@minniexcode/codex-switch 0.0.8 → 0.0.10

package/dist/commands/handlers.js

@@ -48,16 +48,20 @@ const list_providers_1 = require("../app/list-providers");
 const remove_provider_1 = require("../app/remove-provider");
 const rollback_backup_1 = require("../app/rollback-backup");
 const run_doctor_1 = require("../app/run-doctor");
+const bridge_1 = require("../app/bridge");
 const setup_codex_1 = require("../app/setup-codex");
 const show_config_1 = require("../app/show-config");
 const show_provider_1 = require("../app/show-provider");
 const switch_provider_1 = require("../app/switch-provider");
 const config_1 = require("../domain/config");
 const errors_1 = require("../domain/errors");
+const setup_1 = require("../domain/setup");
 const providers_1 = require("../domain/providers");
 const add_interactive_1 = require("../interaction/add-interactive");
 const interactive_1 = require("../interaction/interactive");
 const prompt_1 = require("../interaction/prompt");
+const copilot_adapter_1 = require("../runtime/copilot-adapter");
+const copilot_cli_1 = require("../runtime/copilot-cli");
 const copilot_installer_1 = require("../runtime/copilot-installer");
 const config_repo_1 = require("../storage/config-repo");
 const codex_paths_1 = require("../storage/codex-paths");
@@ -90,6 +94,36 @@ async function handleRegisteredCommand(ctx, parsed, runtime = (0, prompt_1.creat
             return (0, get_current_profile_1.getCurrentProfile)(paths.configPath);
         case "status":
             return (0, get_status_1.getStatus)(paths.codexDir, paths.configPath, paths.providersPath, paths.authPath);
+        case "bridge-start": {
+            const providerName = parsed.positionals[0] ?? null;
+            return (0, bridge_1.startBridge)({
+                providersPath: paths.providersPath,
+                configPath: paths.configPath,
+                providerName,
+                runtime,
+                json: ctx.options.json,
+            });
+        }
+        case "bridge-stop": {
+            const providerName = parsed.positionals[0] ?? null;
+            return (0, bridge_1.stopBridge)({
+                providersPath: paths.providersPath,
+                configPath: paths.configPath,
+                providerName,
+                runtime,
+                json: ctx.options.json,
+            });
+        }
+        case "bridge-status": {
+            const providerName = parsed.positionals[0] ?? null;
+            return (0, bridge_1.statusBridge)({
+                providersPath: paths.providersPath,
+                configPath: paths.configPath,
+                providerName,
+                runtime,
+                json: ctx.options.json,
+            });
+        }
         case "init": {
             let codexDir = ctx.options.codexDir;
             const candidates = (0, config_repo_1.findCodexDirCandidates)(ctx.options.codexDirExplicit ? ctx.options.codexDir : null);
@@ -226,40 +260,70 @@ async function handleRegisteredCommand(ctx, parsed, runtime = (0, prompt_1.creat
             let tags = parsed.commandOptions.get("--tag") ?? [];
             let createProfile = (0, args_1.hasFlag)(parsed.commandOptions, "--create-profile");
             const copilot = (0, args_1.hasFlag)(parsed.commandOptions, "--copilot");
-            const bridgeHost = (0, args_1.getSingleOption)(parsed.commandOptions, "--bridge-host", false);
+            let bridgeHost = (0, args_1.getSingleOption)(parsed.commandOptions, "--bridge-host", false);
             const bridgePortValue = (0, args_1.getSingleOption)(parsed.commandOptions, "--bridge-port", false);
-            const bridgeApiKey = (0, args_1.getSingleOption)(parsed.commandOptions, "--bridge-api-key", false);
+            let bridgeApiKey = (0, args_1.getSingleOption)(parsed.commandOptions, "--bridge-api-key", false);
             let installCopilotSdk = (0, args_1.hasFlag)(parsed.commandOptions, "--install-copilot-sdk");
-            const bridgePort = bridgePortValue ? Number(bridgePortValue) : null;
+            let bridgePort = bridgePortValue ? Number(bridgePortValue) : null;
             if (copilot && apiKey) {
