutex.synchronize do
-        {
+        snapshot = {
           composer: @composer.dup,
           prompt_label: @prompt_label.dup,
-          editor_state: @editor_state&.dup,
-          transcript_buffer: @transcript_buffer.dup,
-          transcript_viewport_rows: @transcript_viewport_rows,
-          stream_state: @stream_state.dup
+          editor_state: @editor_state&.dup
         }
+        if include_transcript
+          snapshot[:transcript_buffer] = @transcript_buffer.dup
+          snapshot[:transcript_viewport_rows] = @transcript_viewport_rows
+          snapshot[:stream_state] = @stream_state.dup
+        end
+        snapshot
       end
     end
 
@@ -859,6 +882,8 @@ module Kward
 
     def refresh_composer_status
       @mutex.synchronize do
+        @cached_footer_text = nil
+        @last_footer_refresh = nil
         @cached_composer_status_text = nil
         @last_composer_status_refresh = 0.0
         render_prompt_locked if @started && @asking
@@ -879,6 +904,22 @@ module Kward
 
     private
 
+    def prompt_workspace_root
+      @workspace_root
+    end
+
+    def reset_workspace_file_state_locked
+      @file_mention_paths = nil
+      @file_mention_path_entries_paths = nil
+      @file_mention_path_entries = nil
+      @project_browser_state = nil
+      @project_browser_tree_paths = nil
+      @project_browser_tree = nil
+      @file_overlay_dismissed_token = nil
+      @file_open_dismissed_token = nil
+      @file_editor_open_status = nil
+    end
+
     def modal_active_locked?
       @question_prompt_active || !@question_state.nil? || !@select_state.nil? || !@git_state.nil?
     end

data/lib/kward/prompts/commands.rb

@@ -30,7 +30,7 @@ module Kward
       { name: "shell", description: "Open the embedded Kward shell.", argument_hint: "" },
       { name: "scratchpad", description: "Open an unsaved editor buffer.", argument_hint: "[text|markdown|ruby]" },
       { name: "pty", description: "Run a command in an interactive PTY passthrough session.", argument_hint: "<command>" },
-      { name: "tab", description: "Manage tabs.", argument_hint: "[1-n|move|close|new|name]" },
+      { name: "tab", description: "Manage tabs.", argument_hint: "[1-n|move|close|new|name|worktree]" },
       { name: "status", description: "Show the current status message.", argument_hint: "" },
       { name: "stats", description: "Show telemetry logging stats.", argument_hint: "[range]" },
       { name: "sandbox", description: "Inspect or configure model command sandboxing.", argument_hint: "[status|off|read_only|workspace_write|network allow|network deny]" },

data/lib/kward/prompts.rb

@@ -22,25 +22,26 @@ module Kward
     # @param plugin_context [String, nil] trusted plugin-provided instructions
     # @return [Hash] role/content system message
     # @api public
-    def system_message(workspace_root: Dir.pwd, include_workspace_personality: true, model: nil, reasoning_effort: nil, now: Time.now, memory_context: nil, plugin_context: nil)
+    def system_message(workspace_root: Dir.pwd, include_workspace_personality: true, model: nil, reasoning_effort: nil, now: Time.now, memory_context: nil, plugin_context: nil, execution_profile_context: nil)
       {
         role: "system",
-        content: prompt_parts(workspace_root: workspace_root, include_workspace_personality: include_workspace_personality, model: model, reasoning_effort: reasoning_effort, now: now, memory_context: memory_context, plugin_context: plugin_context).compact.join("\n\n")
+        content: prompt_parts(workspace_root: workspace_root, include_workspace_personality: include_workspace_personality, model: model, reasoning_effort: reasoning_effort, now: now, memory_context: memory_context, plugin_context: plugin_context, execution_profile_context: execution_profile_context).compact.join("\n\n")
       }
     end
 
-    def prompt_parts(workspace_root: Dir.pwd, include_workspace_personality: true, model: nil, reasoning_effort: nil, now: Time.now, memory_context: nil, plugin_context: nil)
-      prompt_sections(workspace_root: workspace_root, include_workspace_personality: include_workspace_personality, model: model, reasoning_effort: reasoning_effort, now: now, memory_context: memory_context, plugin_context: plugin_context).map { |section| section[:content] }
+    def prompt_parts(workspace_root: Dir.pwd, include_workspace_personality: true, model: nil, reasoning_effort: nil, now: Time.now, memory_context: nil, plugin_context: nil, execution_profile_context: nil)
+      prompt_sections(workspace_root: workspace_root, include_workspace_personality: include_workspace_personality, model: model, reasoning_effort: reasoning_effort, now: now, memory_context: memory_context, plugin_context: plugin_context, execution_profile_context: execution_profile_context).map { |section| section[:content] }
     end
 
