@datename/fastcode-termux 0.1.6 → 0.1.8-beta.0

package/dist/commands/provider.js

@@ -1,18 +1,11 @@
-import { PROVIDERS, getProvider } from "../providers/index.js";
+import { getProvider } from "../providers/index.js";
 export const providerCommand = {
     name: "provider",
     description: "List or switch the active LLM provider. Usage: /provider [id]",
-    run({ args, actions, state }) {
+    run({ args, actions }) {
         if (args.length === 0) {
-            const lines = ["Available providers:"];
-            for (const p of PROVIDERS) {
-                const marker = p.id === state.providerId ? "● " : "  ";
-                const auth = p.authEnv.length === 0 ? "(no key needed)" : `[${p.authEnv.join(", ")}]`;
-                lines.push(`${marker}${p.id.padEnd(12)} ${p.label}  ${auth}`);
-            }
-            lines.push("");
-            lines.push("Switch with `/provider <id>` (e.g. `/provider openrouter`).");
-            return { message: lines.join("\n") };
+            actions.startLogin({ flow: "provider" });
+            return { message: "Configure a provider: choose a provider and model, then enter its API key." };
         }
         const target = args[0];
         const next = getProvider(target);

package/dist/commands/skills.js

@@ -1,4 +1,4 @@
-import { installSkill, uninstallSkill, listInstalledSkills, searchRegistry, getSkill, } from "../skills/manager.js";
+import { installSkill, uninstallSkill, listInstalledSkills, searchRegistry, getSkill, rebaselineSkills, resolveRegistry, } from "../skills/manager.js";
 export const skillsCommand = {
     name: "skills",
     description: "Manage Agent Skills (download from skills.sh and toggle).",
@@ -17,15 +17,20 @@ export const skillsCommand = {
                 const enabled = state.enabledSkills.includes(s.name) ? "● " : "  ";
                 lines.push(`${enabled}${s.name}  — ${truncate(s.description, 80)}`);
                 lines.push(`    source: ${s.source}`);
+                if (s.integrity !== "ok")
+                    lines.push(`    integrity: ${s.integrity === "drift" ? "DRIFT (disabled; run /skills verify " + s.name + " --confirm)" : "unverified (run /skills verify " + s.name + " --confirm)"}`);
             }
             lines.push("");
             lines.push("Toggle with `/skills enable <name>` or `/skills disable <name>`.");
             return { message: lines.join("\n") };
         }
         if (sub === "search") {
+            const registry = resolveRegistry(process.env["FASTCODE_SKILLS_REGISTRY"], state.skillsRegistry);
+            if (!registry)
+                return { message: "No skills registry configured. Set one with `/skills registry <url>` or FASTCODE_SKILLS_REGISTRY." };
             if (rest.length === 0)
                 return { message: "Usage: /skills search <query>" };
-            const hits = await searchRegistry(rest.join(" "), state.skillsRegistry);
+            const hits = await searchRegistry(rest.join(" "), registry);
             if (hits.length === 0) {
                 return { message: `No skills found for "${rest.join(" ")}".` };
             }
@@ -66,6 +71,10 @@ export const skillsCommand = {
             const skill = getSkill(rest[0]);
             if (!skill)
                 return { message: `Skill "${rest[0]}" is not installed.` };
+            if (skill.integrity !== "ok") {
+                const reason = skill.integrity === "drift" ? "content drift detected" : "no integrity baseline";
+                return { message: `Skill "${skill.name}" is disabled (${reason}). Run /skills verify ${skill.name} --confirm to re-baseline.` };
+            }
             actions.enableSkill(skill.name);
             return { message: `Enabled skill "${skill.name}".` };
         }
@@ -84,9 +93,30 @@ export const skillsCommand = {
             const head = `# ${skill.name}\n_${skill.description}_\n\nSource: ${skill.source}\n\n---\n\n`;
             return { message: head + skill.body };
         }
+        if (sub === "verify") {
+            const confirm = rest.includes("--confirm") || rest.includes("--yes");
+            const all = rest.includes("--all");
+            const names = rest.filter((entry) => !entry.startsWith("-"));
+            if (!all && names.length === 0)
+                return { message: "Usage: /skills verify <name> --confirm   (or /skills verify --all --confirm)" };
+            if (!confirm) {
+                return { message: `Re-baselining ${all ? "all skills" : names.join(", ")} trusts the current files as the new baseline. ` +
+                        "Re-run the same command with --confirm to proceed." };
+            }
+            const results = rebaselineSkills(all ? undefined : names);
+            if (results.length === 0)
+                return { message: "No matching installed skills to verify." };
+            const lines = ["Skill integrity re-baselined:"];
+            for (const result of results)
+                lines.push(result.ok ? `  • ${result.name}: locked` : `  • ${result.name}: FAILED — ${result.warning ?? "unknown error"}`);
+            return { message: lines.join("\n") };
+        }
         if (sub === "registry") {
             if (rest.length === 0) {
-                return { message: `Skills registry: ${state.skillsRegistry}` };
+                const registry = resolveRegistry(process.env["FASTCODE_SKILLS_REGISTRY"], state.skillsRegistry);
+                return { message: registry
+                        ? `Skills registry: ${registry}`
+                        : "No skills registry configured. Set one with `/skills registry <url>` or FASTCODE_SKILLS_REGISTRY." };
             }
             // Mutate via AppActions so the in-memory React state stays in sync —
             // direct saveConfig() would be silently overwritten by the next state
@@ -95,7 +125,7 @@ export const skillsCommand = {
             return { message: `Skills registry set to ${rest[0]}.` };
         }
         return {
-            message: "Unknown subcommand. Try: list, search, install, uninstall, enable, disable, info, registry.",
+            message: "Unknown subcommand. Try: list, search, install, uninstall, enable, disable, info, verify, registry.",
         };
     },
 };