                 throw (0, errors_1.cliError)("INVALID_ARGUMENT", "--copilot does not allow --api-key. Use --bridge-api-key for the local bridge secret.");
             }
             if (bridgePortValue && (!Number.isInteger(bridgePort) || bridgePort === null || bridgePort <= 0)) {
                 throw (0, errors_1.cliError)("INVALID_ARGUMENT", "--bridge-port must be a positive integer.");
             }
-            if (copilot && !installCopilotSdk && (0, interactive_1.canPrompt)(runtime, ctx.options.json) && !(0, copilot_installer_1.probeCopilotSdkInstall)().installed) {
-                installCopilotSdk = await runtime.confirmAction("The optional Copilot SDK runtime is not installed. Install it now?");
+            if (copilot) {
+                installCopilotSdk = await ensureCopilotReadyForAdd({
+                    runtime,
+                    json: ctx.options.json,
+                    installCopilotSdk,
+                });
             }
             if (!providerName || !profile || (!apiKey && !copilot)) {
                 if (ctx.options.json || !runtime.isInteractive()) {
-                    throw (0, add_interactive_1.createNonInteractiveAddError)();
+                    throw (0, add_interactive_1.createNonInteractiveAddError)({ copilot });
+                }
+                if (copilot) {
+                    const prompted = await (0, add_interactive_1.collectCopilotAddInput)(runtime, {
+                        providerName,
+                        profile,
+                        model,
+                        note,
+                        tags,
+                    }, (candidate) => Boolean((0, providers_repo_1.readProvidersFileIfExists)(paths.providersPath).providers[candidate]), (candidate) => Boolean((0, config_repo_1.readStructuredConfig)(paths.configPath).profiles.find((profileView) => profileView.name === candidate)), {
+                        bridgeHost,
+                        bridgePort,
+                        bridgeApiKey,
+                    });
+                    providerName = prompted.providerName;
+                    profile = prompted.profile;
+                    model = prompted.model ?? null;
+                    note = prompted.note ?? null;
+                    tags = prompted.tags;
+                    createProfile = createProfile || prompted.createProfile;
+                    baseUrl = null;
+                    bridgeHost = prompted.bridgeHost ?? bridgeHost;
+                    bridgePort = prompted.bridgePort ?? bridgePort;
+                    bridgeApiKey = prompted.bridgeApiKey ?? bridgeApiKey;
+                }
+                else {
+                    const prompted = await (0, add_interactive_1.collectAddInput)(runtime, {
+                        providerName,
+                        profile,
+                        apiKey,
+                        model,
+                        baseUrl,
+                        note,
+                        tags,
+                    }, (candidate) => Boolean((0, providers_repo_1.readProvidersFileIfExists)(paths.providersPath).providers[candidate]), (candidate) => Boolean((0, config_repo_1.readStructuredConfig)(paths.configPath).profiles.find((profileView) => profileView.name === candidate)));
+                    providerName = prompted.providerName;
+                    profile = prompted.profile;
+                    apiKey = prompted.apiKey;
+                    model = prompted.model ?? null;
+                    baseUrl = prompted.baseUrl ?? null;
+                    note = prompted.note ?? null;
+                    tags = prompted.tags;
+                    createProfile = createProfile || prompted.createProfile;
                 }
-                const prompted = await (0, add_interactive_1.collectAddInput)(runtime, {
-                    providerName,
-                    profile,
-                    apiKey,
-                    baseUrl,
-                    note,
-                    tags,
-                }, (candidate) => Boolean((0, providers_repo_1.readProvidersFileIfExists)(paths.providersPath).providers[candidate]), (candidate) => Boolean((0, config_repo_1.readStructuredConfig)(paths.configPath).profiles.find((profileView) => profileView.name === candidate)));
