@ggui-ai/cli 0.20.0 → 0.21.0

package/dist/byok-resolver.d.ts

@@ -78,6 +78,14 @@ export interface ByokKeyResolution {
      * that's what fired, instead of a generic "google env".
      */
     readonly envName?: string;
+    /**
+     * ggui#1132 — env names in this provider's alias list that were ALSO set,
+     * to a DIFFERENT value, and lost to `envName` under the locked precedence.
+     * Names only, never values. A stale key in a shadowed alias is exactly
+     * the silent failure this exists to make loud: a rotated `GEMINI_API_KEY`
+     * that a stale `GOOGLE_API_KEY` beats. Absent ⇒ no conflict.
+     */
+    readonly shadowedEnvNames?: readonly string[];
 }
 export interface ByokResolverOptions {
     /**

package/dist/byok-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"byok-resolver.d.ts","sourceRoot":"","sources":["../src/byok-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EACV,WAAW,EAEX,gBAAgB,EACjB,MAAM,0BAA0B,CAAC;AAIlC;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAEnE,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,CAM3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CACL,QAAQ,EAAE,WAAW,EACrB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE,mBAAwB,GAC7B,YAAY,CA4Ed"}
+{"version":3,"file":"byok-resolver.d.ts","sourceRoot":"","sources":["../src/byok-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EACV,WAAW,EAEX,gBAAgB,EACjB,MAAM,0BAA0B,CAAC;AAIlC;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAEnE,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,CAM3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CACL,QAAQ,EAAE,WAAW,EACrB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE,mBAAwB,GAC7B,YAAY,CAoFd"}

package/dist/byok-resolver.js

@@ -59,11 +59,20 @@ export function createByokResolver(opts = {}) {
                 for (const name of envNames) {
                     const value = env[name];
                     if (value !== undefined && value.length > 0) {
+                        // ggui#1132: name every OTHER alias that is set to a different
+                        // value — it lost silently under the locked precedence.
+                        const shadowed = envNames.filter((other) => {
+                            if (other === name)
+                                return false;
+                            const v = env[other];
+                            return v !== undefined && v.length > 0 && v !== value;
+                        });
                         return {
                             key: value,
                             source: 'env',
                             provider,
                             envName: name,
+                            ...(shadowed.length > 0 ? { shadowedEnvNames: shadowed } : {}),
                         };
                     }
                 }

package/dist/generation-probe.d.ts

@@ -174,6 +174,8 @@ export interface GenerationBinding {
     readonly keySource?: ByokKeyResolution['source'];
     /** Env-var name that produced the boot-scan hit, when applicable. */
     readonly keyEnvName?: string;
+    /** ggui#1132 — aliases set to a different value that lost to `keyEnvName`; names only. */
+    readonly keyShadowedEnvNames?: readonly string[];
 }
 /**
  * Build a `GenerationBinding` whose `resolveLlm` does live BYOK

package/dist/generation-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generation-probe.d.ts","sourceRoot":"","sources":["../src/generation-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,QAAQ,EAGR,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAC9C,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAMlD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAC1B,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9C,GAAG,4BAA4B,CAW/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;IACpE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CAwF5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAWR"}
+{"version":3,"file":"generation-probe.d.ts","sourceRoot":"","sources":["../src/generation-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,QAAQ,EAGR,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACb,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAC9C,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAMlD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAC1B,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9C,GAAG,4BAA4B,CAW/B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;IACpE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CA2F5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,GACzB,MAAM,CAeR"}

package/dist/generation-probe.js

@@ -150,6 +150,9 @@ export async function probeGenerationBinding(opts) {
             ...(bootHit.envName !== undefined
                 ? { keyEnvName: bootHit.envName }
                 : {}),
+            ...(bootHit.shadowedEnvNames !== undefined
+                ? { keyShadowedEnvNames: bootHit.shadowedEnvNames }
+                : {}),
         }
         : {
             generation,
@@ -181,5 +184,8 @@ export function describeGenerationBinding(binding) {
             ? `env: ${binding.keyEnvName}`
             : 'env'
         : 'credentials-file';
-    return `generation: ${binding.provider} / ${binding.model} (${src})`;
+    const conflict = binding.keyShadowedEnvNames !== undefined && binding.keyEnvName !== undefined
+        ? ` — ${binding.keyEnvName} won; ${binding.keyShadowedEnvNames.join(', ')} also set and differs (rotate both or unset one, ggui#1132)`
+        : '';
+    return `generation: ${binding.provider} / ${binding.model} (${src})${conflict}`;
 }