     # Returns labeled prompt sections for inspection by CLI and RPC frontends.
     #
     # @return [Array<Hash>] section hashes with label, content, and optional source
     # @api public
-    def prompt_sections(workspace_root: Dir.pwd, include_workspace_personality: true, model: nil, reasoning_effort: nil, now: Time.now, memory_context: nil, plugin_context: nil)
+    def prompt_sections(workspace_root: Dir.pwd, include_workspace_personality: true, model: nil, reasoning_effort: nil, now: Time.now, memory_context: nil, plugin_context: nil, execution_profile_context: nil)
       return replacement_prompt_sections if ConfigFiles.replacement_system_prompt?
 
       sections = [prompt_section("Built-in system prompt", base_prompt)]
+      sections << prompt_section("Execution profile", execution_profile_context) unless execution_profile_context.to_s.empty?
       sections << prompt_section(config_agents_prompt_label, config_agents_prompt, source: config_agents_prompt_source)
       sections << prompt_section("Memory context", memory_context) unless memory_context.to_s.empty?
       if include_workspace_personality

data/lib/kward/rpc/auth_manager.rb

@@ -4,6 +4,7 @@ require_relative "../auth/anthropic_oauth"
 require_relative "../auth/github_oauth"
 require_relative "../auth/openai_oauth"
 require_relative "../model/client"
+require_relative "../model/provider_catalog"
 require_relative "config_manager"
 
 # Namespace for the Kward CLI agent runtime.
@@ -25,45 +26,44 @@ module Kward
       end
 
       def status
-        oauth = @oauth_factory.call
-        config = stored_config
+        provider_status = providers.fetch(:providers)
         {
-          openaiOAuth: oauth.logged_in?,
-          openaiAccountId: oauth.respond_to?(:account_id) ? oauth.account_id : nil,
-          openrouterApiKey: !ENV["OPENROUTER_API_KEY"].to_s.empty? || !config["openrouter_api_key"].to_s.empty?,
+          providers: provider_status,
+          openaiOAuth: oauth_status("openai")[:configured],
+          openrouterApiKey: @config_manager.api_key_status("openrouter")[:configured],
           openaiAccessToken: !ENV["OPENAI_ACCESS_TOKEN"].to_s.empty?,
-          anthropicOAuth: @anthropic_oauth_factory.call.logged_in?,
-          githubOAuth: @github_oauth_factory.call.logged_in?
+          anthropicOAuth: oauth_status("anthropic")[:configured],
+          githubOAuth: oauth_status("copilot")[:configured]
         }
       rescue StandardError => e
-        { openaiOAuth: false, error: e.message }
+        { providers: [], openaiOAuth: false, error: e.message }
       end
 
       def providers
-        { providers: [openai_provider, anthropic_provider, openrouter_provider, github_provider] }
+        { providers: ProviderCatalog.all.map { |provider| provider_payload(provider) } }
       end
 
-      def login_with_api_key(provider_id:, api_key:)
-        provider_id = provider_id.to_s
-        @config_manager.set_api_key(provider_id, api_key)
-        { providerId: provider_id, message: "Saved API key for #{provider_name(provider_id)}." }
+      def login_with_api_key(provider_id:, api_key:, configuration: nil)
+        raise ArgumentError, "API key must be a non-empty string" if api_key.to_s.strip.empty?
+
+        provider = ProviderCatalog.fetch(provider_id)
+        @config_manager.configure_azure_openai(configuration || {}) if provider.id == "azure_openai"
+        @config_manager.set_api_key(provider.id, api_key)
+        { providerId: provider.id, authMethod: "api_key", configured: true, message: "Saved API key for #{provider.name}." }
       end
 