-                providerName = prompted.providerName;
-                profile = prompted.profile;
-                apiKey = prompted.apiKey;
-                model = prompted.model ?? null;
-                baseUrl = prompted.baseUrl ?? null;
-                note = prompted.note ?? null;
-                tags = prompted.tags;
-                createProfile = createProfile || prompted.createProfile;
             }
             return (0, add_provider_1.addProvider)({
                 codexDir: paths.codexDir,
@@ -402,9 +466,25 @@ async function handleRegisteredCommand(ctx, parsed, runtime = (0, prompt_1.creat
             if (overwrite && merge) {
                 throw (0, errors_1.cliError)("INVALID_ARGUMENT", "migrate does not allow both --merge and --overwrite.");
             }
-            let strategy = overwrite ? "overwrite" : merge ? "merge" : null;
             const providersExists = fs.existsSync(setupPaths.providersPath);
-            if (providersExists && strategy === null) {
+            const document = (0, config_repo_1.readStructuredConfig)(setupPaths.configPath);
+            const currentProviders = providersExists ? (0, providers_1.validateProvidersShape)((0, providers_repo_1.readProvidersFileIfExists)(setupPaths.providersPath)) : null;
+            const adoptability = (0, setup_1.collectMigrateAdoptability)(document, currentProviders);
+            if (adoptability.availableProfiles.length === 0) {
+                throw (0, errors_1.cliError)("PROFILE_NOT_FOUND", "No profiles were found in config.toml.", {
+                    file: setupPaths.configPath,
+                });
+            }
+            if (adoptability.adoptableProfiles.length === 0) {
+                throw (0, errors_1.cliError)("MIGRATE_NO_ADOPTABLE_PROFILES", "No adoptable profiles were found for migrate.", {
+                    availableProfiles: adoptability.availableProfiles,
+                    adoptableProfiles: adoptability.adoptableProfiles,
+                    blockingReasonsByProfile: adoptability.blockingReasonsByProfile,
+                });
+            }
+            let strategy = overwrite ? "overwrite" : merge ? "merge" : null;
+            const registryIsEmpty = !currentProviders || Object.keys(currentProviders.providers).length === 0;
+            if (providersExists && strategy === null && !registryIsEmpty) {
                 if (!(0, interactive_1.canPrompt)(runtime, ctx.options.json)) {
                     throw (0, errors_1.cliError)("PROVIDERS_ALREADY_EXISTS", "providers.json already exists. Pass --merge or --overwrite.", {
                         file: setupPaths.providersPath,
@@ -416,35 +496,35 @@ async function handleRegisteredCommand(ctx, parsed, runtime = (0, prompt_1.creat
                 }
                 strategy = selected;
             }
-            const document = (0, config_repo_1.readStructuredConfig)(setupPaths.configPath);
-            const adoptableProfiles = (0, config_1.buildManagedProfileViews)(document, null)
-                .filter((view) => view.source === "unmanaged" && view.model && view.modelProvider === view.name && view.baseUrl && view.envKey)
-                .map((view) => ({
-                name: view.name,
-                model: view.model,
-                baseUrl: view.baseUrl,
-                envKey: view.envKey,
-            }))
-                .sort((left, right) => left.name.localeCompare(right.name));
-            const selectedProfiles = Array.from((0, config_repo_1.listConfigProfiles)(setupPaths.configPath)).sort();
+            const adoptableProfiles = adoptability.adoptableProfileDetails;
             let adoptProfiles = [];
             let providerDetailsByProfile = {};
             if ((0, interactive_1.canPrompt)(runtime, ctx.options.json)) {
                 adoptProfiles = await (0, interactive_1.chooseSetupProfiles)(runtime, adoptableProfiles);
                 // Defaults are derived from config.toml so interactive setup only asks for missing provider metadata.
