@gajae-code/coding-agent 0.15.4 → 0.15.6

package/src/cli/auth-broker-cli.ts

@@ -17,6 +17,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import * as readline from "node:readline";
 import { cleanReason } from "@gajae-code/ai/auth-broker/redact";
 import {
 	AuthBrokerClient,
@@ -226,19 +227,46 @@ async function runLogin(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 	await runLocalLogin(providerArg as OAuthProvider);
 }
 
+function promptForLogin(rl: readline.Interface, question: string): Promise<string> {
+	const { promise, resolve } = Promise.withResolvers<string>();
+	rl.question(question, answer => resolve(answer));
+	return promise;
+}
+
 async function runLocalLogin(provider: OAuthProvider): Promise<void> {
-	// Spawn the pi-ai CLI in-process — it handles the per-provider OAuth dance
-	// and persists into the same SQLite store the broker uses.
-	const piAiCli = Bun.fileURLToPath(import.meta.resolve("@gajae-code/ai/cli"));
-	const proc = Bun.spawn({
-		cmd: [process.execPath, piAiCli, "login", provider],
-		stdin: "inherit",
-		stdout: "inherit",
-		stderr: "inherit",
-	});
-	const exitCode = await proc.exited;
-	if (exitCode !== 0) {
-		throw new Error(`pi-ai login exited with code ${exitCode}`);
+	// Drive AuthStorage.login() in-process against the local SQLite store the
+	// broker uses. Previously this spawned a child process resolved via
+	// `import.meta.resolve("@gajae-code/ai/cli")`, which requires an on-disk
+	// `node_modules` package resolution — present in a source/dev checkout but
+	// absent inside a compiled `bun build --compile` binary's `$bunfs`, so the
+	// standalone binary failed with a module-resolution error (issue #5064).
+	// `AuthStorage` is already a normal, statically-traceable import from
+	// `@gajae-code/ai/core` (see the top of this file), so it bundles cleanly
+	// into the compiled binary the same way every other `@gajae-code/ai/core`
+	// export used elsewhere in this file already does.
+	const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+	const store = await SqliteAuthCredentialStore.open(getAgentDbPath());
+	const storage = new AuthStorage(store);
+	await storage.reload();
+	try {
+		await storage.login(provider, {
+			onAuth(info) {
+				const { url, instructions } = info;
+				process.stdout.write(`\nOpen this URL in your browser:\n${url}\n`);
+				if (instructions) process.stdout.write(`${instructions}\n`);
+				process.stdout.write("\n");
+			},
+			onProgress(message) {
+				process.stdout.write(`${message}\n`);
+			},
+			onPrompt(p) {
+				return promptForLogin(rl, `${p.message}${p.placeholder ? ` (${p.placeholder})` : ""}: `);
+			},
+		});
+		process.stdout.write(`\nCredentials saved to ${getAgentDbPath()}\n`);
+	} finally {
+		store.close();
+		rl.close();
 	}
 }
 

package/src/cli/auth-gateway-cli.ts

@@ -8,23 +8,28 @@
  * `GJC_AUTH_BROKER_URL` / `auth.broker.url` precedence used elsewhere).
  *
  * Sub-verbs:
- *   - `serve [--bind=…]` — boots the gateway against the configured broker.
+ *   - `serve --provider=<id> [--bind=…]` — boots a provider-scoped gateway against the configured broker.
  *   - `token` / `token --regenerate` — manages the gateway bearer token file.
- *   - `status` — prints the locally-stored gateway token and bind hint.
+ *   - `status` — prints scoped gateway readiness without token material.
  */
 import * as crypto from "node:crypto";
 import * as path from "node:path";
 import { cleanReason } from "@gajae-code/ai/auth-broker/redact";
-import { startAuthGateway } from "@gajae-code/ai/auth-gateway/server";
 import {
-	type Api,
+	createAuthGatewayModelCatalog,
+	isAuthGatewayModelBrokerConsumable,
+	isSafeProviderScope,
+	startAuthGateway,
+} from "@gajae-code/ai/auth-gateway/server";
+import {
 	AuthBrokerClient,
+	type AuthCredentialSnapshot,
 	AuthStorage,
+	type CredentialHealthResult,
 	DEFAULT_AUTH_GATEWAY_BIND,
+	extractStructuredApiKeyToken,
 	type GeneratedProvider,
 	getBundledModels,
-	getBundledProviders,
-	type Model,
 	RemoteAuthCredentialStore,
 	type SnapshotResponse,
 } from "@gajae-code/ai/core";
@@ -44,6 +49,7 @@ export interface AuthGatewayCommandArgs {
 	flags: {
 		json?: boolean;
 		bind?: string;
+		provider?: string;
 		regenerate?: boolean;
 		/**
 		 * Disable bearer-token auth on inbound requests. Useful when the gateway
@@ -77,12 +83,34 @@ function safeDiagnostic(value: unknown, fallback: string): string {
 	return cleanReason(value) ?? fallback;
 }
 