package/dist/commands/steer.d.ts

@@ -0,0 +1,11 @@
+export declare const steerCommand: {
+    name: string;
+    description: string;
+    run({ args, state, actions }: {
+        args: any;
+        state: any;
+        actions: any;
+    }): {
+        message: string;
+    };
+};

package/dist/commands/steer.js

@@ -0,0 +1,13 @@
+export const steerCommand = {
+    name: "steer",
+    description: "Add guidance to the next request of an active run (/steer <text>)",
+    run({ args, state, actions }) {
+        const text = args.join(" ").trim();
+        if (!text)
+            return { message: "Usage: /steer <guidance>" };
+        if (!state.busy)
+            return { message: "No active run. Just send the guidance as the next message." };
+        actions.steer(text);
+        return { message: "Steering queued for the next request." };
+    },
+};

package/dist/commands/threads.d.ts

@@ -0,0 +1,9 @@
+import type { CommandContext } from "../types.js";
+export declare const threadsCommand: {
+    name: string;
+    aliases: string[];
+    description: string;
+    run({ args, actions }: CommandContext): {
+        message: string;
+    };
+};

package/dist/commands/threads.js

@@ -0,0 +1,26 @@
+import { DEFAULT_SHELL_POOL_SIZE, MAX_SHELL_POOL_SIZE, shellPoolSize } from "../agent/shell-session.js";
+export const threadsCommand = {
+    name: "threads",
+    aliases: ["pool"],
+    description: `Show or set resident shell concurrency (default ${DEFAULT_SHELL_POOL_SIZE}, max ${MAX_SHELL_POOL_SIZE}). Usage: /threads [1-${MAX_SHELL_POOL_SIZE}]`,
+    run({ args, actions }) {
+        const before = shellPoolSize();
+        if (args.length === 0) {
+            return {
+                message: `Shell concurrency: ${before} resident slot(s) (default ${DEFAULT_SHELL_POOL_SIZE}, max ${MAX_SHELL_POOL_SIZE}). ` +
+                    `Usage: /threads <1-${MAX_SHELL_POOL_SIZE}>.`,
+            };
+        }
+        const requested = Number(args[0]);
+        if (!Number.isFinite(requested)) {
+            return { message: `Invalid thread count "${args[0]}". Use /threads <1-${MAX_SHELL_POOL_SIZE}>.` };
+        }
+        actions.setShellPoolSize(requested);
+        const applied = shellPoolSize();
+        const clamped = applied !== Math.floor(requested) ? " (clamped)" : "";
+        return {
+            message: `Shell concurrency: ${before} → ${applied}${clamped} (default ${DEFAULT_SHELL_POOL_SIZE}, max ${MAX_SHELL_POOL_SIZE}). ` +
+                "Running jobs keep their slots.",
+        };
+    },
+};