-      def logout_provider(provider_id:)
-        provider_id = provider_id.to_s
-        case provider_id
-        when "openai"
-          logout_openai
-          { providerId: provider_id, message: "Logged out of OpenAI." }
-        when "anthropic"
-          logout_anthropic
-          { providerId: provider_id, message: "Logged out of Anthropic." }
-        when "openrouter"
-          @config_manager.delete_key("openrouter_api_key")
-          { providerId: provider_id, message: "Logged out of OpenRouter." }
-        else
-          raise "Unsupported auth provider: #{provider_id}"
+      def logout_provider(provider_id:, auth_method: nil)
+        provider = ProviderCatalog.fetch(provider_id)
+        auth_method = auth_method.to_s unless auth_method.nil?
+        removed = false
+        if provider.api_key? && (auth_method.nil? || auth_method == "api_key")
+          removed = @config_manager.delete_api_key(provider.id) || removed
+        end
+        if provider.oauth? && (auth_method.nil? || auth_method == "oauth")
+          removed = logout_oauth_provider(provider.id) || removed
         end
+
+        { providerId: provider.id, authMethod: auth_method, removed: removed, message: "Logged out of #{provider.name}." }.compact
       end
 
       def login_with_oauth(provider_id:, timeout_seconds: 120)
@@ -73,8 +73,12 @@ module Kward
           start_oauth_login(provider_id: "openai", oauth: @oauth_factory.call, timeout_seconds: timeout_seconds)
         when "anthropic"
           start_oauth_login(provider_id: "anthropic", oauth: @anthropic_oauth_factory.call, timeout_seconds: timeout_seconds)
-        when "github"
-          raise "GitHub OAuth is supported in the CLI with `ruby lib/main.rb login github`, but RPC browser login is not implemented yet."
+        when "github", "copilot"
+          raise "GitHub Copilot OAuth is unavailable over RPC; use the interactive CLI login."
+        when "openrouter"
+          raise "OpenRouter OAuth is unavailable because Kward has not implemented OpenRouter's official PKCE flow."
+        when "xai"
+          raise "xAI OAuth is unavailable because no official stable third-party flow is supported."
         else
           raise "Unsupported OAuth provider: #{provider_id}"
         end
@@ -121,144 +125,100 @@ module Kward
 
       private
 
-      def fetch_login(login_id)
-        @mutex.synchronize { @logins[login_id.to_s] } || raise("Unknown login: #{login_id}")
-      end
-
-      def stored_config
-        @config_manager.read(redacted: false)
-      rescue StandardError
-        {}
-      end
-
-      def openai_provider
-        oauth = @oauth_factory.call
-        env_configured = !ENV["OPENAI_ACCESS_TOKEN"].to_s.empty?
-        stored_configured = oauth.logged_in?
-        provider = {
-          id: "openai",
-          name: "OpenAI",
-          authType: "oauth",
-          configured: env_configured || stored_configured,
-          storedCredentialType: "oauth",
-          canLogout: stored_configured,
-          usesCallbackServer: true
-        }
-        provider[:source] = env_configured ? "environment" : "stored" if provider[:configured]
-        provider[:label] = provider[:configured] ? "Signed in" : "Not signed in"
-        provider
-      rescue StandardError
+      def provider_payload(provider)
+        methods = []
+        if provider.api_key?
+          status = @config_manager.api_key_status(provider.id)
+          methods << {
+            id: "api_key",
+            supported: true,
+            configured: status[:configured],
+            source: status[:source],
+            canLogout: status[:canLogout]
+          }.compact
+        end
+        methods << oauth_method_payload(provider) if provider.oauth?
+        configured_methods = methods.select { |method| method[:configured] }
+        preferred = methods.find { |method| method[:id] == "oauth" } || methods.first
         {
-          id: "openai",
-          name: "OpenAI",
-          authType: "oauth",
-          configured: !ENV["OPENAI_ACCESS_TOKEN"].to_s.empty?,
-          source: (!ENV["OPENAI_ACCESS_TOKEN"].to_s.empty? ? "environment" : nil),
-          label: (!ENV["OPENAI_ACCESS_TOKEN"].to_s.empty? ? "Signed in" : "Not signed in"),
-          storedCredentialType: "oauth",
-          canLogout: false,
-          usesCallbackServer: true
+          id: provider.id,
+          runtimeId: ProviderCatalog.runtime(provider.id).id,
+          name: provider.name,
+          authType: preferred&.fetch(:id, nil),
+          authMethods: methods,
+          configured: !configured_methods.empty?,
+          source: configured_methods.find { |method| method[:source] == "environment" }&.fetch(:source, nil) || configured_methods.first&.fetch(:source, nil),
+          canLogout: configured_methods.any? { |method| method[:canLogout] },
+          usesCallbackServer: methods.any? { |method| method[:usesCallbackServer] },
+          label: configured_methods.empty? ? "Not configured" : "Configured"
         }.compact
       end
 
