@datename/fastcode-termux 0.1.6-beta → 0.1.6

package/src/cli.ts

@@ -12,9 +12,7 @@ import { loadConfig, saveConfig, resolveProviderKey } from "./config/store.js";
 import { getPaths } from "./config/paths.js";
 import { PROVIDERS, getProvider } from "./providers/index.js";
 import { collectDiagnostics, formatDiagnostics } from "./lib/diagnostics.js";
-import { existsSync } from "node:fs";
-import { latestSessionFile, listSessions, projectionPath, readSession, resolveSessionFile } from "./session/log.js";
-import { readProjection, sessionMetaFromFile } from "./session/projection.js";
+import { latestSessionFile, listSessions, readSession, resolveSessionFile } from "./session/log.js";
 import { listTrusted, trustProject, untrustProject } from "./config/trust.js";
 const NL = String.fromCharCode(10);
 const HELP = [
@@ -158,26 +156,13 @@ export async function parseCli(): Promise<any> {
             return { done: true };
         }
         if (rest[0] === "show") {
-            const idOrFile = rest[1] ?? all[0].id;
-            const entries = readSession(idOrFile);
+            const entries = readSession(rest[1] ?? all[0].id);
             for (const entry of entries) {
                 if (entry.type === "message")
                     console.log("[" + entry.role + "] " + entry.content);
-                else if (entry.type === "user" || entry.type === "assistant_raw")
-                    console.log("[" + entry.type + "] " + String(entry.content ?? "").slice(0, 300));
                 else
                     console.log("[" + entry.type + "]");
             }
-            const file = resolveSessionFile(idOrFile);
-            const projection = readProjection(file);
-            console.log("");
-            if (projection) {
-                console.log("[projection] " + projectionPath(file));
-                console.log("  messages: " + projection.messages.length + " · activeFiles: " + projection.activeFiles.length + " · lastFactSeq: " + projection.lastFactSeq);
-            }
-            else {
-                console.log("[projection] (none)");
-            }
             return { done: true };
         }
         console.log("Sessions (newest first):");
@@ -192,22 +177,10 @@ export async function parseCli(): Promise<any> {
     if (first === "resume") {
         const target = rest[0];
         const file = !target || target === "latest" ? latestSessionFile() : resolveSessionFile(target);
-        if (!file || !existsSync(file)) {
+        if (!file) {
             console.error("No saved session to resume. Start one with: fastcode");
             process.exit(1);
         }
-        const meta = sessionMetaFromFile(file);
-        if (meta.cwd) {
-            if (existsSync(meta.cwd)) {
-                process.chdir(meta.cwd);
-                console.log("Working directory: " + meta.cwd);
-            }
-            else {
-                console.log("Session directory no longer exists: " + meta.cwd + " (staying in " + process.cwd() + ")");
-            }
-        }
-        if (meta.providerId)
-            console.log("Session model: " + meta.providerId + "::" + meta.model);
         console.log("Resuming " + file);
         return { done: false, resume: file };
     }

package/src/commands/index.ts

@@ -7,7 +7,6 @@ import { clearCommand } from "./clear.js";
 import { exitCommand } from "./exit.js";
 import { modelCommand } from "./model.js";
 import { providerCommand } from "./provider.js";
-import { effortCommand } from "./effort.js";
 import { loginCommand } from "./login.js";
 import { logoutCommand } from "./logout.js";
 import { skillsCommand } from "./skills.js";
@@ -18,16 +17,6 @@ import { systemCommand } from "./system.js";
 import { aboutCommand } from "./about.js";
 import { configCommand } from "./config.js";
 import { whoamiCommand } from "./whoami.js";
-import { contextCommand } from "./context.js";
-import { jobsCommand } from "./jobs.js";
-import { killCommand } from "./kill.js";
-import { cancelCommand } from "./cancel.js";
-import { steerCommand } from "./steer.js";
-import { compactCommand } from "./compact.js";
-import { expandCommand } from "./expand.js";
-import { attachCommand } from "./attach.js";
-import { bgCommand } from "./bg.js";
-import { editCommand } from "./edit.js";
 export const COMMANDS = [
     helpCommand,
     agentCommand,
@@ -38,7 +27,6 @@ export const COMMANDS = [
     exitCommand,
     modelCommand,
     providerCommand,
-    effortCommand,
     loginCommand,
     logoutCommand,
     skillsCommand,
@@ -49,16 +37,6 @@ export const COMMANDS = [
     aboutCommand,
     configCommand,
     whoamiCommand,
-    contextCommand,
-    jobsCommand,
-    killCommand,
-    cancelCommand,
-    steerCommand,
-    compactCommand,
-    expandCommand,
-    attachCommand,
-    bgCommand,
-    editCommand,
 ];
 export function findCommand(name) {
     const lower = name.toLowerCase();

