@agxnte/reidx 2.0.2 → 2.0.4

package/README.md

@@ -65,7 +65,7 @@ reid doctor
 Expected output:
 
 ```
-reid 2.0.2
+reid 2.0.3
 settings  <path> (found|missing)
 python    <path> (3.13.x)
 workspace <cwd>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agxnte/reidx",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Terminal-native personal intelligence and coding CLI (agent-first runtime)",
   "bin": {
     "reid": "bin/reidx.js"

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "reidx"
-version = "2.0.1"
+version = "2.0.4"
 description = "Terminal-native personal intelligence and coding CLI (agent-first runtime)"
 readme = "README.md"
 requires-python = ">=3.12"

package/src/reidx/__init__.py

@@ -1,3 +1,3 @@
 """ReidX: terminal-native agent-first CLI runtime."""
 
-__version__ = "2.0.2"
+__version__ = "2.0.4"

package/src/reidx/app/commands.py

@@ -16,9 +16,11 @@ from reidx import __version__
 from reidx.automation.exec import exec_run
 from reidx.config.loader import ConfigLoader
 from reidx.config.models import Config
+from reidx.config.storage import storage_root
 from reidx.deepreid import format_markdown, run_deepreid, save_deepreid_result
 from reidx.diagnostics.logger import get_logger
 from reidx.provider.registry import default_registry
+from reidx.provider.store import load_from_database
 from reidx.provider.store import load_into as load_stored_providers
 from reidx.runtime.orchestrator import Orchestrator
 from reidx.tools import default_registry as tools_registry
@@ -97,11 +99,9 @@ def _main(
 def build_orchestrator(config: Config | None = None) -> Orchestrator:
     cfg = config or ConfigLoader().load()
     providers = default_registry(cfg)
-    load_stored_providers(providers, cfg.storage_root or (Path.home() / ".reidx"))
-    # `/connect` may have persisted a provider that isn't yet `cfg.default_provider`.
-    # We never auto-promote — stub stays default unless the user did `/use` last
-    # session (that's a session setting, not a config change). Fall back to stub
-    # if the configured default isn't registered.
+    root = cfg.storage_root or storage_root()
+    load_stored_providers(providers, root)
+    load_from_database(providers, root)
     default_name = cfg.default_provider if providers.has(cfg.default_provider) else "stub"
     provider = providers.get(default_name)
     return Orchestrator(cfg, provider, tools_registry(), providers=providers)
@@ -207,7 +207,7 @@ def doctor() -> None:
     console.print(f"storage   {cfg.storage_root}")
     console.print(f"provider  {cfg.default_provider}")
     console.print(f"mode      {cfg.policy.default_mode.value}")
-    console.print(f"providers {orch.provider.name} (active), {orch.tools.definitions().__len__()} tools")
+    console.print(f"providers {orch.provider.name} (active), {len(orch.tools.definitions())} tools")
     import os
 
     has_key = bool(os.environ.get("ANTHROPIC_API_KEY", "").strip())

package/src/reidx/config/__init__.py

@@ -1,10 +1,13 @@
 from reidx.config.loader import ConfigLoader
 from reidx.config.models import Config, PolicyConfig, ProviderConfig, default_config
+from reidx.config.storage import app_data_dir, storage_root
 
 __all__ = [
     "Config",
     "ConfigLoader",
     "PolicyConfig",
     "ProviderConfig",
+    "app_data_dir",
     "default_config",
+    "storage_root",
 ]

package/src/reidx/config/loader.py

@@ -11,11 +11,12 @@ from pathlib import Path
 
 from reidx.config.models import Config, default_config
 from reidx.config.settings import apply_settings_env, read_reidx_block
+from reidx.config.storage import storage_root
 from reidx.diagnostics.logger import get_logger
 
 log = get_logger("reidx.config")
 
-GLOBAL_DIR = Path.home() / ".reidx"
+GLOBAL_DIR = storage_root()
 PROJECT_DIR = Path(".reidx")
 CONFIG_FILENAME = "config.json"
 

package/src/reidx/config/models.py

@@ -19,6 +19,7 @@ class ProviderConfig(BaseModel):
     base_url: str | None = None
     api_key: SecretStr | None = None
     default_model: str = ""
+    auth_method: str = "bearer"
 
 
 class PolicyConfig(BaseModel):

package/src/reidx/config/settings.py

@@ -10,13 +10,14 @@ ignored harmlessly.