-      def anthropic_provider
-        oauth = @anthropic_oauth_factory.call
-        stored_configured = oauth.logged_in?
-        provider = {
-          id: "anthropic",
-          name: "Anthropic",
-          authType: "oauth",
-          configured: stored_configured,
-          storedCredentialType: "oauth",
-          canLogout: stored_configured,
-          usesCallbackServer: true
-        }
-        provider[:source] = "stored" if provider[:configured]
-        provider[:label] = provider[:configured] ? "Signed in" : "Not signed in"
-        provider
-      rescue StandardError
+      def oauth_method_payload(provider)
+        status = oauth_status(provider.id)
+        supported = ["openai", "anthropic"].include?(provider.id)
+        reason = unless supported
+                   case provider.id
+                   when "openrouter"
+                     "Official PKCE is documented, but Kward has not implemented it."
+                   when "xai"
+                     "No official stable third-party OAuth flow is available."
+                   else
+                     "OAuth login is available only in the interactive CLI."
+                   end
+                 end
         {
-          id: "anthropic",
-          name: "Anthropic",
-          authType: "oauth",
-          configured: false,
-          label: "Not signed in",
-          storedCredentialType: "oauth",
-          canLogout: false,
-          usesCallbackServer: true
-        }
-      end
-
-      def openrouter_provider
-        config = stored_config
-        env_configured = !ENV["OPENROUTER_API_KEY"].to_s.empty?
-        stored_configured = !config["openrouter_api_key"].to_s.empty?
-        provider = {
-          id: "openrouter",
-          name: "OpenRouter",
-          authType: "api_key",
-          configured: env_configured || stored_configured,
-          canLogout: stored_configured
-        }
-        provider[:source] = env_configured ? "environment" : "stored" if provider[:configured]
-        provider[:storedCredentialType] = "api_key" if stored_configured
-        provider[:label] = provider[:configured] ? "API key configured" : "API key not configured"
-        provider
+          id: "oauth",
+          name: provider.oauth_name,
+          supported: supported,
+          configured: status[:configured],
+          source: status[:source],
+          canLogout: status[:canLogout],
+          usesCallbackServer: supported,
+          reason: reason
+        }.compact
       end
 
-      def github_provider
-        oauth = @github_oauth_factory.call
-        env_configured = !ENV["COPILOT_GITHUB_TOKEN"].to_s.empty?
-        stored_configured = oauth.logged_in? && !env_configured
-        provider = {
-          id: "github",
-          name: "GitHub",
-          authType: "oauth",
-          configured: env_configured || stored_configured,
-          storedCredentialType: "oauth",
-          canLogout: false,
-          usesCallbackServer: false,
-          supported: false,
-          reason: "GitHub OAuth is available in the CLI for Copilot scaffolding; RPC login is not implemented yet."
-        }
-        provider[:source] = env_configured ? "environment" : "stored" if provider[:configured]
-        provider[:label] = provider[:configured] ? "Signed in" : "Not signed in"
-        provider
+      def oauth_status(provider_id)
+        case provider_id
+        when "openai"
+          oauth_credential_status(@oauth_factory.call, env_name: "OPENAI_ACCESS_TOKEN")
+        when "anthropic"
+          oauth_credential_status(@anthropic_oauth_factory.call)
+        when "copilot"
+          oauth_credential_status(@github_oauth_factory.call, env_name: "COPILOT_GITHUB_TOKEN", can_logout: false)
+        else
+          { configured: false, canLogout: false }
+        end
       rescue StandardError
-        {
-          id: "github",
-          name: "GitHub",
-          authType: "oauth",
-          configured: false,
-          label: "Not signed in",
-          storedCredentialType: "oauth",
-          canLogout: false,
-          usesCallbackServer: false,
-          supported: false,
-          reason: "GitHub OAuth status unavailable."
-        }
+        { configured: false, canLogout: false }
       end
 
-      def provider_name(provider_id)
-        case provider_id
-        when "openrouter" then "OpenRouter"
-        when "openai" then "OpenAI"
-        when "anthropic" then "Anthropic"
-        when "github" then "GitHub"
-        else provider_id
-        end
+      def oauth_credential_status(oauth, env_name: nil, can_logout: true)
+        environment = env_name && !ENV[env_name].to_s.empty?
+        stored = oauth.logged_in?
+        {
+          configured: environment || stored,
+          source: environment ? "environment" : (stored ? "stored" : nil),
+          canLogout: can_logout && stored
+        }.compact
       end
 