-                providerDetailsByProfile = await (0, interactive_1.collectSetupProviderDetails)(runtime, adoptProfiles, adoptableProfiles.reduce((accumulator, profile) => {
+                const collectedDetails = await (0, interactive_1.collectSetupProviderDetails)(runtime, adoptProfiles, adoptableProfiles.reduce((accumulator, profile) => {
                     accumulator[profile.name] = {
                         providerName: profile.name,
-                        envKey: profile.envKey,
                         baseUrl: profile.baseUrl,
                     };
                     return accumulator;
                 }, {}));
+                providerDetailsByProfile = Object.fromEntries(Object.entries(collectedDetails).map(([profile, detail]) => [
+                    profile,
+                    {
+                        providerName: detail.providerName,
+                        apiKey: detail.apiKey,
+                        baseUrl: detail.baseUrl,
+                        note: detail.note,
+                        tags: detail.tags,
+                    },
+                ]));
             }
             else {
                 throw (0, errors_1.cliError)("INVALID_ARGUMENT", "migrate currently requires an interactive TTY to choose adoptable profiles and collect provider details.", {
-                    adoptableProfiles,
-                    availableProfiles: selectedProfiles,
+                    availableProfiles: adoptability.availableProfiles,
+                    adoptableProfiles: adoptability.adoptableProfiles,
+                    blockingReasonsByProfile: adoptability.blockingReasonsByProfile,
                     suggestion: "Run `codexs migrate` in an interactive terminal. Non-interactive migrate flags for profile selection and provider secrets are not available in this release.",
                 });
             }
@@ -483,3 +563,107 @@ async function handleRegisteredCommand(ctx, parsed, runtime = (0, prompt_1.creat
             throw (0, errors_1.cliError)("UNKNOWN_COMMAND", `Unknown command: ${ctx.command}`);
     }
 }
+/**
+ * Runs the deterministic Copilot onboarding preflight before any provider persistence.
+ */
+async function ensureCopilotReadyForAdd(args) {
+    let installCopilotSdk = args.installCopilotSdk;
+    const interactive = (0, interactive_1.canPrompt)(args.runtime, args.json);
+    if (interactive) {
+        args.runtime.writeLine("Checking Copilot SDK runtime...");
+    }
+    if (!(0, copilot_installer_1.probeCopilotSdkInstall)().installed) {
+        if (!interactive) {
+            if (!installCopilotSdk) {
+                const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)();
+                throw (0, errors_1.cliError)("COPILOT_SDK_INSTALL_REQUIRES_TTY", "The optional Copilot SDK runtime is not installed. Pass --install-copilot-sdk when running non-interactively.", {
+                    installDir: installStatus.installDir,
+                    packageName: installStatus.packageName,
+                });
+            }
+            (0, copilot_installer_1.installCopilotSdk)();
+        }
+        else {
+            if (!installCopilotSdk) {
+                installCopilotSdk = await args.runtime.confirmAction("The optional Copilot SDK runtime is not installed. Install it now?");
+            }
+            if (!installCopilotSdk) {
+                const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)();
+                throw (0, errors_1.cliError)("COPILOT_SDK_MISSING", "The optional Copilot SDK runtime is not installed. Re-run with --install-copilot-sdk or confirm installation interactively.", {
+                    installDir: installStatus.installDir,
+                    packageName: installStatus.packageName,
+                });
+            }
+            if (interactive) {
+                args.runtime.writeLine("Installing Copilot SDK runtime...");
+            }
+            (0, copilot_installer_1.installCopilotSdk)();
+            if (interactive) {
+                args.runtime.writeLine("Copilot SDK runtime installed.");
+            }
+        }
+    }
+    if (interactive) {
+        args.runtime.writeLine("Checking GitHub Copilot login...");