+export function resolveAuthGatewayReadiness(input: {
+	noAuth: boolean;
+	tokenPresent: boolean;
+	credentialCount: number;
+	modelCount: number;
+}): { ready: boolean; reason: "token_missing" | "provider_credential_missing" | "provider_catalog_empty" | null } {
+	const authReady = input.noAuth || input.tokenPresent;
+	const ready = authReady && input.credentialCount > 0 && input.modelCount > 0;
+	const reason = !authReady
+		? "token_missing"
+		: input.credentialCount === 0
+			? "provider_credential_missing"
+			: input.modelCount === 0
+				? "provider_catalog_empty"
+				: null;
+	return { ready, reason };
+}
+
 function writeCommandFailure(action: AuthGatewayAction, flags: AuthGatewayCommandArgs["flags"], error: unknown): void {
 	const stable = stableErrorForAction(action);
+	const scope = normalizeProviderScope(flags.provider);
+	const scopeLabel = flags.provider === undefined ? "(unscoped)" : (scope ?? "(invalid)");
 	if (flags.json) {
-		process.stdout.write(`${JSON.stringify({ ok: false, error: stable })}\n`);
+		process.stdout.write(`${JSON.stringify({ ok: false, error: stable, scope })}\n`);
 	} else {
-		process.stderr.write(`${chalk.red("FAILED")} ${safeDiagnostic(error, stable.message)}\n`);
+		process.stderr.write(`scope: ${scopeLabel}\n`);
+		const message = action === "check" ? stable.message : safeDiagnostic(error, stable.message);
+		process.stderr.write(`${chalk.red("FAILED")} ${message}\n`);
 	}
 	process.exitCode = 1;
 }
@@ -130,13 +158,85 @@ function createBrokerClient(brokerConfig: AuthBrokerClientConfig): AuthBrokerCli
 	return new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });
 }
 
+export function normalizeProviderScope(provider: string | undefined): string | undefined {
+	return provider && isSafeProviderScope(provider) ? provider : undefined;
+}
+
+export function filterCredentialCheckResults(
+	results: readonly CredentialHealthResult[],
+	provider: string | undefined,
+): CredentialHealthResult[] {
+	return provider ? results.filter(row => row.provider === provider) : [...results];
+}
+
+function sanitizeCredentialCheckResult(row: CredentialHealthResult): Record<string, unknown> {
+	return {
+		id: row.id,
+		provider: row.provider,
+		type: row.type,
+		ok: row.ok,
+		...(row.remoteRefresh ? { remoteRefresh: true } : {}),
+		...(row.reason
+			? { reason: row.ok === false ? "Credential check failed." : "Credential status unavailable." }
+			: {}),
+	};
+}
+
+function requireProviderScope(provider: string | undefined, action: "serve"): string {
+	const normalized = normalizeProviderScope(provider);
+	if (!normalized) {
+		throw new Error(
+			`gjc auth-gateway ${action} requires --provider=<id>; an unscoped gateway is disabled to prevent model-id ambiguity.`,
+		);
+	}
+	return normalized;
+}
+
+export function redactBrokerUrl(rawUrl: string): string {
+	try {
+		const url = new URL(rawUrl);
+		url.username = "";
+		url.password = "";
+		url.search = "";
+		url.hash = "";
+		return url.origin === "null" ? "<configured broker>" : url.origin;
+	} catch {
+		return "<configured broker>";
+	}
+}
+
 async function fetchBrokerSnapshot(client: AuthBrokerClient): Promise<SnapshotResponse> {
 	const result = await client.fetchSnapshot();
 	if (result.status !== 200) throw new Error("Auth broker returned no initial snapshot");
 	return result.snapshot;
 }
 