-      def logout_openai
-        oauth = @oauth_factory.call
+      def logout_oauth_provider(provider_id)
+        oauth = case provider_id
+                when "openai" then @oauth_factory.call
+                when "anthropic" then @anthropic_oauth_factory.call
+                else return false
+                end
         path = oauth.auth_path if oauth.respond_to?(:auth_path)
-        File.delete(path) if path && File.exist?(path)
+        return false unless path && File.exist?(path)
+
+        File.delete(path)
+        true
       end
 
-      def logout_anthropic
-        oauth = @anthropic_oauth_factory.call
-        path = oauth.auth_path if oauth.respond_to?(:auth_path)
-        File.delete(path) if path && File.exist?(path)
+      def fetch_login(login_id)
+        @mutex.synchronize { @logins[login_id.to_s] } || raise("Unknown login: #{login_id}")
       end
 
       def wait_for_callback(login, timeout_seconds:)

data/lib/kward/rpc/config_manager.rb

@@ -1,6 +1,9 @@
 require_relative "../auth/openai_oauth"
+require_relative "../auth/api_key_store"
 require_relative "../config_files"
 require_relative "../model/model_info"
+require_relative "../model/provider_catalog"
+require_relative "../model/azure_openai_config"
 require_relative "redactor"
 
 # Namespace for the Kward CLI agent runtime.
@@ -9,8 +12,9 @@ module Kward
   module RPC
     # RPC configuration manager for reading and updating user config.
     class ConfigManager
-      def initialize(config_path: OpenAIOAuth.default_config_path)
+      def initialize(config_path: OpenAIOAuth.default_config_path, api_key_store: nil)
         @config_path = File.expand_path(config_path)
+        @api_key_store = api_key_store || APIKeyStore.new(path: File.join(File.dirname(@config_path), "api_keys.json"), config_path: @config_path)
       end
 
       attr_reader :config_path
@@ -21,6 +25,7 @@ module Kward
       end
 
       def update(values)
+        reject_provider_api_keys!(values)
         Redactor.redact(ConfigFiles.update_config(values, @config_path))
       end
 
@@ -39,12 +44,35 @@ module Kward
       end
 
       def set_api_key(provider_id, api_key)
-        provider_id = provider_id.to_s
-        api_key = api_key.to_s.strip
-        raise "API key must be a non-empty string" if api_key.empty?
-        raise "Unsupported API key provider: #{provider_id}" unless provider_id == "openrouter"
+        provider = ProviderCatalog.fetch(provider_id)
+        raise "#{provider.name} does not accept an API key" unless provider.api_key?
 
-        update("openrouter_api_key" => api_key)
+        @api_key_store.store(provider.id, api_key)
+      end
+
+      def api_key_status(provider_id)
+        provider = ProviderCatalog.fetch(provider_id)
+        configured = @api_key_store.configured?(provider.id)
+        stored = @api_key_store.stored?(provider.id)
+        {
+          configured: configured,
+          stored: stored,
+          source: configured ? (environment_api_key?(provider) ? "environment" : "stored") : nil,
+          canLogout: stored
+        }.compact
+      end
+
+      def delete_api_key(provider_id)
+        @api_key_store.delete(provider_id)
+      end
+
+      def configure_azure_openai(values)
+        setup = AzureOpenAIConfig.new(
+          endpoint: values["endpoint"] || values[:endpoint],
+          deployment: values["deployment"] || values[:deployment],
+          api_version: values["apiVersion"] || values[:apiVersion] || values["api_version"] || values[:api_version]
+        )
+        update(setup.to_config)
       end
 
       def delete_key(key)
@@ -61,6 +89,18 @@ module Kward
 
       private
 
+      def reject_provider_api_keys!(values)
+        keys = values.respond_to?(:keys) ? values.keys.map(&:to_s) : []
+        private_keys = ProviderCatalog.api_key_providers.map { |provider| "#{provider.id}_api_key" }
+        return if (keys & private_keys).empty?
+
+        raise ArgumentError, "Provider API keys must be saved with auth/loginWithApiKey"
+      end
+
+      def environment_api_key?(provider)
+        provider.api_key_env.any? { |name| !ENV[name].to_s.strip.empty? }
+      end
+
       def load_config
         ConfigFiles.read_config(@config_path)
       end