package/dist/commands/whoami.js

@@ -10,19 +10,20 @@ export const whoamiCommand = {
             lines.push("  " + describeLookup(current, resolveApiKey(current.id, state.model, current.authEnv)));
         const credentials = listCredentials();
         lines.push("");
-        lines.push(`Stored keys (${credentials.length}):`);
+        lines.push(`Stored keys (${credentials.length}, provider-wide):`);
         if (credentials.length === 0)
             lines.push("  (none) — add one with /login");
         for (const c of credentials) {
-            const marker = c.provider === state.providerId && c.model === state.model ? "● " : "  ";
-            lines.push(`${marker}${c.provider}::${c.model}   ${maskKey(c.key)}`);
+            const marker = c.provider === state.providerId ? "● " : "  ";
+            const origin = c.model ? `   (originally saved for ${c.model})` : "";
+            lines.push(`${marker}${c.provider}   ${maskKey(c.key)}${origin}`);
         }
         const legacy = listLegacy();
         if (legacy.length > 0) {
             lines.push("");
-            lines.push("Unbound legacy keys (NOT used — re-bind them to a model):");
+            lines.push("Legacy keys (could not be migrated — re-save with /login):");
             for (const l of legacy)
-                lines.push(`  ${l.provider}   ${maskKey(l.key)}   → /login ${l.provider} <model> <key>`);
+                lines.push(`  ${l.provider}   ${maskKey(l.key)}`);
         }
         const envLines = [];
         for (const p of PROVIDERS) {