+    }
+    try {
+        await (0, copilot_adapter_1.readCopilotAuthState)();
+        return installCopilotSdk;
+    }
+    catch (error) {
+        const normalized = (0, errors_1.normalizeError)(error);
+        if (normalized.code !== "COPILOT_AUTH_REQUIRED") {
+            throw error;
+        }
+        if (!interactive) {
+            throw (0, errors_1.cliError)("COPILOT_AUTH_REQUIRED", "Copilot authentication is required before the local bridge can be added.", {
+                ...(normalized.details ?? {}),
+                manualLoginCommand: "copilot login",
+                suggestion: "Run `copilot login` manually or provide supported Copilot SDK credentials, then rerun add --copilot.",
+            });
+        }
+        args.runtime.writeLine("GitHub Copilot login is required. Starting official copilot login...");
+        let loginLaunchCause;
+        try {
+            const availability = (0, copilot_cli_1.checkCopilotCliAvailable)();
+            if (!availability.ok) {
+                throw new Error(availability.cause ?? "copilot CLI is unavailable");
+            }
+            (0, copilot_cli_1.runCopilotLogin)();
+        }
+        catch (launchError) {
+            loginLaunchCause = launchError instanceof Error ? launchError.message : String(launchError);
+            args.runtime.writeLine("Unable to launch the official Copilot login automatically.");
+            args.runtime.writeLine("Run this command in the current terminal: copilot login");
+            args.runtime.writeLine("GitHub's official device flow should open the browser or show the verification URL and code.");
+        }
+        args.runtime.writeLine("GitHub Copilot login completed. Rechecking session...");
+        const retry = await args.runtime.confirmAction("Recheck GitHub Copilot login now?", {
+            defaultValue: true,
+        });
+        if (!retry) {
+            throw (0, errors_1.cliError)("COPILOT_AUTH_REQUIRED", "Copilot authentication is required before the local bridge can be added.", {
+                ...(normalized.details ?? {}),
+                manualLoginCommand: "copilot login",
+                loginLaunchCause,
+                suggestion: "Complete GitHub Copilot login with the official tooling, then rerun add --copilot.",
+            });
+        }
+        try {
+            await (0, copilot_adapter_1.readCopilotAuthState)();
+            return installCopilotSdk;
+        }
+        catch (recheckError) {
+            const rechecked = (0, errors_1.normalizeError)(recheckError);
+            if (rechecked.code !== "COPILOT_AUTH_REQUIRED") {
+                throw recheckError;
+            }
+            throw (0, errors_1.cliError)("COPILOT_AUTH_REQUIRED", "Copilot authentication is required before the local bridge can be added.", {
+                ...(rechecked.details ?? {}),
+                manualLoginCommand: "copilot login",
+                loginLaunchCause,
+                suggestion: "Complete GitHub Copilot login with the official tooling, then rerun add --copilot.",
+            });
+        }
+    }
+}

package/dist/commands/help.js

@@ -63,6 +63,7 @@ function buildHelpText(commandName) {
             "  codexs migrate",
             "  codexs list",
             "  codexs switch",
+            "  codexs bridge start",
             "  codexs add packycode --profile packycode --api-key sk-xxx",
             "  codexs config show",
             "  codexs remove freemodel",

package/dist/commands/registry.js

@@ -41,6 +41,48 @@ exports.COMMANDS = [
         ],
         examples: ["codexs config list-profiles", "codexs config list-profiles --json"],
     },
+    {
+        id: "bridge-start",
+        tokens: ["bridge", "start"],
+        handler: handlers_1.handleRegisteredCommand,
+        group: "write",
+        summary: "Start or reuse the managed Copilot bridge.",
+        usage: ["codexs bridge start [provider] [--json] [--codex-dir <path>]"],
+        details: [
+            "Resolves a Copilot bridge provider by explicit name, active provider, sole provider, or TTY selection.",
+            "Reuses a healthy bridge for the same provider and replaces a different managed provider when needed.",