+export function hasEnabledProviderCredential(
+	snapshot: Pick<AuthCredentialSnapshot, "credentials">,
+	provider: string,
+): boolean {
+	return snapshot.credentials.some(entry => entry.provider === provider);
+}
+
+export function matchesProviderCredential(
+	entry: AuthCredentialSnapshot["credentials"][number],
+	apiKey: string,
+): boolean {
+	if (entry.credential.type === "api_key") return entry.credential.key === apiKey;
+	return entry.credential.access === apiKey || extractStructuredApiKeyToken(apiKey) === entry.credential.access;
+}
+
+export function assertEnabledProviderCredential(
+	snapshot: Pick<AuthCredentialSnapshot, "credentials">,
+	provider: string,
+): void {
+	if (!hasEnabledProviderCredential(snapshot, provider)) {
+		throw new Error(`Auth gateway scope ${provider} has no enabled broker credential`);
+	}
+}
+
 async function runServe(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
+	const provider = requireProviderScope(flags.provider, "serve");
 	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	if (!brokerConfig) {
 		throw new Error(
@@ -144,89 +244,95 @@ async function runServe(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 		);
 	}
 	const bind = flags.bind ?? DEFAULT_AUTH_GATEWAY_BIND;
-	const gatewayToken = flags.noAuth ? null : await ensureToken();
+	const models = getBundledModels(provider as GeneratedProvider);
+	if (!models.some(isAuthGatewayModelBrokerConsumable)) {
+		throw new Error(`Auth gateway scope ${provider} has no broker-consumable models`);
+	}
 
 	// Build a broker-backed AuthStorage — same pattern as discoverAuthStorage()
 	// in sdk/session.ts. The gateway never touches local SQLite.
 	const client = createBrokerClient(brokerConfig);
 	const initialSnapshot = await fetchBrokerSnapshot(client);
+	assertEnabledProviderCredential(initialSnapshot, provider);
 	const store = new RemoteAuthCredentialStore({ client, initialSnapshot });
 	// Refresh + usage both flow through the store's broker hooks automatically —
 	// `RemoteAuthCredentialStore.refreshOAuthCredential` and `.fetchUsageReports`.
 	// AuthStorage discovers them when no explicit option overrides them, so the
 	// gateway only needs to construct the store and pass it in.
 	const storage = new AuthStorage(store, {
-		sourceLabel: `broker ${brokerConfig.url}`,
+		sourceLabel: `broker ${redactBrokerUrl(brokerConfig.url)}`,
 	});
-	await storage.reload();
-
-	// Build the model resolver + catalog from pi-ai's bundled metadata, scoped
-	// to providers we hold credentials for. Format handlers ask `resolveModel`
-	// to translate a client-requested `model` field into a pi-ai `Model<Api>`
-	// before dispatch; `listModels` powers `/v1/models`.
-	const snapshot = storage.exportSnapshot();
-	const providersWithCreds = new Set<string>();
-	for (const entry of snapshot.credentials) providersWithCreds.add(entry.provider);
-	const modelById = new Map<string, Model<Api>>();
-	for (const provider of getBundledProviders()) {
-		if (!providersWithCreds.has(provider)) continue;
-		for (const model of getBundledModels(provider as GeneratedProvider)) {
-			// First-write-wins so a canonical model id collisions across providers
-			// stick to the provider listed first by getBundledProviders.
-			if (!modelById.has(model.id)) modelById.set(model.id, model);
-		}
-	}
+	try {
+		await storage.reload();
+		assertEnabledProviderCredential(storage.exportSnapshot(), provider);
 