package/dist/config/store.d.ts

@@ -8,20 +8,55 @@ export declare const DEFAULT_CONFIG: {
     enabledPlugins: any[];
     skillsRegistry: string;
     lifetimeCostUsd: number;
+    /**
+     * Extra directories the file tools may read and write outside the project
+     * root. Relative entries are resolved against the project root; `~/` is
+     * expanded against the user's home directory.
+     */
+    sharedDirs: any[];
+    /** Maximum agent tool turns before the loop asks the user to continue. */
+    maxAgentTurns: number;
+    /** Abort a stream that receives no data for this long (ms). */
+    requestIdleTimeoutMs: number;
+    /** Approximate character budget before history compaction kicks in. */
+    contextBudgetChars: number;
+    /** Thinking depth: auto = send nothing, provider default. */
+    reasoningEffort: string;
+    /** Resident shell concurrency: safe default 2, max 6. `/threads` changes it. */
+    shellPoolSize: number;
+    /** Cached per-provider/model capabilities (native vs pseudo tool calling). */
+    capabilities: {
+        toolCalling: {};
+    };
+    /**
+     * Application-layer egress policy. Default is audit-only; set
+     * enabled:true + mode:"block" to enforce. See docs/CONFIGURATION.md.
+     */
+    egress: {
+        enabled: boolean;
+        mode: import("../agent/policy/defaults.js").EgressMode;
+        denyPaths: string[];
+        denyGlobs: string[];
+        denyContentMarkers: string[];
+        maxScanBytes: number;
+        scanToolOutput: boolean;
+    };
 };
 export interface StoredCredential {
     provider: string;
-    model: string;
+    /** Model the key was originally saved for (display only; keys are provider-wide). */
+    model?: string;
     key: string;
     addedAt: string;
 }
 export interface AuthStore {
     version: number;
-    /** Scoped credentials, keyed by `provider::model`. */
+    /** Provider-scoped credentials, keyed by provider id. */
     keys: Record<string, StoredCredential>;
-    /** Old provider-only keys we refuse to use until the user re-binds them. */
+    /** Old provider-only keys that could not be migrated (kept for diagnostics). */
     legacy: Record<string, string>;
 }
+export declare const AUTH_VERSION = 3;
 export type KeyLookup = {
     status: "ok";
     key: string;
@@ -34,33 +69,39 @@ export type KeyLookup = {
 } | {
     status: "missing";
 };
+/** Drop the cached config so the next loadConfig() re-stats and re-reads. */
+export declare function invalidateConfigCache(): void;
+export declare function configCacheStatus(): {
+    cached: boolean;
+    fingerprint?: string;
+};
 export declare function loadConfig(): any;
 export declare function saveConfig(cfg: any): void;
-/** Composite scope id for a provider + model credential. */
+/** Composite id used by the legacy v2 format; kept for API compatibility. */
 export declare function scopeId(providerId: any, model: any): string;
 export declare function loadAuth(): AuthStore;
 export declare function saveAuth(store: AuthStore): void;
-export declare function getCredential(providerId: any, model: any): StoredCredential | undefined;
+export declare function getCredential(providerId: any, _model?: any): StoredCredential | undefined;
 export declare function listCredentials(): StoredCredential[];
 export declare function listLegacy(): Array<{
     provider: string;
     key: string;
 }>;
 export declare function getLegacy(providerId: any): string | undefined;
-/** Save/replace the credential for one provider+model scope (drops the legacy key). */
+/** Save/replace the provider-wide credential (drops any legacy key). */
 export declare function setCredential(providerId: any, model: any, key: any): StoredCredential;
-export declare function removeCredential(providerId: any, model: any): boolean;
-/** Remove every credential for a provider (all models) plus its legacy key. */
+export declare function removeCredential(providerId: any, _model?: any): boolean;
+/** Remove the provider-wide credential plus any legacy leftovers. */
 export declare function removeCredentialsForProvider(providerId: any): number;
 /** Turn a key into a safe terminal echo: `sk-****abcd`. */
 export declare function maskKey(key: any): string;
 /**
- * Resolve the key to use for a specific provider+model:
- *   1. the scoped credential in auth.json (exact provider+model match), then
+ * Resolve the key to use for a provider:
+ *   1. the provider-wide credential in auth.json,
  *   2. the provider's environment variable (provider-scoped, any model), and
- *   3. report an "unbound" legacy key instead of using it silently.
+ *   3. a legacy provider-only key that somehow escaped migration.
  */
-export declare function resolveApiKey(providerId: any, model: any, envVars: any): KeyLookup;
+export declare function resolveApiKey(providerId: any, _model: any, envVars: any): KeyLookup;
 /** Best-effort key for a provider regardless of model (used to list models). */
 export declare function resolveProviderKey(providerId: any, envVars: any): {
     key?: string;