+            "If the preferred port is occupied, automatically selects another free 5-digit port and persists it.",
+        ],
+        examples: ["codexs bridge start", "codexs bridge start copilot-main"],
+    },
+    {
+        id: "bridge-stop",
+        tokens: ["bridge", "stop"],
+        handler: handlers_1.handleRegisteredCommand,
+        group: "recovery",
+        summary: "Stop the managed Copilot bridge.",
+        usage: ["codexs bridge stop [provider] [--json] [--codex-dir <path>]"],
+        details: [
+            "Prefers the runtime-state instance when present and uses an explicit provider as a guard.",
+            "Clears the runtime-state manifest without mutating providers.json or Codex auth state.",
+            "Is idempotent when no managed bridge is currently running.",
+        ],
+        examples: ["codexs bridge stop", "codexs bridge stop copilot-main"],
+    },
+    {
+        id: "bridge-status",
+        tokens: ["bridge", "status"],
+        handler: handlers_1.handleRegisteredCommand,
+        group: "read",
+        summary: "Inspect the managed Copilot bridge.",
+        usage: ["codexs bridge status [provider] [--json] [--codex-dir <path>]"],
+        details: [
+            "Reports runtime-state, provider binding, and whether the live worker matches the expected provider.",
+            "Prefers the runtime-state instance when one is present.",
+            "Uses an explicit provider as a guard instead of silently switching targets.",
+        ],
+        examples: ["codexs bridge status", "codexs bridge status copilot-main"],
+    },
     {
         id: "init",
         tokens: ["init"],
@@ -66,7 +108,7 @@ exports.COMMANDS = [
         details: [
             "Reads config.toml profiles, collects complete provider records, then writes providers.json under managed backup flow.",
             "TTY mode can collect missing provider details and choose merge or overwrite when providers.json already exists.",
-            "Migrate adopts only runtime profiles that already expose model, model_provider, matching base_url, and env_key.",
+            "Migrate adopts only runtime profiles that already expose model, model_provider, and matching base_url.",
             "Non-TTY and --json runs still fail fast because migrate profile selection and provider details remain interactive in this release.",
         ],
         examples: ["codexs migrate", "codexs migrate --overwrite --json --codex-dir ~/.codex"],
@@ -173,6 +215,7 @@ exports.COMMANDS = [
             "Automation and non-TTY environments must pass all required values explicitly.",
             "Creating a missing profile section requires --create-profile together with --model and --base-url.",
             "Use --copilot to create a GitHub Copilot bridge provider backed by the official SDK.",
+            "TTY add --copilot checks SDK install and GitHub Copilot login before it asks for Copilot provider fields.",
         ],
         examples: [
             "codexs add packycode --profile packycode --api-key sk-xxx",
@@ -185,14 +228,15 @@ exports.COMMANDS = [
         tokens: ["switch"],
         handler: handlers_1.handleRegisteredCommand,
         group: "write",
-        summary: "Switch to a provider and rewrite the managed auth mirror.",
+        summary: "Switch the active config profile to a provider.",
         usage: ["codexs switch <provider> [--json] [--codex-dir <path>]"],
         details: [
             "When <provider> is omitted in a TTY, an interactive provider selector is shown.",
             "When <provider> is passed explicitly, switch proceeds directly without extra confirmation.",
-            "Switch updates the active config profile and rewrites auth.json from the provider envKey/apiKey pair.",
+            "Direct providers update the active config profile and rewrite auth.json with auth_mode=apikey plus OPENAI_API_KEY.",
+            "Copilot bridge providers still manage runtime routing and bridge state instead of rewriting OPENAI_API_KEY.",
             "Copilot bridge providers probe the optional official SDK before switching and fail fast if it is missing.",