package/src/commands/login.ts

@@ -2,10 +2,8 @@ import { getProvider, PROVIDERS } from "../providers/index.js";
 import { maskKey, setCredential } from "../config/store.js";
 import { getPaths } from "../config/paths.js";
 /**
- * Save a provider-wide key and describe it for the terminal. `model` is kept
- * for the `/login provider model key` one-liner and only recorded as the
- * credential's origin — the key itself is reused by every model of that
- * provider. Shared by the `/login` command and the guided flow in the app.
+ * Save a key scoped to one provider + model and describe it for the terminal.
+ * Shared by the `/login` command and the guided flow in the app.
  */
 export function saveScopedKey(providerId, providerLabel, model, key) {
     const trimmed = key.trim();
@@ -14,16 +12,16 @@ export function saveScopedKey(providerId, providerLabel, model, key) {
     return [
         "Saved API key",
         `  provider  ${providerLabel} (${providerId})`,
-        `  scope     all ${providerId} models (saved from ${model || "unknown"})`,
+        `  model     ${model}`,
         `  key       ${maskKey(trimmed)}`,
         `  stored    ${paths.auth} (mode 0600)`,
         "",
-        `Remove with /logout ${providerId}`,
+        `Remove with /logout ${providerId} ${model}`,
     ].join("\n");
 }
 export const loginCommand = {
     name: "login",
-    description: "Bind a provider-wide API key. Usage: /login [provider] [model] [key]",
+    description: "Bind an API key to a provider + model. Usage: /login [provider] [model] [key]",
     run({ args, state, actions }) {
         if (args.length === 0) {
             actions.startLogin({});
@@ -38,12 +36,12 @@ export const loginCommand = {
         }
         if (args.length === 1) {
             actions.startLogin({ provider: provider.id });
-            return { message: `Provider: ${provider.label} (${provider.id}).\nThe key will apply to every model of this provider.` };
+            return { message: `Provider: ${provider.label} (${provider.id}).\nNow pick the model this key is for.` };
         }
         const model = args[1];
         if (args.length === 2) {
             actions.startLogin({ provider: provider.id, model });
-            return { message: `Provider: ${provider.id} · saved from model: ${model}.\nNow paste the API key (input is masked).` };
+            return { message: `Provider: ${provider.id} · model: ${model}.\nNow paste the API key (input is masked).` };
         }
         const key = args.slice(2).join(" ");
         return { message: saveScopedKey(provider.id, provider.label, model, key) };
@@ -52,11 +50,11 @@ export const loginCommand = {
 function introText(state) {
     const env = getProvider(state.providerId)?.authEnv?.[0] ?? "PROVIDER_API_KEY";
     return [
-        "Bind a provider-wide API key (reused by every model of that provider).",
+        "Bind an API key to a specific provider + model.",
         "",
-        `  current provider: ${state.providerId}`,
+        `  current scope: ${state.providerId} · ${state.model}`,
         "",
-        "FastCode will ask for the provider, then optionally a model name, then the key.",
+        "FastCode will ask for the provider, then the model, then the key.",
         "  one-liner:  /login <provider> <model> <key>",
         `  or set:     export ${env}=<key>   (provider-wide, any model)`,
     ].join("\n");