package/dist/config/store.js

@@ -5,17 +5,16 @@
  * edit it from `nano ~/.fastcode/config.json` if needed. Atomic writes prevent
  * partial files on Ctrl+C.
  *
- * API keys are NOT a single global string: each one is scoped to a concrete
- * "provider + model" pair. auth.json stores one credential per
- * `<provider>::<model>` scope, and a stored key is only used when the current
- * provider AND model match that scope. The old provider-only format is read as
- * "legacy": it is shown back to the user but never used silently, because a
- * provider-only key does not tell us which model it was meant for.
+ * API keys are scoped to a provider, not to a model. auth.json stores one
+ * credential per provider id, so switching between models of the same provider
+ * reuses the same key. The old "provider::model" (v2) and provider-only (v1)
+ * formats are read and migrated to the provider-scoped v3 layout on first load.
  */
-import { readFileSync, writeFileSync, existsSync, renameSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, renameSync, copyFileSync, statSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { getPaths, lockdown, ensureDir } from "./paths.js";
 import { DEFAULT_THEME } from "./themes.js";
+import { DEFAULT_EGRESS_CONFIG } from "../agent/policy/defaults.js";
 export const DEFAULT_CONFIG = {
     providerId: "anthropic",
     model: "claude-sonnet-5.5",
@@ -27,77 +26,172 @@ export const DEFAULT_CONFIG = {
         "or unified diffs the user can apply.",
     enabledSkills: [],
     enabledPlugins: [],
-    skillsRegistry: "https://skillshub.wtf",
+    skillsRegistry: "",
     lifetimeCostUsd: 0,
+    /**
+     * Extra directories the file tools may read and write outside the project
+     * root. Relative entries are resolved against the project root; `~/` is
+     * expanded against the user's home directory.
+     */
+    sharedDirs: [],
+    /** Maximum agent tool turns before the loop asks the user to continue. */
+    maxAgentTurns: 24,
+    /** Abort a stream that receives no data for this long (ms). */
+    requestIdleTimeoutMs: 60_000,
+    /** Approximate character budget before history compaction kicks in. */
+    contextBudgetChars: 400_000,
+    /** Thinking depth: auto = send nothing, provider default. */
+    reasoningEffort: "auto",
+    /** Resident shell concurrency: safe default 2, max 6. `/threads` changes it. */
+    shellPoolSize: 2,
+    /** Cached per-provider/model capabilities (native vs pseudo tool calling). */
+    capabilities: {
+        toolCalling: {},
+    },
+    /**
+     * Application-layer egress policy. Default is audit-only; set
+     * enabled:true + mode:"block" to enforce. See docs/CONFIGURATION.md.
+     */
+    egress: { ...DEFAULT_EGRESS_CONFIG },
 };
-export function loadConfig() {
-    const { config } = getPaths();
-    if (!existsSync(config))
-        return { ...DEFAULT_CONFIG };
+export const AUTH_VERSION = 3;
+let configCache;
+function configFingerprint(file) {
     try {
-        const raw = JSON.parse(readFileSync(config, "utf8"));
-        return { ...DEFAULT_CONFIG, ...raw };
+        const info = statSync(file);
+        // mtime + size are required; ctime adds resilience on filesystems with
+        // coarse mtime resolution. stat() is much cheaper than a full read on
+        // Termux shared storage.
+        return `${info.mtimeMs}:${info.size}:${info.ctimeMs}`;
     }
     catch {
-        return { ...DEFAULT_CONFIG };
+        return "missing";
+    }
+}
+/** Drop the cached config so the next loadConfig() re-stats and re-reads. */
+export function invalidateConfigCache() {
+    configCache = undefined;
+}
+export function configCacheStatus() {
+    return configCache ? { cached: true, fingerprint: configCache.fingerprint } : { cached: false };
+}
+export function loadConfig() {
+    const { config } = getPaths();
+    const fingerprint = configFingerprint(config);
+    if (configCache && configCache.path === config && configCache.fingerprint === fingerprint)
+        return { ...configCache.value };
+    let value;
+    if (!existsSync(config)) {
+        value = { ...DEFAULT_CONFIG };
     }
+    else {
+        try {
+            const raw = JSON.parse(readFileSync(config, "utf8"));
+            value = { ...DEFAULT_CONFIG, ...raw };
+        }
+        catch {
+            value = { ...DEFAULT_CONFIG };
+        }
+    }
+    configCache = { path: config, fingerprint, value };
+    return { ...value };
 }
 export function saveConfig(cfg) {
     const { config } = getPaths();