-            "Backs up config.toml and auth.json, then rolls back on failure.",
+            "Backs up config.toml and auth.json and rolls back on failure.",
         ],
         examples: ["codexs switch freemodel", "codexs switch packycode --json"],
     },

package/dist/domain/config.js

@@ -41,7 +41,6 @@ exports.parseStructuredConfig = parseStructuredConfig;
 exports.buildManagedProfileViews = buildManagedProfileViews;
 exports.collectConfigConsistencyIssues = collectConfigConsistencyIssues;
 exports.validateManagedProfileCreation = validateManagedProfileCreation;
-exports.buildManagedProfileEnvKey = buildManagedProfileEnvKey;
 exports.planProfileLifecycleOutcome = planProfileLifecycleOutcome;
 exports.planConfigMutation = planConfigMutation;
 exports.applyPatchOperations = applyPatchOperations;
@@ -120,8 +119,6 @@ function parseStructuredConfig(configContent) {
                 sectionEnd: configContent.length,
                 baseUrlValueRange: null,
                 baseUrl: null,
-                envKeyValueRange: null,
-                envKey: null,
             };
             modelProviders.push(currentModelProvider);
             inRoot = false;
@@ -176,14 +173,6 @@ function parseStructuredConfig(configContent) {
                     end: line.start + baseUrlMatch.valueEnd,
                 };
             }
-            const envKeyMatch = matchKeyValueLine(line.content, "env_key");
-            if (envKeyMatch) {
-                currentModelProvider.envKey = envKeyMatch.value;
-                currentModelProvider.envKeyValueRange = {
-                    start: line.start + envKeyMatch.valueStart,
-                    end: line.start + envKeyMatch.valueEnd,
-                };
-            }
         }
     }
     return {
@@ -218,7 +207,6 @@ function buildManagedProfileViews(document, providers) {
             model: section.model,
             modelProvider: section.modelProvider,
             baseUrl: modelProviderSection?.baseUrl ?? null,
-            envKey: modelProviderSection?.envKey ?? null,
             managedFields: collectManagedFields(section.model, section.modelProvider),
             source: linkInfo.managed ? "managed" : "unmanaged",
         });
@@ -235,7 +223,6 @@ function buildManagedProfileViews(document, providers) {
             model: null,
             modelProvider: null,
             baseUrl: null,
-            envKey: null,
             managedFields: [],
             source: "orphaned-reference",
         });
@@ -298,28 +285,6 @@ function collectConfigConsistencyIssues(document, providers) {
                         modelProvider: view.modelProvider,
                     });
                 }
-                else if (!modelProviderSection.envKey) {
-                    issues.push({
-                        code: "MODEL_PROVIDER_ENV_KEY_MISSING",
-                        profile: view.name,
-                        modelProvider: view.modelProvider,
-                    });
-                }
-            }
-            for (const providerName of view.linkedProviders) {
-                const provider = providers?.providers[providerName];
-                if (!provider) {
-                    continue;
-                }
-                if (provider.envKey !== view.envKey) {
-                    issues.push({
-                        code: "PROVIDER_ENV_KEY_MISMATCH",
-                        provider: providerName,
-                        profile: view.name,
-                        providerEnvKey: provider.envKey,
-                        runtimeEnvKey: view.envKey,
-                    });
-                }
             }
         }
     }
@@ -366,17 +331,6 @@ function validateManagedProfileCreation(profile, fields) {
         modelProvider,
     };
 }
-/**
- * Normalizes a profile name into the default env_key used for generated runtime sections.
- */
-function buildManagedProfileEnvKey(profile) {
-    const normalized = profile
-        .trim()
-        .replace(/[^A-Za-z0-9]+/g, "_")
-        .replace(/^_+|_+$/g, "")
-        .toUpperCase();
-    return `${normalized || "PROVIDER"}_API_KEY`;
-}
 /**
  * Computes keep/delete/switch outcomes when a provider leaves or changes profiles.