package/src/commands/logout.ts

@@ -8,11 +8,11 @@ export const logoutCommand = {
             const credentials = listCredentials();
             if (credentials.length === 0)
                 return { message: "No stored keys. Use /login to add one." };
-            const lines = ["Stored keys (provider-wide):"];
+            const lines = ["Stored keys (provider :: model):"];
             for (const c of credentials)
-                lines.push(`  ${c.provider}   ${maskKey(c.key)}`);
+                lines.push(`  ${c.provider}::${c.model}   ${maskKey(c.key)}`);
             lines.push("");
-            lines.push("Remove: /logout <provider>");
+            lines.push("Remove: /logout <provider> <model>");
             lines.push("        /logout <provider> --all");
             return { message: lines.join("\n") };
         }
@@ -29,17 +29,25 @@ export const logoutCommand = {
             };
         }
         if (args.length >= 2) {
-            const ok = removeCredential(provider.id);
+            const model = args[1];
+            const ok = removeCredential(provider.id, model);
             return {
                 message: ok
-                    ? `Removed the stored key for ${provider.id} (applies to all its models).`
-                    : `No stored key for ${provider.id}.`,
+                    ? `Removed stored key for ${provider.id}::${model}.`
+                    : `No stored key for ${provider.id}::${model}.`,
             };
         }
         const forProvider = listCredentials().filter((c) => c.provider === provider.id);
         if (forProvider.length === 0)
             return { message: `No stored key for ${provider.label}.` };
-        removeCredential(provider.id);
-        return { message: `Removed the stored key for ${provider.label} (all models).` };
+        if (forProvider.length === 1) {
+            removeCredential(forProvider[0].provider, forProvider[0].model);
+            return { message: `Removed stored key for ${forProvider[0].provider}::${forProvider[0].model}.` };
+        }
+        const lines = [`${provider.label} has ${forProvider.length} stored keys — pick one to remove:`];
+        for (const c of forProvider)
+            lines.push(`  /logout ${c.provider} ${c.model}   (${maskKey(c.key)})`);
+        lines.push(`  /logout ${provider.id} --all   (remove all)`);
+        return { message: lines.join("\n") };
     },
 };

package/src/commands/model.ts

@@ -1,50 +1,30 @@
-import { getProviderOrThrow, probeProvider } from "../providers/index.js";
+import { getProviderOrThrow } from "../providers/index.js";
 import { resolveProviderKey } from "../config/store.js";
 export const modelCommand = {
     name: "model",
-    description: "Pick a model interactively, or switch with /model <id>",
+    description: "List models for the current provider, or switch model. Usage: /model [id]",
     async run({ args, state, actions }) {
         const provider = getProviderOrThrow(state.providerId);
-        if (args.length > 0) {
-            const id = args.join(" ");
-            actions.setModel(id);
-            return { message: `Model set to ${id}.` };
+        if (args.length === 0) {
+            const { key } = resolveProviderKey(provider.id, provider.authEnv);
+            const models = await provider.listModels(key);
+            if (models.length === 0) {
+                return { message: `No models available from ${provider.label}.` };
+            }
+            const lines = [`Models for ${provider.label}:`];
+            for (const m of models.slice(0, 50)) {
+                const marker = m.id === state.model ? "● " : "  ";
+                const label = m.label ? ` — ${m.label}` : "";
+                lines.push(`${marker}${m.id}${label}`);
+            }
+            if (models.length > 50)
+                lines.push(`  … and ${models.length - 50} more.`);
+            lines.push("");
+            lines.push("Switch with `/model <id>`.");
+            return { message: lines.join("\n") };
         }
-        const { key } = resolveProviderKey(provider.id, provider.authEnv);
-        const fetched = await provider.listModels(key).catch(() => []);
-        const models = dedupe(fetched);
-        if (models.length === 0) {
-            return { message: `No models available from ${provider.label}.` };
-        }
-        const online = await probeProvider(provider, key);
-        const list = models.slice(0, 50);
-        return {
-            message: `Models for ${provider.label}: ${list.length}${online ? "" : " (offline — showing the built-in list)"}.\n` +
-                "Use ↑/↓, a number, or Enter to select.",
-            picker: {
-                title: `Select model · ${provider.label}${online ? "" : " (offline)"}`,
-                current: state.model,
-                items: list.map((m) => ({
-                    value: m.id,
-                    label: m.id,
-                    hint: m.label ? `— ${m.label}` : undefined,
-                })),
-                onSelect: (id) => {
-                    actions.setModel(id);
-                    actions.pushSystemMessage(`Model set to ${id}.`);
-                },
-            },
-        };
+        const id = args.join(" ");
+        actions.setModel(id);
+        return { message: `Model set to ${id}.` };
     },
 };
-function dedupe(models) {
-    const seen = new Set();
-    const out = [];
-    for (const model of models) {
-        if (!model?.id || seen.has(model.id))
-            continue;
-        seen.add(model.id);
-        out.push(model);
-    }
-    return out;
-}