 Path resolution (first hit wins):
   1. $REIDCHAT_SETTINGS                (explicit override)
   2. ./settings.json                   (project-local, when it exists)
-  3. E:/leech/Reidchat.json            (legacy default — the shared Reidchat file)
-
-Project-local wins over the shared Reidchat file so a project can bake in a
-different backend, permission mode, or provider set without editing the
-global file. The env block is authoritative for the process (overrides any
-ambient env) — this is how ReidX picks up the Reidchat proxy credentials
-even when the shell's ANTHROPIC_* vars point somewhere else.
+  3. ~/.reidx/settings.json            (global default)
+  4. ~/Reidchat.json                    (legacy fallback)
+
+Project-local wins over the global file so a project can bake in a different
+backend, permission mode, or provider set without editing the global file.
+The env block is authoritative for the process (overrides any ambient env)
+— this is how ReidX picks up proxy credentials even when the shell's
+ANTHROPIC_* vars point somewhere else.
 """
 from __future__ import annotations
 
@@ -24,13 +25,14 @@ import json
 import os
 from pathlib import Path
 
+from reidx.config.storage import app_data_dir
 from reidx.diagnostics.logger import get_logger
 
 log = get_logger("reidx.config.settings")
 
-LEGACY_SETTINGS_PATH = Path("E:/leech/Reidchat.json")
-GLOBAL_SETTINGS_PATH = Path.home() / ".reidx" / "settings.json"
+GLOBAL_SETTINGS_PATH = app_data_dir() / "settings.json"
 PROJECT_SETTINGS_FILENAME = "settings.json"
+LEGACY_SETTINGS_PATH = Path.home() / "Reidchat.json"
 
 
 def _walk_upward_for_project_settings(start: Path) -> Path | None:
@@ -61,7 +63,7 @@ def settings_path() -> Path:
       1. $REIDCHAT_SETTINGS                    (explicit override)
       2. project settings.json (walk upward from CWD)
       3. ~/.reidx/settings.json              (global default)
-      4. E:/leech/Reidchat.json                (legacy shared file)
+      4. ~/Reidchat.json                      (legacy fallback)
 
     Returns the last fallback even if it doesn't exist, so `doctor` can
     report it as "missing" rather than crashing on a None.

package/src/reidx/config/storage.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+
+def app_data_dir() -> Path:
+    if sys.platform == "win32":
+        base = os.environ.get("APPDATA")
+        if base:
+            return Path(base) / "Reid"
+    return Path.home() / ".reidx"
+
+
+def storage_root() -> Path:
+    return app_data_dir()
+
+
+def settings_file() -> Path:
+    return app_data_dir() / "settings.json"

package/src/reidx/provider/_http.py

@@ -27,3 +27,16 @@ def post_json(url: str, payload: dict, headers: dict[str, str], timeout: int = T
     except urllib.error.URLError as exc:
         raise RuntimeError(f"connection error: {exc}") from exc
     return json.loads(raw)
+
+
+def get_json(url: str, headers: dict[str, str], timeout: int = TIMEOUT_SECONDS) -> dict:
+    req = urllib.request.Request(url, headers=headers, method="GET")
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            raw = resp.read().decode("utf-8")
+    except urllib.error.HTTPError as exc:
+        err_body = exc.read().decode("utf-8", errors="replace")[:500]
+        raise RuntimeError(f"HTTP {exc.code}: {err_body}") from exc
+    except urllib.error.URLError as exc:
+        raise RuntimeError(f"connection error: {exc}") from exc
+    return json.loads(raw)

package/src/reidx/provider/anthropic.py

@@ -11,13 +11,11 @@ Env vars consumed:
 """
 from __future__ import annotations
 
-import json
 import os
-import urllib.error
-import urllib.request
 from typing import Any
 
 from reidx.diagnostics.logger import get_logger
+from reidx.provider._http import get_json, post_json
 from reidx.provider.base import BaseProvider, Message, ProviderResponse, ToolCall, Usage
 
 log = get_logger("reidx.provider.anthropic")
@@ -25,7 +23,6 @@ log = get_logger("reidx.provider.anthropic")
 DEFAULT_BASE_URL = "https://api.anthropic.com"
 API_VERSION = "2023-06-01"
 MAX_TOKENS = 4096
-TIMEOUT_SECONDS = 120
 
 
 class AnthropicProvider(BaseProvider):
@@ -53,6 +50,12 @@ class AnthropicProvider(BaseProvider):
         model = os.environ.get("ANTHROPIC_MODEL", "").strip()
         return cls(api_key=key, base_url=base, default_model=model)
 
+    def _headers(self) -> dict[str, str]:
+        return {
+            "x-api-key": self.api_key,
+            "anthropic-version": API_VERSION,
+        }
+
     def _to_anthropic_messages(self, messages: list[Message]) -> tuple[str | None, list[dict]]:
         """Convert ReidX Messages to Anthropic format. Returns (system, messages)."""