     atomicWrite(config, JSON.stringify(cfg, null, 2));
+    invalidateConfigCache();
 }
-/** Composite scope id for a provider + model credential. */
+/** Composite id used by the legacy v2 format; kept for API compatibility. */
 export function scopeId(providerId, model) {
     return `${providerId}::${model}`;
 }
+/** Pick the most recently saved credential when several legacy scopes map to one provider. */
+function keepNewest(keys, credential) {
+    const existing = keys[credential.provider];
+    if (!existing) {
+        keys[credential.provider] = credential;
+        return;
+    }
+    const previous = Date.parse(existing.addedAt || "") || 0;
+    const next = Date.parse(credential.addedAt || "") || 0;
+    if (next > previous)
+        keys[credential.provider] = credential;
+}
+let migrationChecked = false;
 export function loadAuth() {
     const { auth } = getPaths();
-    const empty = { version: 2, keys: {}, legacy: {} };
+    const empty = { version: AUTH_VERSION, keys: {}, legacy: {} };
     if (!existsSync(auth))
         return empty;
+    let raw;
     try {
-        const raw = JSON.parse(readFileSync(auth, "utf8"));
-        const keys = {};
-        const legacy = {};
-        const source = raw && typeof raw === "object" ? (raw.keys ?? {}) : {};
-        for (const [id, value] of Object.entries(source)) {
-            if (value && typeof value === "object" && typeof value.key === "string") {
-                const [idProvider, idModel] = id.split("::");
-                const provider = value.provider || idProvider || id;
-                const model = value.model || idModel || "";
-                keys[scopeId(provider, model)] = {
-                    provider,
-                    model,
-                    key: value.key,
-                    addedAt: value.addedAt ?? "",
-                };
-            }
-            else if (typeof value === "string" && value.trim()) {
-                legacy[id] = value;
-            }
+        raw = JSON.parse(readFileSync(auth, "utf8"));
+    }
+    catch {
+        return empty;
+    }
+    if (!raw || typeof raw !== "object")
+        return empty;
+    const keys = {};
+    const legacy = {};
+    let migrated = false;
+    const source = raw.keys && typeof raw.keys === "object" ? raw.keys : {};
+    for (const [id, value] of Object.entries(source)) {
+        if (value && typeof value === "object" && typeof value.key === "string" && value.key.trim()) {
+            const [idProvider, idModel] = id.split("::");
+            const provider = typeof value.provider === "string" && value.provider ? value.provider : idProvider || id;
+            const model = typeof value.model === "string" ? value.model : idModel || "";
+            if (id.includes("::") || raw.version !== AUTH_VERSION)
+                migrated = true;
+            keepNewest(keys, {
+                provider,
+                model,
+                key: value.key,
+                addedAt: typeof value.addedAt === "string" ? value.addedAt : "",
+            });
         }
-        if (raw && typeof raw === "object" && raw.legacy && typeof raw.legacy === "object") {
-            for (const [id, value] of Object.entries(raw.legacy)) {
-                if (typeof value === "string" && value.trim())
-                    legacy[id] = value;
+        else if (typeof value === "string" && value.trim()) {
+            // v1: keys were plain provider -> key strings.
+            keepNewest(keys, { provider: id, key: value, addedAt: "" });
+            migrated = true;
+        }
+    }
+    if (raw.legacy && typeof raw.legacy === "object") {
+        for (const [provider, value] of Object.entries(raw.legacy)) {
+            if (typeof value === "string" && value.trim()) {
+                // Provider-only keys are exactly what v3 wants: migrate instead
+                // of leaving them unusable.
+                keepNewest(keys, { provider, key: value, addedAt: "" });
+                migrated = true;
             }
         }
-        return { version: 2, keys, legacy };
     }
-    catch {
-        return empty;
+    if (migrated && !migrationChecked) {
+        try {
+            // Keep the pre-migration file so a user with several old model
+            // keys can recover a credential we had to collapse.
+            const backup = auth + ".v2.bak";
+            if (!existsSync(backup))
+                copyFileSync(auth, backup);
+            writeAuth({ version: AUTH_VERSION, keys, legacy });
+        }
+        catch {