package/src/commands/provider.ts

@@ -4,26 +4,15 @@ export const providerCommand = {
     description: "List or switch the active LLM provider. Usage: /provider [id]",
     run({ args, actions, state }) {
         if (args.length === 0) {
-            return {
-                message: "Select a provider (↑/↓ or a number, Enter to confirm).",
-                picker: {
-                    title: "Select provider",
-                    current: state.providerId,
-                    items: PROVIDERS.map((p) => ({
-                        value: p.id,
-                        label: `${p.id.padEnd(12)} ${p.label}`,
-                        hint: p.authEnv.length === 0 ? "(no key needed)" : `[${p.authEnv.join(", ")}]`,
-                    })),
-                    onSelect: (id) => {
-                        const next = getProvider(id);
-                        if (!next)
-                            return;
-                        actions.setProvider(next.id);
-                        actions.setModel(next.defaultModel);
-                        actions.pushSystemMessage(`Provider set to ${next.label}. Default model: ${next.defaultModel}.`);
-                    },
-                },
-            };
+            const lines = ["Available providers:"];
+            for (const p of PROVIDERS) {
+                const marker = p.id === state.providerId ? "● " : "  ";
+                const auth = p.authEnv.length === 0 ? "(no key needed)" : `[${p.authEnv.join(", ")}]`;
+                lines.push(`${marker}${p.id.padEnd(12)} ${p.label}  ${auth}`);
+            }
+            lines.push("");
+            lines.push("Switch with `/provider <id>` (e.g. `/provider openrouter`).");
+            return { message: lines.join("\n") };
         }
         const target = args[0];
         const next = getProvider(target);

package/src/commands/whoami.ts

@@ -10,20 +10,19 @@ export const whoamiCommand = {
             lines.push("  " + describeLookup(current, resolveApiKey(current.id, state.model, current.authEnv)));
         const credentials = listCredentials();
         lines.push("");
-        lines.push(`Stored keys (${credentials.length}, provider-wide):`);
+        lines.push(`Stored keys (${credentials.length}):`);
         if (credentials.length === 0)
             lines.push("  (none) — add one with /login");
         for (const c of credentials) {
-            const marker = c.provider === state.providerId ? "● " : "  ";
-            const origin = c.model ? `   (originally saved for ${c.model})` : "";
-            lines.push(`${marker}${c.provider}   ${maskKey(c.key)}${origin}`);
+            const marker = c.provider === state.providerId && c.model === state.model ? "● " : "  ";
+            lines.push(`${marker}${c.provider}::${c.model}   ${maskKey(c.key)}`);
         }
         const legacy = listLegacy();
         if (legacy.length > 0) {
             lines.push("");
-            lines.push("Legacy keys (could not be migrated — re-save with /login):");
+            lines.push("Unbound legacy keys (NOT used — re-bind them to a model):");
             for (const l of legacy)
-                lines.push(`  ${l.provider}   ${maskKey(l.key)}`);
+                lines.push(`  ${l.provider}   ${maskKey(l.key)}   → /login ${l.provider} <model> <key>`);
         }
         const envLines = [];
         for (const p of PROVIDERS) {