         system: str | None = None
@@ -62,7 +65,6 @@ class AnthropicProvider(BaseProvider):
                 system = m.content
                 continue
             if m.role == "tool":
-                # Tool results -> Anthropic tool_result content block.
                 out.append({
                     "role": "user",
                     "content": [{
@@ -73,7 +75,6 @@ class AnthropicProvider(BaseProvider):
                 })
                 continue
             if m.role == "assistant" and m.tool_calls:
-                # Assistant turn with tool calls -> content blocks.
                 blocks: list[dict] = []
                 if m.content:
                     blocks.append({"type": "text", "text": m.content})
@@ -86,7 +87,6 @@ class AnthropicProvider(BaseProvider):
                     })
                 out.append({"role": "assistant", "content": blocks})
                 continue
-            # Plain user or assistant text.
             out.append({"role": m.role, "content": m.content})
         return system, out
 
@@ -150,27 +150,24 @@ class AnthropicProvider(BaseProvider):
         if anthropic_tools:
             payload["tools"] = anthropic_tools
 
-        body = json.dumps(payload).encode("utf-8")
         url = f"{self.base_url}/v1/messages"
-        req = urllib.request.Request(
-            url,
-            data=body,
-            headers={
-                "x-api-key": self.api_key,
-                "anthropic-version": API_VERSION,
-                "content-type": "application/json",
-            },
-            method="POST",
-        )
         try:
-            with urllib.request.urlopen(req, timeout=TIMEOUT_SECONDS) as resp:
-                raw = resp.read().decode("utf-8")
-        except urllib.error.HTTPError as exc:
-            err_body = exc.read().decode("utf-8", errors="replace")[:500]
-            log.error("Anthropic API error %s: %s", exc.code, err_body)
-            raise RuntimeError(f"Anthropic API error {exc.code}: {err_body}") from exc
-        except urllib.error.URLError as exc:
-            log.error("Anthropic connection error: %s", exc)
-            raise RuntimeError(f"connection error: {exc}") from exc
-
-        return self._parse_response(json.loads(raw), model)
+            body = post_json(url, payload, self._headers())
+        except RuntimeError:
+            log.exception("Anthropic API request failed")
+            raise
+        return self._parse_response(body, model)
+
+    def fetch_models(self) -> list[str]:
+        url = f"{self.base_url}/v1/models"
+        try:
+            body = get_json(url, self._headers())
+        except RuntimeError:
+            log.debug("failed to fetch models from %s", url)
+            return []
+        models: list[str] = []
+        for item in body.get("data", []):
+            mid = item.get("id", "")
+            if mid:
+                models.append(mid)
+        return sorted(models)

package/src/reidx/provider/base.py

@@ -48,3 +48,6 @@ class BaseProvider(ABC):
         model: str | None = None,
     ) -> ProviderResponse:
         """Run one model turn. Returns text and/or tool calls."""