package/dist/provider-key-command.d.ts

@@ -30,7 +30,13 @@ export declare function envVarForProvider(provider: ByokProvider): string;
  *
  * - `anthropic`   → `ANTHROPIC_API_KEY`
  * - `openai`      → `OPENAI_API_KEY`
- * - `google`      → `GOOGLE_API_KEY` (primary), then `GEMINI_API_KEY` (fallback)
+ * - `google`      → `GOOGLE_API_KEY` (primary), then `GEMINI_API_KEY` (fallback).
+ *                   The precedence is locked (Google's own SDKs prefer
+ *                   `GOOGLE_API_KEY` when both are set, and the hosted key
+ *                   routes mirror this order). When both are set to DIFFERENT
+ *                   values the loser is named — see {@link describeAliasConflict}
+ *                   — because a stale key in the shadowed alias is the failure
+ *                   that otherwise happens silently (ggui#1132).
  * - `openrouter`  → `OPENROUTER_API_KEY`
  *
  * Order matches `byok-resolver.ts` so that the key the cloud receives is
@@ -39,7 +45,13 @@ export declare function envVarForProvider(provider: ByokProvider): string;
  * Returns `undefined` when no non-empty value is found.
  */
 export declare function readKeyFromEnv(provider: ByokProvider, env?: Readonly<Record<string, string | undefined>>): string | undefined;
-export declare const PROVIDER_KEY_HELP = "ggui provider-key \u2014 manage cloud provider API keys for a ggui app\n\nUsage:\n  ggui provider-key set --app <appId> [--provider <name>]\n\nSubcommands:\n  set   Push a provider API key from the appropriate env var to the cloud app.\n        The provider is derived from ggui.json#generation.model unless\n        --provider is given explicitly.\n\n        Supported providers: anthropic, openai, google, openrouter.\n        (bedrock is IAM-only \u2014 no plaintext key to push.)\n\n        Reads the key from env:\n          ANTHROPIC_API_KEY  (anthropic)\n          OPENAI_API_KEY     (openai)\n          GOOGLE_API_KEY     (google, primary); GEMINI_API_KEY (fallback)\n          OPENROUTER_API_KEY (openrouter)\n\nOptions:\n  --app <appId>       Target app ID (required).\n  --provider <name>   Override provider (default: derived from ggui.json).\n  --help, -h          Show this help.\n";
+/**
+ * ggui#1132 — one line naming an alias conflict, or `undefined` when there is
+ * none. Only `google` has aliases. Names only, never values: the line is
+ * printed to stderr by `ggui provider-key set` and by the `ggui serve` banner.
+ */
+export declare function describeAliasConflict(provider: ByokProvider, env?: Readonly<Record<string, string | undefined>>): string | undefined;
+export declare const PROVIDER_KEY_HELP = "ggui provider-key \u2014 manage cloud provider API keys for a ggui app\n\nUsage:\n  ggui provider-key set --app <appId> [--provider <name>]\n\nSubcommands:\n  set   Push a provider API key from the appropriate env var to the cloud app.\n        The provider is derived from ggui.json#generation.model unless\n        --provider is given explicitly.\n\n        Supported providers: anthropic, openai, google, openrouter.\n        (bedrock is IAM-only \u2014 no plaintext key to push.)\n\n        Reads the key from env:\n          ANTHROPIC_API_KEY  (anthropic)\n          OPENAI_API_KEY     (openai)\n          GOOGLE_API_KEY     (google, primary); GEMINI_API_KEY (fallback)\n                             \u2014 if both are set and differ, the shadowed one is named\n          OPENROUTER_API_KEY (openrouter)\n\nOptions:\n  --app <appId>       Target app ID (required).\n  --provider <name>   Override provider (default: derived from ggui.json).\n  --help, -h          Show this help.\n";
 /**
  * Entry point for `ggui provider-key <subcommand> [options]`.
  *

package/dist/provider-key-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-key-command.d.ts","sourceRoot":"","sources":["../src/provider-key-command.ts"],"names":[],"mappings":"AAqBA,+DAA+D;AAC/D,eAAO,MAAM,cAAc,0DAA2D,CAAC;AAEvF,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAU3D;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA8ClC;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAWhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,YAAY,EACtB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,MAAM,GAAG,SAAS,CAWpB;AAMD,eAAO,MAAM,iBAAiB,o4BAuB7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CA+EjB"}
+{"version":3,"file":"provider-key-command.d.ts","sourceRoot":"","sources":["../src/provider-key-command.ts"],"names":[],"mappings":"AAqBA,+DAA+D;AAC/D,eAAO,MAAM,cAAc,0DAA2D,CAAC;AAEvF,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAU3D;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA8ClC;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAWhE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,YAAY,EACtB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,MAAM,GAAG,SAAS,CAWpB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,YAAY,EACtB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,MAAM,GAAG,SAAS,CAUpB;AAMD,eAAO,MAAM,iBAAiB,+9BAwB7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAiFjB"}