package/src/config/store.ts

@@ -5,12 +5,14 @@
  * edit it from `nano ~/.fastcode/config.json` if needed. Atomic writes prevent
  * partial files on Ctrl+C.
  *
- * API keys are scoped to a provider, not to a model. auth.json stores one
- * credential per provider id, so switching between models of the same provider
- * reuses the same key. The old "provider::model" (v2) and provider-only (v1)
- * formats are read and migrated to the provider-scoped v3 layout on first load.
+ * API keys are NOT a single global string: each one is scoped to a concrete
+ * "provider + model" pair. auth.json stores one credential per
+ * `<provider>::<model>` scope, and a stored key is only used when the current
+ * provider AND model match that scope. The old provider-only format is read as
+ * "legacy": it is shown back to the user but never used silently, because a
+ * provider-only key does not tell us which model it was meant for.
  */
-import { readFileSync, writeFileSync, existsSync, renameSync, copyFileSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, renameSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { getPaths, lockdown, ensureDir } from "./paths.js";
 import { DEFAULT_THEME } from "./themes.js";
@@ -27,40 +29,20 @@ export const DEFAULT_CONFIG = {
     enabledPlugins: [],
     skillsRegistry: "https://skillshub.wtf",
     lifetimeCostUsd: 0,
-    /**
-     * Extra directories the file tools may read and write outside the project
-     * root. Relative entries are resolved against the project root; `~/` is
-     * expanded against the user's home directory.
-     */
-    sharedDirs: [],
-    /** Maximum agent tool turns before the loop asks the user to continue. */
-    maxAgentTurns: 24,
-    /** Abort a stream that receives no data for this long (ms). */
-    requestIdleTimeoutMs: 60_000,
-    /** Approximate character budget before history compaction kicks in. */
-    contextBudgetChars: 400_000,
-    /** Thinking depth: auto = send nothing, provider default. */
-    reasoningEffort: "auto",
-    /** Cached per-provider/model capabilities (native vs pseudo tool calling). */
-    capabilities: {
-        toolCalling: {},
-    },
 };
 export interface StoredCredential {
     provider: string;
-    /** Model the key was originally saved for (display only; keys are provider-wide). */
-    model?: string;
+    model: string;
     key: string;
     addedAt: string;
 }
 export interface AuthStore {
     version: number;
-    /** Provider-scoped credentials, keyed by provider id. */
+    /** Scoped credentials, keyed by `provider::model`. */
     keys: Record<string, StoredCredential>;
-    /** Old provider-only keys that could not be migrated (kept for diagnostics). */
+    /** Old provider-only keys we refuse to use until the user re-binds them. */
     legacy: Record<string, string>;
 }
-export const AUTH_VERSION = 3;
 export type KeyLookup = {
     status: "ok";
     key: string;
@@ -89,97 +71,58 @@ export function saveConfig(cfg) {
     const { config } = getPaths();
     atomicWrite(config, JSON.stringify(cfg, null, 2));
 }
-/** Composite id used by the legacy v2 format; kept for API compatibility. */
+/** Composite scope id for a provider + model credential. */
 export function scopeId(providerId, model) {
     return `${providerId}::${model}`;
 }
-/** Pick the most recently saved credential when several legacy scopes map to one provider. */
-function keepNewest(keys, credential) {
-    const existing = keys[credential.provider];
-    if (!existing) {
-        keys[credential.provider] = credential;
-        return;
-    }
-    const previous = Date.parse(existing.addedAt || "") || 0;
-    const next = Date.parse(credential.addedAt || "") || 0;
-    if (next > previous)
-        keys[credential.provider] = credential;
-}
-let migrationChecked = false;
 export function loadAuth(): AuthStore {
     const { auth } = getPaths();
-    const empty: AuthStore = { version: AUTH_VERSION, keys: {}, legacy: {} };
+    const empty: AuthStore = { version: 2, keys: {}, legacy: {} };
     if (!existsSync(auth))
         return empty;
-    let raw: any;
     try {