+
+    def fetch_models(self) -> list[str]:
+        return []

package/src/reidx/provider/ollama.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 from typing import Any
 
 from reidx.diagnostics.logger import get_logger
-from reidx.provider._http import post_json
+from reidx.provider._http import get_json, post_json
 from reidx.provider.base import BaseProvider, Message, ProviderResponse, ToolCall, Usage
 
 log = get_logger("reidx.provider.ollama")
@@ -107,3 +107,16 @@ class OllamaProvider(BaseProvider):
             ),
             stop_reason=body.get("done_reason", "stop"),
         )
+
+    def fetch_models(self) -> list[str]:
+        try:
+            body = get_json(f"{self.base_url}/api/tags", {})
+        except RuntimeError:
+            log.debug("failed to fetch models from ollama")
+            return []
+        models: list[str] = []
+        for item in body.get("models", []):
+            name = item.get("name", "")
+            if name:
+                models.append(name)
+        return sorted(models)

package/src/reidx/provider/openai.py

@@ -14,7 +14,7 @@ import os
 from typing import Any
 
 from reidx.diagnostics.logger import get_logger
-from reidx.provider._http import post_json
+from reidx.provider._http import get_json, post_json
 from reidx.provider.base import BaseProvider, Message, ProviderResponse, ToolCall, Usage
 
 log = get_logger("reidx.provider.openai")
@@ -125,19 +125,56 @@ class OpenAIProvider(BaseProvider):
             raise
         return self._parse(body, model)
 
+    def fetch_models(self) -> list[str]:
+        url = f"{self.base_url}/v1/models"
+        try:
+            body = get_json(url, self._headers())
+        except RuntimeError:
+            log.debug("failed to fetch models from %s", url)
+            return []
+        models: list[str] = []
+        for item in body.get("data", []):
+            mid = item.get("id", "")
+            if mid:
+                models.append(mid)
+        return sorted(models)
+
 
 class OpenAICompatibleProvider(OpenAIProvider):
     """OpenAI-compatible endpoints (llama.cpp server, LM Studio, vLLM, etc.).
 
     Same wire format as OpenAI; only default base_url differs and the API key
-    is optional. Kept as a subclass so `/providers` can show the kind
-    separately in the list.
+    is optional. Auth method is configurable so providers that use x-api-key
+    instead of Bearer are handled correctly. Kept as a subclass so `/providers`
+    can show the kind separately in the list.
     """
 
     name = "openai-compatible"
     DEFAULT_BASE_URL = "http://localhost:8080"
     DEFAULT_MODEL = "local"
 
+    def __init__(
+        self,
+        api_key: str,
+        base_url: str = "",
+        default_model: str = "",
+        auth_method: str = "bearer",
+    ) -> None:
+        self.auth_method = auth_method
+        super().__init__(api_key=api_key, base_url=base_url, default_model=default_model)
+
+    def _headers(self) -> dict[str, str]:
+        h = {}
+        if not self.api_key:
+            return h
+        if self.auth_method == "x-api-key":
+            h["x-api-key"] = self.api_key
+        elif self.auth_method == "none":
+            pass
+        else:
+            h["authorization"] = f"Bearer {self.api_key}"
+        return h
+
 
 def _json_dump(obj) -> str:  # type: ignore[no-untyped-def]
     import json

package/src/reidx/provider/registry.py

@@ -79,6 +79,7 @@ def default_registry(config: Config) -> ProviderRegistry:
                 base_url=pc.base_url or "",
                 api_key=pc.api_key.get_secret_value() if pc.api_key else "",
                 default_model=pc.default_model,
+                auth_method=pc.auth_method,
             ))
         except (ValueError, TypeError):
             log.warning("provider '%s' (kind=%s) configured but could not be built; skipping", name, kind)

package/src/reidx/provider/store.py

@@ -39,6 +39,7 @@ class ProviderRecord:
     base_url: str = ""
     api_key: str = ""
     default_model: str = ""
+    auth_method: str = "bearer"
 
 
 def build_provider(record: ProviderRecord) -> BaseProvider:
@@ -60,6 +61,7 @@ def build_provider(record: ProviderRecord) -> BaseProvider:
             api_key=record.api_key,
             base_url=record.base_url,
             default_model=record.default_model,
+            auth_method=record.auth_method,
         )
     if kind == "ollama":
         return OllamaProvider(
@@ -125,11 +127,28 @@ class ProviderStore:
         return True
 
 
+def validate_provider(record: ProviderRecord) -> tuple[bool, str]:
+    try:
+        provider = build_provider(record)
+    except (ValueError, TypeError) as exc:
+        return False, str(exc)
+    _keyless_kinds = ("ollama", "openai-compatible")
+    if not record.api_key and record.kind not in _keyless_kinds:
+        return False, "API key required for this provider kind"
+    if not record.api_key:
+        return True, "no key required"
+    try:
+        models = provider.fetch_models()
+    except Exception:
+        return False, "could not connect to provider"
+    if models:
+        return True, f"ok ({len(models)} models available)"
+    if record.kind == "ollama":
+        return True, "connected"
+    return False, "key rejected or no models returned"
+
+
 def load_into(registry: ProviderRegistry, storage_root: Path) -> list[str]:
-    """Register every persisted provider into `registry`. Returns the list of
-    names successfully registered. Skips (with a warning) any record whose
-    kind is unknown or fails to construct — the app must not crash on a
-    single bad entry."""
     added: list[str] = []
     store = ProviderStore(storage_root)
     for record in store.list():
@@ -139,3 +158,40 @@ def load_into(registry: ProviderRegistry, storage_root: Path) -> list[str]:
         except (ValueError, TypeError):
             log.exception("skipping provider %s (kind=%s): failed to build", record.name, record.kind)
     return added
+
+
+def load_from_database(registry: ProviderRegistry, storage_root: Path) -> list[str]:
+    from reidx.provider_manager.database import ProviderDatabase
+
+    added: list[str] = []
+    db = ProviderDatabase(storage_root)
+    for sp in db.list_providers():
+        if registry.has(sp.name):
+            continue
+        api_key = sp.decrypted_api_key()
+        record = ProviderRecord(
+            name=sp.name,
+            kind=sp.kind,
+            base_url=sp.base_url,
+            api_key=api_key,
+            default_model=sp.default_model,
+            auth_method=sp.auth_method,
+        )
+        try:
+            provider = build_provider(record)
+        except (ValueError, TypeError):
+            log.warning("skipping provider %s (kind=%s): failed to build", sp.name, sp.kind)
+            continue
+        if not record.default_model:
+            try:
+                models = provider.fetch_models()
+            except Exception:
+                models = []
+            if models:
+                provider.default_model = models[0]
+                sp.default_model = models[0]
+                db.save_provider(sp)
+                log.info("auto-fetched model for %s: %s", sp.name, models[0])
+        registry.register(sp.name, provider)
+        added.append(sp.name)
+    return added

package/src/reidx/provider_manager/catalog.py

@@ -113,8 +113,8 @@ _BUILTIN: list[ProviderDefinition] = [
         default_model="auto", aliases=[], auth_method="none", icon="🚀",
     ),
     ProviderDefinition(
-        id="azure-openai", name="Azure OpenAI", description="OpenAI models via Azure cloud",
-        kind="openai", base_url="", default_model="gpt-4o-mini",
+        id="azure-openai", name="Azure OpenAI", description="OpenAI models via Azure cloud (set base URL to your endpoint)",
+        kind="openai", base_url="https://api.openai.com", default_model="gpt-4o-mini",
         aliases=["azure"], icon="☁️",
     ),
     ProviderDefinition(
@@ -178,8 +178,9 @@ _BUILTIN: list[ProviderDefinition] = [
         default_model="jamba-1.5-large", aliases=[], icon="🃏",
     ),
     ProviderDefinition(
-        id="databricks", name="Databricks", description="Serving endpoints for fine-tuned models",
-        kind="openai-compatible", base_url="", default_model="databricks-dbrx-instruct",
+        id="databricks", name="Databricks", description="Serving endpoints for fine-tuned models (set base URL to your workspace)",