-	const handle = startAuthGateway({
-		storage,
-		bind,
-		bearerTokens: gatewayToken ? [gatewayToken] : [],
-		version: VERSION,
-		resolveModel: (id: string) => modelById.get(id),
-		listModels: () => modelById.values(),
-	});
-	process.stdout.write(`auth-gateway listening on ${handle.url}\n`);
-	if (gatewayToken) {
-		process.stdout.write(`bearer token: ${getTokenFilePath()} (chmod 0600)\n`);
-	} else {
-		process.stdout.write(`auth: disabled (--no-auth) — any client can call this gateway\n`);
-	}
-	process.stdout.write(`upstream broker: ${brokerConfig.url}\n`);
-
-	const stopped = Promise.withResolvers<void>();
-	let shutdownStarted = false;
-	const stop = async (signal: NodeJS.Signals): Promise<void> => {
-		if (shutdownStarted) return;
-		shutdownStarted = true;
-		process.stdout.write(`\nReceived ${signal}, shutting down...\n`);
-		let closeError: unknown;
-		try {
-			await handle.close();
-		} catch (error) {
-			closeError = error;
-		} finally {
-			storage.close();
+		const catalog = createAuthGatewayModelCatalog(provider, models);
+		if (catalog.models.length === 0) {
+			throw new Error(`Auth gateway scope ${provider} has no source-backed models`);
 		}
-		if (closeError) {
-			stopped.reject(closeError);
+		const modelById = new Map(catalog.models.map(model => [model.id, model] as const));
+		const gatewayToken = flags.noAuth ? null : await ensureToken();
+		const handle = startAuthGateway({
+			storage,
+			hasProviderCredential: () => store.snapshot.credentials.some(entry => entry.provider === provider),
+			reloadProviderCredentials: async signal => {
+				await store.refreshSnapshot(signal);
+			},
+			validateProviderCredential: (candidateProvider, apiKey) =>
+				store.snapshot.credentials.some(
+					entry => entry.provider === candidateProvider && matchesProviderCredential(entry, apiKey),
+				),
+			bind,
+			providerScope: { provider },
+			bearerTokens: gatewayToken ? [gatewayToken] : [],
+			version: VERSION,
+			resolveModel: (id: string) => modelById.get(id),
+			listModels: () => catalog.models,
+		});
+		process.stdout.write(`auth-gateway listening on ${handle.url}\n`);
+		process.stdout.write(`scope: ${provider}\n`);
+		if (gatewayToken) {
+			process.stdout.write(`bearer token: ${getTokenFilePath()} (chmod 0600)\n`);
 		} else {
-			stopped.resolve();
+			process.stdout.write(`auth: disabled (--no-auth) — non-browser local clients can call this gateway\n`);
 		}
-	};
-	const onSigint = (): void => {
-		void stop("SIGINT");
-	};
-	const onSigterm = (): void => {
-		void stop("SIGTERM");
-	};
-	process.once("SIGINT", onSigint);
-	process.once("SIGTERM", onSigterm);
+		process.stdout.write(`upstream broker: ${redactBrokerUrl(brokerConfig.url)}\n`);
 
-	try {
-		await stopped.promise;
+		const stopped = Promise.withResolvers<void>();
+		let shutdownStarted = false;
+		const stop = async (signal: NodeJS.Signals): Promise<void> => {
+			if (shutdownStarted) return;
+			shutdownStarted = true;
+			process.stdout.write(`\nReceived ${signal}, shutting down...\n`);
+			let closeError: unknown;
+			try {
+				await handle.close();
+			} catch (error) {
+				closeError = error;
+			}
+			if (closeError) {
+				stopped.reject(closeError);
+			} else {
+				stopped.resolve();
+			}
+		};
+		const onSigint = (): void => {
+			void stop("SIGINT");
+		};
+		const onSigterm = (): void => {
+			void stop("SIGTERM");
+		};
+		process.once("SIGINT", onSigint);
+		process.once("SIGTERM", onSigterm);
+
+		try {
+			await stopped.promise;
+		} finally {
+			process.off("SIGINT", onSigint);
+			process.off("SIGTERM", onSigterm);
+		}
 	} finally {
-		process.off("SIGINT", onSigint);
-		process.off("SIGTERM", onSigterm);
+		storage.close();
 	}
 }
 