-        raw = JSON.parse(readFileSync(auth, "utf8"));
-    }
-    catch {
-        return empty;
-    }
-    if (!raw || typeof raw !== "object")
-        return empty;
-    const keys: Record<string, StoredCredential> = {};
-    const legacy: Record<string, string> = {};
-    let migrated = false;
-    const source = raw.keys && typeof raw.keys === "object" ? raw.keys : {};
-    for (const [id, value] of Object.entries<any>(source)) {
-        if (value && typeof value === "object" && typeof value.key === "string" && value.key.trim()) {
-            const [idProvider, idModel] = id.split("::");
-            const provider = typeof value.provider === "string" && value.provider ? value.provider : idProvider || id;
-            const model = typeof value.model === "string" ? value.model : idModel || "";
-            if (id.includes("::") || raw.version !== AUTH_VERSION)
-                migrated = true;
-            keepNewest(keys, {
-                provider,
-                model,
-                key: value.key,
-                addedAt: typeof value.addedAt === "string" ? value.addedAt : "",
-            });
-        }
-        else if (typeof value === "string" && value.trim()) {
-            // v1: keys were plain provider -> key strings.
-            keepNewest(keys, { provider: id, key: value, addedAt: "" });
-            migrated = true;
+        const raw = JSON.parse(readFileSync(auth, "utf8"));
+        const keys: Record<string, StoredCredential> = {};
+        const legacy: Record<string, string> = {};
+        const source = raw && typeof raw === "object" ? (raw.keys ?? {}) : {};
+        for (const [id, value] of Object.entries<any>(source)) {
+            if (value && typeof value === "object" && typeof value.key === "string") {
+                const [idProvider, idModel] = id.split("::");
+                const provider = value.provider || idProvider || id;
+                const model = value.model || idModel || "";
+                keys[scopeId(provider, model)] = {
+                    provider,
+                    model,
+                    key: value.key,
+                    addedAt: value.addedAt ?? "",
+                };
+            }
+            else if (typeof value === "string" && value.trim()) {
+                legacy[id] = value;
+            }
         }
-    }
-    if (raw.legacy && typeof raw.legacy === "object") {
-        for (const [provider, value] of Object.entries<any>(raw.legacy)) {
-            if (typeof value === "string" && value.trim()) {
-                // Provider-only keys are exactly what v3 wants: migrate instead
-                // of leaving them unusable.
-                keepNewest(keys, { provider, key: value, addedAt: "" });
-                migrated = true;
+        if (raw && typeof raw === "object" && raw.legacy && typeof raw.legacy === "object") {
+            for (const [id, value] of Object.entries<any>(raw.legacy)) {
+                if (typeof value === "string" && value.trim())
+                    legacy[id] = value;
             }
         }
+        return { version: 2, keys, legacy };
     }
-    if (migrated && !migrationChecked) {
-        try {
-            // Keep the pre-migration file so a user with several old model
-            // keys can recover a credential we had to collapse.
-            const backup = auth + ".v2.bak";
-            if (!existsSync(backup))
-                copyFileSync(auth, backup);
-            writeAuth({ version: AUTH_VERSION, keys, legacy });
-        }
-        catch {
-            // Read-only home (or locked file): keep the migrated view in memory.
-        }
+    catch {
+        return empty;
     }
-    migrationChecked = true;
-    return { version: AUTH_VERSION, keys, legacy };
 }
-function writeAuth(store: AuthStore) {
+export function saveAuth(store: AuthStore) {
     const { auth } = getPaths();
-    atomicWrite(auth, JSON.stringify({ version: AUTH_VERSION, keys: store.keys }, null, 2));
+    const payload: any = { version: 2, keys: store.keys };
+    if (Object.keys(store.legacy).length > 0)
+        payload.legacy = store.legacy;