+        kind="openai-compatible", base_url="https://dbc-xxxxxxxx.cloud.databricks.com/serving-endpoints",
+        default_model="databricks-dbrx-instruct",
         aliases=[], icon="🧱",
     ),
     ProviderDefinition(
@@ -205,7 +206,7 @@ _BUILTIN: list[ProviderDefinition] = [
     ProviderDefinition(
         id="lambda", name="Lambda Labs", description="GPU cloud for AI training and inference",
         kind="openai-compatible", base_url="https://api.lambdalabs.com/v1",
-        default_model="", aliases=["lambda-labs"], icon="λ",
+        default_model="meta-llama/Meta-Llama-3.1-70B-Instruct", aliases=["lambda-labs"], icon="λ",
     ),
     ProviderDefinition(
         id="kluster", name="Kluster AI", description="Distributed GPU network for inference",
@@ -234,7 +235,8 @@ _BUILTIN: list[ProviderDefinition] = [
     ),
     ProviderDefinition(
         id="cloudflare-ai", name="Cloudflare Workers AI", description="Serverless AI inference at the edge",
-        kind="openai-compatible", base_url="", default_model="@cf/meta/llama-3.1-70b-instruct",
+        kind="openai-compatible", base_url="https://api.cloudflare.com/client/v4",
+        default_model="@cf/meta/llama-3.1-70b-instruct",
         aliases=["cf-ai"], icon="orange",
     ),
     ProviderDefinition(
@@ -245,7 +247,7 @@ _BUILTIN: list[ProviderDefinition] = [
     ProviderDefinition(
         id="baseten", name="Baseten", description="Model deployment and serving platform",
         kind="openai-compatible", base_url="https://inference.baseten.co/v1",
-        default_model="", aliases=[], icon="🏗️",
+        default_model="meta-llama/Meta-Llama-3.1-70B-Instruct", aliases=[], icon="🏗️",
     ),
     ProviderDefinition(
         id="anyscale", name="Anyscale", description="Ray-based scalable model serving",
@@ -264,7 +266,8 @@ _BUILTIN: list[ProviderDefinition] = [
     ),
     ProviderDefinition(
         id="watsonx", name="IBM Watsonx", description="Enterprise AI platform with Granite models",
-        kind="openai-compatible", base_url="", default_model="ibm/granite-3-8b-instruct",
+        kind="openai-compatible", base_url="https://us-south.ml.cloud.ibm.com",
+        default_model="ibm/granite-3-8b-instruct",
         aliases=["ibm"], icon="🔷",
     ),
     ProviderDefinition(

package/src/reidx/provider_manager/keychain.py

@@ -1,7 +1,10 @@
 from __future__ import annotations
 
 import base64
+import getpass
+import hashlib
 import os
+import socket
 import sys
 from pathlib import Path
 
@@ -70,6 +73,21 @@ if _IS_WINDOWS:
             ctypes.windll.kernel32.LocalFree(blob_out.pbData)
 
 
+def _machine_key() -> bytes:
+    parts = [
+        getpass.getuser(),
+        socket.gethostname(),
+        str(Path.home()),
+        sys.platform,
+    ]
+    raw = "|".join(parts).encode("utf-8")
+    return hashlib.pbkdf2_hmac("sha256", raw, b"reidx-keychain-v1", 100000, dklen=32)
+
+
+def _xor_cipher(data: bytes, key: bytes) -> bytes:
+    return bytes(data[i] ^ key[i % len(key)] for i in range(len(data)))
+
+
 def encrypt(plaintext: str) -> str:
     if not plaintext:
         return ""
@@ -77,8 +95,7 @@ def encrypt(plaintext: str) -> str:
     if _IS_WINDOWS:
         encrypted = _dpapi_encrypt(raw)
     else:
-        log.warning("DPAPI not available on this platform; storing key without OS encryption")
-        encrypted = raw
+        encrypted = _xor_cipher(raw, _machine_key())
     return base64.b64encode(encrypted).decode("ascii")
 
 
@@ -89,7 +106,7 @@ def decrypt(ciphertext: str) -> str:
     if _IS_WINDOWS:
         decrypted = _dpapi_decrypt(raw)
     else:
-        decrypted = raw
+        decrypted = _xor_cipher(raw, _machine_key())
     return decrypted.decode("utf-8")
 
 

package/src/reidx/provider_manager/palette.py

@@ -9,7 +9,7 @@ from typing import Any
 from prompt_toolkit.buffer import Buffer
 
 from reidx.diagnostics.logger import get_logger
-from reidx.provider.store import ProviderRecord, build_provider
+from reidx.provider.store import ProviderRecord, build_provider, validate_provider
 from reidx.provider_manager.catalog import (
     ProviderDefinition,
     all_providers,