@@ -253,20 +359,24 @@ async function runStatus(flags: AuthGatewayCommandArgs["flags"]): Promise<void>
 	const token = await readToken();
 	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	const tokenFile = getTokenFilePath();
+	const provider = normalizeProviderScope(flags.provider);
 	if (!brokerConfig) {
 		const status = {
 			ready: false,
 			reason: "broker_not_configured",
 			error: { code: "broker_not_configured", message: "Auth broker is not configured." },
+			scope: provider,
 			tokenFile,
 			tokenPresent: token !== null,
 			broker: null,
 			brokerConfigured: false,
 			brokerAuthenticated: false,
+			credentialCount: null,
 		};
 		if (flags.json) {
 			process.stdout.write(`${JSON.stringify(status)}\n`);
 		} else {
+			process.stdout.write(`scope: ${provider ?? "(required: --provider=<id>)"}\n`);
 			process.stdout.write(`${chalk.yellow("No broker configured.")} Set GJC_AUTH_BROKER_URL.\n`);
 			process.stdout.write(
 				`token: ${status.tokenPresent ? chalk.green("present") : chalk.red("missing")} at ${status.tokenFile}\n`,
@@ -275,54 +385,98 @@ async function runStatus(flags: AuthGatewayCommandArgs["flags"]): Promise<void>
 		process.exitCode = 1;
 		return;
 	}
+	if (!provider) {
+		const status = {
+			ready: false,
+			reason: "provider_scope_required",
+			error: {
+				code: "provider_scope_required",
+				message: "A provider scope is required to report gateway readiness.",
+			},
+			scope: null,
+			tokenFile,
+			tokenPresent: token !== null,
+			broker: redactBrokerUrl(brokerConfig.url),
+			brokerConfigured: true,
+			brokerAuthenticated: false,
+			credentialCount: null,
+		};
+		if (flags.json) {
+			process.stdout.write(`${JSON.stringify(status)}\n`);
+		} else {
+			process.stdout.write(`scope: (required: --provider=<id>)\n`);
+			process.stdout.write(`${chalk.yellow("not ready")} provider scope is required\n`);
+			process.stdout.write(
+				`token: ${status.tokenPresent ? chalk.green("present") : chalk.red("missing")} at ${status.tokenFile}\n`,
+			);
+		}
+		process.exitCode = 1;
+		return;
+	}
 
 	try {
 		const snapshot = await fetchBrokerSnapshot(createBrokerClient(brokerConfig));
 		const tokenPresent = token !== null;
+		const noAuth = flags.noAuth === true;
+		const credentialCount = snapshot.credentials.filter(entry => entry.provider === provider).length;
+		const catalog = createAuthGatewayModelCatalog(provider, getBundledModels(provider as GeneratedProvider));
+		const modelCount = catalog.models.length;
+		const { ready, reason } = resolveAuthGatewayReadiness({ noAuth, tokenPresent, credentialCount, modelCount });
 		const status = {
-			ready: tokenPresent,
-			reason: tokenPresent ? null : "token_missing",
+			ready,
+			reason,
 			tokenFile,
 			tokenPresent,
-			broker: brokerConfig.url,
+			broker: redactBrokerUrl(brokerConfig.url),
 			brokerConfigured: true,
 			brokerAuthenticated: true,
-			credentialCount: snapshot.credentials.length,
+			scope: provider,
+			credentialCount,
+			modelCount,
 		};
 		if (flags.json) {
 			process.stdout.write(`${JSON.stringify(status)}\n`);
 		} else {
-			const brokerLine = `upstream broker: ${brokerConfig.url} (${snapshot.credentials.length} credential${
-				snapshot.credentials.length === 1 ? "" : "s"
+			const brokerLine = `upstream broker: ${redactBrokerUrl(brokerConfig.url)} (${credentialCount} scoped credential${
+				credentialCount === 1 ? "" : "s"
 			})`;
-			process.stdout.write(`${tokenPresent ? chalk.green("ready") : chalk.yellow("not ready")} ${brokerLine}\n`);
+			process.stdout.write(`scope: ${provider}\n`);
+			process.stdout.write(`${ready ? chalk.green("ready") : chalk.yellow("not ready")} ${brokerLine}\n`);
 			process.stdout.write(
 				`token: ${tokenPresent ? chalk.green("present") : chalk.red("missing")} at ${status.tokenFile}\n`,
 			);
-			if (!tokenPresent) {
+			if (!tokenPresent && !noAuth) {
 				process.stdout.write(
 					"Run `gjc auth-gateway token` or `gjc auth-gateway serve` to create a bearer token.\n",
 				);
 			}
+			if (credentialCount === 0) {
+				process.stdout.write(`No enabled broker credential is available for scope ${provider}.\n`);
+			}
+			if (modelCount === 0) {
+				process.stdout.write(`No source-backed models are available for scope ${provider}.\n`);
+			}
 		}
-		if (!tokenPresent) process.exitCode = 1;
+		if (!ready) process.exitCode = 1;
 	} catch (error) {
 		const status = {
 			ready: false,
 			reason: "broker_unavailable",
 			tokenFile,
 			tokenPresent: token !== null,
-			broker: brokerConfig.url,
+			broker: redactBrokerUrl(brokerConfig.url),
 			brokerConfigured: true,
 			brokerAuthenticated: false,
+			scope: provider,
 			error: { code: "broker_unavailable", message: "Auth broker is unavailable." },
 		};
 		if (flags.json) {
 			process.stdout.write(`${JSON.stringify(status)}\n`);
 		} else {
 			process.stdout.write(
-				`${chalk.red("FAILED")} upstream broker: ${brokerConfig.url}: ${safeDiagnostic(error, "Auth broker is unavailable.")}\n`,
+				`${chalk.red("FAILED")} upstream broker: ${redactBrokerUrl(brokerConfig.url)}: ${safeDiagnostic(error, "Auth broker is unavailable.")}\n`,
 			);
+			process.stdout.write(`scope: ${provider}\n`);
 			process.stdout.write(
 				`token: ${status.tokenPresent ? chalk.green("present") : chalk.red("missing")} at ${status.tokenFile}\n`,
 			);
@@ -333,6 +487,9 @@ async function runStatus(flags: AuthGatewayCommandArgs["flags"]): Promise<void>
 