+    atomicWrite(auth, JSON.stringify(payload, null, 2));
     lockdown(auth);
 }
-export function saveAuth(store: AuthStore) {
-    writeAuth(store);
-}
-export function getCredential(providerId, _model?): StoredCredential | undefined {
-    return loadAuth().keys[providerId];
+export function getCredential(providerId, model): StoredCredential | undefined {
+    return loadAuth().keys[scopeId(providerId, model)];
 }
 export function listCredentials(): StoredCredential[] {
     return Object.values(loadAuth().keys);
@@ -193,35 +136,38 @@ export function listLegacy(): Array<{
 export function getLegacy(providerId): string | undefined {
     return loadAuth().legacy[providerId];
 }
-/** Save/replace the provider-wide credential (drops any legacy key). */
+/** Save/replace the credential for one provider+model scope (drops the legacy key). */
 export function setCredential(providerId, model, key): StoredCredential {
     const store = loadAuth();
-    const credential: StoredCredential = {
+    const credential = {
         provider: providerId,
         model,
         key: key.trim(),
         addedAt: new Date().toISOString(),
     };
-    store.keys[providerId] = credential;
+    store.keys[scopeId(providerId, model)] = credential;
     delete store.legacy[providerId];
     saveAuth(store);
     return credential;
 }
-export function removeCredential(providerId, _model?): boolean {
+export function removeCredential(providerId, model): boolean {
     const store = loadAuth();
-    if (!store.keys[providerId])
+    const id = scopeId(providerId, model);
+    if (!store.keys[id])
         return false;
-    delete store.keys[providerId];
+    delete store.keys[id];
     saveAuth(store);
     return true;
 }
-/** Remove the provider-wide credential plus any legacy leftovers. */
+/** Remove every credential for a provider (all models) plus its legacy key. */
 export function removeCredentialsForProvider(providerId): number {
     const store = loadAuth();
     let removed = 0;
-    if (store.keys[providerId]) {
-        delete store.keys[providerId];
-        removed += 1;
+    for (const id of Object.keys(store.keys)) {
+        if (store.keys[id].provider === providerId) {
+            delete store.keys[id];
+            removed += 1;
+        }
     }
     if (store.legacy[providerId]) {
         delete store.legacy[providerId];
@@ -241,16 +187,16 @@ export function maskKey(key) {
     return value.slice(0, 3) + "****" + value.slice(-4);
 }
 /**
- * Resolve the key to use for a provider:
- *   1. the provider-wide credential in auth.json,
+ * Resolve the key to use for a specific provider+model:
+ *   1. the scoped credential in auth.json (exact provider+model match), then
  *   2. the provider's environment variable (provider-scoped, any model), and
- *   3. a legacy provider-only key that somehow escaped migration.
+ *   3. report an "unbound" legacy key instead of using it silently.
  */
-export function resolveApiKey(providerId, _model, envVars): KeyLookup {
+export function resolveApiKey(providerId, model, envVars): KeyLookup {
     const store = loadAuth();
-    const credential = store.keys[providerId];
-    if (credential && credential.key)
-        return { status: "ok", key: credential.key, source: "file" };
+    const scoped = store.keys[scopeId(providerId, model)];
+    if (scoped && scoped.key)
+        return { status: "ok", key: scoped.key, source: "file" };
     for (const envVar of envVars ?? []) {
         const value = process.env[envVar];
         if (value && value.trim())
@@ -267,9 +213,10 @@ export function resolveProviderKey(providerId, envVars): {
     envVar?: string;
 } {
     const store = loadAuth();
-    const credential = store.keys[providerId];
-    if (credential && credential.key)
-        return { key: credential.key, source: "file" };
+    for (const credential of Object.values(store.keys)) {
+        if (credential.provider === providerId && credential.key)
+            return { key: credential.key, source: "file" };
+    }
     for (const envVar of envVars ?? []) {
         const value = process.env[envVar];
         if (value && value.trim())