@@ -602,6 +602,25 @@ class ProviderPalette:
         auth = d.get("auth_method", "bearer")
         api_key = d.get("api_key", "").strip()
 
+        if api_key:
+            record = ProviderRecord(
+                name=name, kind=kind, base_url=base_url,
+                api_key=api_key, default_model=model,
+            )
+            ok, msg = validate_provider(record)
+            if not ok:
+                self._show_message(f"Key validation failed: {msg}", self.WIZARD)
+                self.wizard_step_idx = len(WIZARD_STEPS) - 1
+                return
+            if not model:
+                try:
+                    provider = build_provider(record)
+                    models = provider.fetch_models()
+                except Exception:
+                    models = []
+                if models:
+                    model = models[0]
+
         existing = self.db.get_provider(name)
         if existing:
             existing.kind = kind
@@ -609,13 +628,12 @@ class ProviderPalette:
             existing.default_model = model
             existing.auth_method = auth
             if api_key:
+                from reidx.provider_manager import keychain
                 existing.keys.append(StoredKey(
                     id=uuid.uuid4().hex[:12],
                     label="Default",
-                    encrypted_key="",
+                    encrypted_key=keychain.encrypt(api_key),
                 ))
-                from reidx.provider_manager import keychain
-                existing.keys[-1].encrypted_key = keychain.encrypt(api_key)
                 if existing.active_key_id is None:
                     existing.active_key_id = existing.keys[-1].id
             self.db.save_provider(existing)
@@ -647,10 +665,19 @@ class ProviderPalette:
         if not self.current_provider:
             return
         name = self.current_provider.name
+        sp = self.current_provider
+        record = ProviderRecord(
+            name=name, kind=sp.kind, base_url=sp.base_url,
+            api_key=api_key, default_model=sp.default_model,
+        )
+        ok, msg = validate_provider(record)
+        if not ok:
+            self._show_message(f"Key validation failed: {msg}", self.MANAGE)
+            return
         self.db.add_key(name, label, api_key)
         self.current_provider = self.db.get_provider(name)
         self._register_current()
-        self._show_message(f"Added key '{label}'", self.MANAGE)
+        self._show_message(f"Added key '{label}' ({msg})", self.MANAGE)
 
     def _do_delete_key(self, key_id: str, label: str) -> str:
         if not self.current_provider:
@@ -680,8 +707,18 @@ class ProviderPalette:
             record = ProviderRecord(
                 name=sp.name, kind=sp.kind, base_url=sp.base_url,
                 api_key=api_key, default_model=sp.default_model,
+                auth_method=sp.auth_method,
             )
             provider = build_provider(record)
+            if not sp.default_model:
+                try:
+                    models = provider.fetch_models()
+                except Exception:
+                    models = []
+                if models:
+                    provider.default_model = models[0]
+                    sp.default_model = models[0]
+                    self.db.save_provider(sp)
             self.orchestrator.providers.register(sp.name, provider)
         except (ValueError, TypeError):
             log.exception("failed to register provider %s", sp.name)

package/src/reidx/ui/app.py

@@ -458,8 +458,10 @@ class ChatApp:
         if self._palette is not None:
             return
         from pathlib import Path
-        storage_root = self.orchestrator.config.storage_root or (Path.home() / ".reidx")
-        db = ProviderDatabase(Path(storage_root))
+
+        from reidx.config.storage import storage_root as get_storage_root
+        root = self.orchestrator.config.storage_root or get_storage_root()
+        db = ProviderDatabase(Path(root))
         self._palette = ProviderPalette(
             db=db,
             orchestrator=self.orchestrator,

package/src/reidx/ui/commands.py

@@ -10,15 +10,22 @@ from, so they can't drift out of sync.