 export async function runAuthGatewayCommand(cmd: AuthGatewayCommandArgs): Promise<void> {
 	try {
+		if (cmd.flags.provider !== undefined && !normalizeProviderScope(cmd.flags.provider)) {
+			throw new Error("Invalid provider scope.");
+		}
 		switch (cmd.action) {
 			case "serve":
 				await runServe(cmd.flags);
@@ -368,6 +525,7 @@ export async function runAuthGatewayCommand(cmd: AuthGatewayCommandArgs): Promis
  * dedicated diagnostic is the only way to see which credentials failed.
  */
 async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
+	const provider = normalizeProviderScope(flags.provider);
 	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	if (!brokerConfig) {
 		throw new Error(
@@ -378,17 +536,32 @@ async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 	const client = createBrokerClient(brokerConfig);
 	const initialSnapshot = await fetchBrokerSnapshot(client);
 	const store = new RemoteAuthCredentialStore({ client, initialSnapshot });
-	const storage = new AuthStorage(store, { sourceLabel: `broker ${brokerConfig.url}` });
+	const storage = new AuthStorage(store, { sourceLabel: `broker ${redactBrokerUrl(brokerConfig.url)}` });
 	try {
 		await storage.reload();
-		const results = await storage.checkCredentials();
+		const results = filterCredentialCheckResults(
+			await storage.checkCredentials(provider ? { provider } : undefined),
+			provider,
+		);
+		const scopedCredentialCount = provider
+			? store.snapshot.credentials.filter(entry => entry.provider === provider).length
+			: store.snapshot.credentials.length;
+		const failed = results.filter(row => row.ok === false).length;
 