package/dist/provider-key-command.js

@@ -103,7 +103,13 @@ export function envVarForProvider(provider) {
  *
  * - `anthropic`   → `ANTHROPIC_API_KEY`
  * - `openai`      → `OPENAI_API_KEY`
- * - `google`      → `GOOGLE_API_KEY` (primary), then `GEMINI_API_KEY` (fallback)
+ * - `google`      → `GOOGLE_API_KEY` (primary), then `GEMINI_API_KEY` (fallback).
+ *                   The precedence is locked (Google's own SDKs prefer
+ *                   `GOOGLE_API_KEY` when both are set, and the hosted key
+ *                   routes mirror this order). When both are set to DIFFERENT
+ *                   values the loser is named — see {@link describeAliasConflict}
+ *                   — because a stale key in the shadowed alias is the failure
+ *                   that otherwise happens silently (ggui#1132).
  * - `openrouter`  → `OPENROUTER_API_KEY`
  *
  * Order matches `byok-resolver.ts` so that the key the cloud receives is
@@ -122,6 +128,22 @@ export function readKeyFromEnv(provider, env = process.env) {
     }
     return undefined;
 }
+/**
+ * ggui#1132 — one line naming an alias conflict, or `undefined` when there is
+ * none. Only `google` has aliases. Names only, never values: the line is
+ * printed to stderr by `ggui provider-key set` and by the `ggui serve` banner.
+ */
+export function describeAliasConflict(provider, env = process.env) {
+    if (provider !== 'google')
+        return undefined;
+    const [primary, fallback] = ['GOOGLE_API_KEY', 'GEMINI_API_KEY'];
+    const a = env[primary];
+    const b = env[fallback];
+    if (!a || !b || a === b)
+        return undefined;
+    return (`${primary} won; ${fallback} is also set and differs — ` +
+        `a stale key in the shadowed alias wins silently, so rotate both or unset one (ggui#1132).`);
+}
 // ─────────────────────────────────────────────────────────────────────────────
 // Command runner
 // ─────────────────────────────────────────────────────────────────────────────
@@ -142,6 +164,7 @@ Subcommands:
           ANTHROPIC_API_KEY  (anthropic)
           OPENAI_API_KEY     (openai)
           GOOGLE_API_KEY     (google, primary); GEMINI_API_KEY (fallback)
+                             — if both are set and differ, the shadowed one is named
           OPENROUTER_API_KEY (openrouter)
 
 Options:
@@ -201,6 +224,9 @@ export async function runProviderKeyCommand(args, startDir = process.cwd()) {
     const provider = providerResult;
     // ── Read key from env ────────────────────────────────────────────────────
     const key = readKeyFromEnv(provider);
+    const conflict = describeAliasConflict(provider);
+    if (conflict !== undefined)
+        process.stderr.write(`ggui provider-key set: ${conflict}\n`);
     if (!key) {
         const primaryVar = envVarForProvider(provider);
         const hint = provider === 'google'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/cli",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "The `ggui` CLI — run the ggui protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
   "keywords": [
     "ggui",
@@ -37,22 +37,22 @@
     "@noble/hashes": "^1.6.0",
     "esbuild": "^0.28.2",
     "zod": "^4.3.6",
-    "@ggui-ai/agent-runtime": "0.20.0",
-    "@ggui-ai/artifact-manifest": "0.20.0",
-    "@ggui-ai/dev-stack": "0.20.0",
-    "@ggui-ai/design": "0.20.0",
-    "@ggui-ai/gadget-signing": "0.20.0",
-    "@ggui-ai/mcp-server": "0.20.0",
-    "@ggui-ai/mcp-server-core": "0.20.0",
-    "@ggui-ai/mcp-server-handlers": "0.20.0",
-    "@ggui-ai/preview-a2ui": "0.20.0",
-    "@ggui-ai/embedding-local": "0.20.0",
-    "@ggui-ai/registry-core": "0.20.0",
-    "@ggui-ai/iframe-runtime": "0.20.0",
-    "@ggui-ai/ui-gen": "0.20.0",
-    "@ggui-ai/ui-registry": "0.20.0",
-    "@ggui-ai/protocol": "0.20.0",
-    "@ggui-ai/project-config": "0.20.0"
+    "@ggui-ai/agent-runtime": "0.21.0",
+    "@ggui-ai/artifact-manifest": "0.21.0",
+    "@ggui-ai/design": "0.21.0",
+    "@ggui-ai/dev-stack": "0.21.0",
+    "@ggui-ai/gadget-signing": "0.21.0",
+    "@ggui-ai/embedding-local": "0.21.0",
+    "@ggui-ai/mcp-server-core": "0.21.0",
+    "@ggui-ai/mcp-server": "0.21.0",
+    "@ggui-ai/mcp-server-handlers": "0.21.0",
+    "@ggui-ai/preview-a2ui": "0.21.0",
+    "@ggui-ai/project-config": "0.21.0",
+    "@ggui-ai/protocol": "0.21.0",
+    "@ggui-ai/iframe-runtime": "0.21.0",
+    "@ggui-ai/registry-core": "0.21.0",
+    "@ggui-ai/ui-gen": "0.21.0",
+    "@ggui-ai/ui-registry": "0.21.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",