 """
 from __future__ import annotations
 
-from pathlib import Path
+import uuid
 
 from rich.console import Group
 from rich.panel import Panel
 from rich.text import Text
 
+from reidx.config.storage import storage_root
 from reidx.goals.models import Goal, GoalNodeKind, GoalStatus
 from reidx.policy.models import PermissionMode
-from reidx.provider.store import SUPPORTED_KINDS, ProviderRecord, ProviderStore, build_provider
+from reidx.provider.store import (
+    SUPPORTED_KINDS,
+    ProviderRecord,
+    ProviderStore,
+    build_provider,
+    validate_provider,
+)
 from reidx.runtime.orchestrator import Orchestrator
 from reidx.ui import render
 from reidx.ui.theme import APP_NAME, BOX, PRIMARY
@@ -472,10 +479,49 @@ _BUILTIN_PROVIDER_NAMES = ("stub", "anthropic")
 
 
 def _providers_store(orchestrator: Orchestrator) -> ProviderStore:
-    root = orchestrator.config.storage_root or (Path.home() / ".reidx")
+    root = orchestrator.config.storage_root or storage_root()
     return ProviderStore(root)
 
 
+def _save_to_database(orchestrator: Orchestrator, record: ProviderRecord) -> None:
+    from reidx.provider_manager import keychain
+    from reidx.provider_manager.database import ProviderDatabase, StoredKey, StoredProvider
+
+    root = orchestrator.config.storage_root or storage_root()
+    db = ProviderDatabase(root)
+    existing = db.get_provider(record.name)
+    if existing:
+        if record.api_key:
+            k = StoredKey(
+                id=uuid.uuid4().hex[:12],
+                label="Default",
+                encrypted_key=keychain.encrypt(record.api_key),
+            )
+            existing.keys.append(k)
+            if existing.active_key_id is None:
+                existing.active_key_id = k.id
+        existing.kind = record.kind
+        existing.base_url = record.base_url
+        existing.auth_method = record.auth_method
+        if record.default_model:
+            existing.default_model = record.default_model
+        db.save_provider(existing)
+    else:
+        sp = StoredProvider(
+            name=record.name, kind=record.kind, base_url=record.base_url,
+            default_model=record.default_model, auth_method=record.auth_method,
+        )
+        if record.api_key:
+            k = StoredKey(
+                id=uuid.uuid4().hex[:12],
+                label="Default",
+                encrypted_key=keychain.encrypt(record.api_key),
+            )
+            sp.keys.append(k)
+            sp.active_key_id = k.id
+        db.save_provider(sp)
+
+
 def _handle_providers(orchestrator: Orchestrator) -> None:
     store = _providers_store(orchestrator)
     persisted = store.list()
@@ -507,12 +553,28 @@ def _handle_connect(orchestrator: Orchestrator, arg: str) -> None:
     api_key = parts[3] if len(parts) > 3 else ""
     model = parts[4] if len(parts) > 4 else ""
     record = ProviderRecord(name=name, kind=kind, base_url=base_url, api_key=api_key, default_model=model)
+    if api_key:
+        ok, msg = validate_provider(record)
+        if not ok:
+            render.print_error(f"key validation failed: {msg}")
+            return
+        render.print_info(f"key validated: {msg}")
     try:
         provider = build_provider(record)
     except ValueError as exc:
         render.print_error(f"failed to build provider: {exc}")
         return
+    if not model and api_key:
+        try:
+            models = provider.fetch_models()
+        except Exception:
+            models = []
+        if models:
+            provider.default_model = models[0]
+            record.default_model = models[0]
+            render.print_info(f"auto-detected model: {models[0]}")
     _providers_store(orchestrator).save(record)
+    _save_to_database(orchestrator, record)
     if orchestrator.providers is not None:
         orchestrator.providers.register(name, provider)
     render.print_info(f"connected provider '{name}' ({kind}) → {base_url or '(default)'}")