 		if (flags.json) {
-			const credentials = results.map(row => ({
-				...row,
-				...(row.reason ? { reason: safeDiagnostic(row.reason, "Credential check failed.") } : {}),
-			}));
-			process.stdout.write(`${JSON.stringify({ broker: brokerConfig.url, credentials }, null, 2)}\n`);
+			const credentials = results.map(sanitizeCredentialCheckResult);
+			process.stdout.write(
+				`${JSON.stringify(
+					{
+						broker: redactBrokerUrl(brokerConfig.url),
+						scope: provider,
+						credentialCount: scopedCredentialCount,
+						credentials,
+					},
+					null,
+					2,
+				)}\n`,
+			);
 		} else {
 			const grouped = new Map<string, typeof results>();
 			for (const row of results) {
@@ -397,7 +570,11 @@ async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 				grouped.set(row.provider, list);
 			}
 			const providers = [...grouped.keys()].sort();
-			process.stdout.write(`broker: ${brokerConfig.url}\n`);
+			process.stdout.write(`broker: ${redactBrokerUrl(brokerConfig.url)}\n`);
+			process.stdout.write(`scope: ${provider ?? "(all providers; diagnostic only)"}\n`);
+			if (provider && scopedCredentialCount === 0) {
+				process.stdout.write(`No enabled broker credential is available for scope ${provider}.\n`);
+			}
 			for (const provider of providers) {
 				const rows = grouped.get(provider) ?? [];
 				process.stdout.write(`\n${chalk.bold(provider)} (${rows.length})\n`);
@@ -408,25 +585,24 @@ async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 							: row.ok === false
 								? chalk.red("FAIL    ")
 								: chalk.yellow("unknown ");
-					const identity =
-						row.email ?? row.accountId ?? (row.type === "api_key" ? "(api key)" : "(no identity on credential)");
+					const identity = row.type === "api_key" ? "(api key)" : "(identity hidden)";
 					const remote = row.remoteRefresh ? chalk.dim(" [remote-refresh]") : "";
 					const reason = row.reason
-						? chalk.dim(` — ${safeDiagnostic(row.reason, "Credential check failed.")}`)
+						? chalk.dim(` — ${row.ok === false ? "Credential check failed." : "Credential status unavailable."}`)
 						: "";
 					process.stdout.write(
 						`  ${status} id=${row.id.toString().padStart(3)} ${row.type.padEnd(7)} ${identity}${remote}${reason}\n`,
 					);
 				}
 			}
-			const failed = results.filter(row => row.ok === false).length;
 			const unverifiable = results.filter(row => row.ok === null).length;
 			const passing = results.filter(row => row.ok === true).length;
 			process.stdout.write(
 				`\n${chalk.green(`${passing} ok`)}, ${chalk.red(`${failed} failed`)}, ${chalk.yellow(`${unverifiable} unverifiable`)}, ${results.length} total\n`,
 			);
-			if (failed > 0) process.exitCode = 1;
 		}
+		if (failed > 0) process.exitCode = 1;
+		if (provider && scopedCredentialCount === 0) process.exitCode = 1;
 	} finally {
 		storage.close();
 	}

package/src/cli/config-cli.ts

@@ -16,8 +16,8 @@ import {
 	validateAutoroutingProvenance,
 	validateAutoroutingSetup,
 } from "../config/autorouting-contract";
+import { loadEffectiveModelProfiles } from "../config/model-preset-registry";
 import { resolveModelProfileName } from "../config/model-profile-contract";
-import { mergeModelProfiles } from "../config/model-profiles";
 import { ModelsConfigFile } from "../config/model-registry";
 import {
 	getDefault,
@@ -548,7 +548,7 @@ function handlePath(): void {
  */
 export function collectConfigAdvisories(): string[] {
 	const profileName = settings.get("modelProfile.default");
-	const profiles = mergeModelProfiles(ModelsConfigFile.load()?.profiles);
+	const profiles = loadEffectiveModelProfiles(ModelsConfigFile.load()?.profiles);
 	const resolvedProfileName = profileName ? resolveModelProfileName(profileName, profiles) : undefined;
 	const delegation = resolveEagerTaskDelegation({
 		settings,

package/src/cli/fast-help.ts

@@ -9,6 +9,7 @@ export function getExtraHelpText(): string {
   ${APP_NAME} state                - Inspect or manage persisted GJC state
   ${APP_NAME} auth-broker         - Manage the auth-broker (credential vault)
   ${APP_NAME} accounts             - List, check, pin, and remove stored OAuth accounts
+  ${APP_NAME} models presets       - Inspect, refresh, pin, rollback, or disable the signed model preset registry
   ${APP_NAME} auth-gateway        - Run an auth-gateway forward proxy
   ${APP_NAME} harness              - Run harness control-plane commands
   ${APP_NAME} coordinator          - Manage coordinator/runtime coordination helpers
@@ -82,6 +83,8 @@ Environment Variables:
   GJC_SMOL_MODEL              - Override smol/fast model (see --smol)
   GJC_SLOW_MODEL              - Override slow/reasoning model (see --slow)
   GJC_PLAN_MODEL              - Override planning model (see --plan)
+  GJC_MODEL_PRESET_REGISTRY_URL - HTTPS latest.json override for the signed preset registry
+  GJC_MODEL_PRESET_REGISTRY_DISABLED - Disable registry fetch/use (1/true/yes/on)
   GJC_NO_PTY                  - Disable PTY-based interactive bash execution
   --tmux                       - Launch interactive startup inside a fresh tmux session
   gjc session                  - List, inspect, create, remove, or attach tagged GJC-managed tmux sessions