+            // Read-only home (or locked file): keep the migrated view in memory.
+        }
     }
+    migrationChecked = true;
+    return { version: AUTH_VERSION, keys, legacy };
 }
-export function saveAuth(store) {
+function writeAuth(store) {
     const { auth } = getPaths();
-    const payload = { version: 2, keys: store.keys };
-    if (Object.keys(store.legacy).length > 0)
-        payload.legacy = store.legacy;
-    atomicWrite(auth, JSON.stringify(payload, null, 2));
+    atomicWrite(auth, JSON.stringify({ version: AUTH_VERSION, keys: store.keys }, null, 2));
     lockdown(auth);
 }
-export function getCredential(providerId, model) {
-    return loadAuth().keys[scopeId(providerId, model)];
+export function saveAuth(store) {
+    writeAuth(store);
+}
+export function getCredential(providerId, _model) {
+    return loadAuth().keys[providerId];
 }
 export function listCredentials() {
     return Object.values(loadAuth().keys);
@@ -108,7 +202,7 @@ export function listLegacy() {
 export function getLegacy(providerId) {
     return loadAuth().legacy[providerId];
 }
-/** Save/replace the credential for one provider+model scope (drops the legacy key). */
+/** Save/replace the provider-wide credential (drops any legacy key). */
 export function setCredential(providerId, model, key) {
     const store = loadAuth();
     const credential = {
@@ -117,29 +211,26 @@ export function setCredential(providerId, model, key) {
         key: key.trim(),
         addedAt: new Date().toISOString(),
     };
-    store.keys[scopeId(providerId, model)] = credential;
+    store.keys[providerId] = credential;
     delete store.legacy[providerId];
     saveAuth(store);
     return credential;
 }
-export function removeCredential(providerId, model) {
+export function removeCredential(providerId, _model) {
     const store = loadAuth();
-    const id = scopeId(providerId, model);
-    if (!store.keys[id])
+    if (!store.keys[providerId])
         return false;
-    delete store.keys[id];
+    delete store.keys[providerId];
     saveAuth(store);
     return true;
 }
-/** Remove every credential for a provider (all models) plus its legacy key. */
+/** Remove the provider-wide credential plus any legacy leftovers. */
 export function removeCredentialsForProvider(providerId) {
     const store = loadAuth();
     let removed = 0;
-    for (const id of Object.keys(store.keys)) {
-        if (store.keys[id].provider === providerId) {
-            delete store.keys[id];
-            removed += 1;
-        }
+    if (store.keys[providerId]) {
+        delete store.keys[providerId];
+        removed += 1;
     }
     if (store.legacy[providerId]) {
         delete store.legacy[providerId];
@@ -159,16 +250,16 @@ export function maskKey(key) {
     return value.slice(0, 3) + "****" + value.slice(-4);
 }
 /**
- * Resolve the key to use for a specific provider+model:
- *   1. the scoped credential in auth.json (exact provider+model match), then
+ * Resolve the key to use for a provider:
+ *   1. the provider-wide credential in auth.json,
  *   2. the provider's environment variable (provider-scoped, any model), and
- *   3. report an "unbound" legacy key instead of using it silently.
+ *   3. a legacy provider-only key that somehow escaped migration.
  */
-export function resolveApiKey(providerId, model, envVars) {
+export function resolveApiKey(providerId, _model, envVars) {
     const store = loadAuth();
-    const scoped = store.keys[scopeId(providerId, model)];
-    if (scoped && scoped.key)
-        return { status: "ok", key: scoped.key, source: "file" };
+    const credential = store.keys[providerId];
+    if (credential && credential.key)
+        return { status: "ok", key: credential.key, source: "file" };
     for (const envVar of envVars ?? []) {
         const value = process.env[envVar];
         if (value && value.trim())
@@ -181,10 +272,9 @@ export function resolveApiKey(providerId, model, envVars) {
 /** Best-effort key for a provider regardless of model (used to list models). */
 export function resolveProviderKey(providerId, envVars) {
     const store = loadAuth();
-    for (const credential of Object.values(store.keys)) {
-        if (credential.provider === providerId && credential.key)
-            return { key: credential.key, source: "file" };
-    }
+    const credential = store.keys[providerId];
+    if (credential && credential.key)
+        return { key: credential.key, source: "file" };
     for (const envVar of envVars ?? []) {
         const value = process.env[envVar];
         if (value && value.trim())