  */
@@ -491,14 +445,12 @@ function planConfigMutation(document, args) {
         const section = modelProviderSectionMap.get(profileName);
         if (!section) {
             const baseUrl = fields.baseUrl?.trim() ?? "";
-            const envKey = fields.envKey?.trim() ?? "";
-            if (!baseUrl || !envKey) {
-                throw (0, errors_1.cliError)("MANAGED_PROFILE_FIELDS_MISSING", `Model provider "${profileName}" requires both base_url and env_key.`, {
+            if (!baseUrl) {
+                throw (0, errors_1.cliError)("MANAGED_PROFILE_FIELDS_MISSING", `Model provider "${profileName}" requires base_url.`, {
                     profile: profileName,
                     modelProvider: profileName,
                     missingFields: [
                         !baseUrl ? "base_url" : null,
-                        !envKey ? "env_key" : null,
                     ].filter((value) => Boolean(value)),
                 });
             }
@@ -509,8 +461,7 @@ function planConfigMutation(document, args) {
                 kind: "insert-at",
                 index: document.rawText.length,
                 text: `${prefix}[model_providers.${profileName}]${document.lineEnding}` +
-                    `base_url = ${JSON.stringify(baseUrl)}${document.lineEnding}` +
-                    `env_key = ${JSON.stringify(envKey)}${document.lineEnding}`,
+                    `base_url = ${JSON.stringify(baseUrl)}${document.lineEnding}`,
             });
             createdModelProviderSections.push(profileName);
             continue;
@@ -594,12 +545,11 @@ function planSectionFieldMutation(document, section, fields, operations) {
     return updated;
 }
 /**
- * Plans base_url/env_key updates for one model_providers section.
+ * Plans base_url updates for one model_providers section.
  */
 function planModelProviderFieldMutation(section, fields, operations) {
     let updated = false;
     const baseUrlText = fields.baseUrl !== undefined ? JSON.stringify(fields.baseUrl) : null;
-    const envKeyText = fields.envKey !== undefined ? JSON.stringify(fields.envKey) : null;
     const inserts = [];
     if (baseUrlText !== null && section.baseUrlValueRange) {
         if (section.baseUrl !== fields.baseUrl) {
@@ -615,20 +565,6 @@ function planModelProviderFieldMutation(section, fields, operations) {
     else if (baseUrlText !== null) {
         inserts.push(`base_url = ${baseUrlText}`);
     }
-    if (envKeyText !== null && section.envKeyValueRange) {
-        if (section.envKey !== fields.envKey) {
-            operations.push({
-                kind: "replace-range",
-                start: section.envKeyValueRange.start,
-                end: section.envKeyValueRange.end,
-                text: envKeyText,
-            });
-            updated = true;
-        }
-    }
-    else if (envKeyText !== null) {
-        inserts.push(`env_key = ${envKeyText}`);
-    }
     if (inserts.length > 0) {
         operations.push({
             kind: "insert-at",

package/dist/domain/providers.js

@@ -32,9 +32,6 @@ function validateProvidersShape(input) {
         if (typeof provider.apiKey !== "string" || provider.apiKey.trim() === "") {
             throw new Error(`Provider "${name}" is missing a valid apiKey.`);
         }
-        if (typeof provider.envKey !== "string" || provider.envKey.trim() === "") {
-            throw new Error(`Provider "${name}" is missing a valid envKey.`);
-        }
         if (provider.baseUrl !== undefined && typeof provider.baseUrl !== "string") {
             throw new Error(`Provider "${name}" has an invalid baseUrl.`);
         }
@@ -56,7 +53,6 @@ function validateProvidersShape(input) {
         providers[name] = cleanProviderRecord({
             profile: provider.profile,
             apiKey: provider.apiKey,
-            envKey: provider.envKey,
             baseUrl: provider.baseUrl,
             note: provider.note,
             tags: provider.tags,
@@ -72,7 +68,6 @@ function cleanProviderRecord(record) {
     const next = {
         profile: record.profile.trim(),
         apiKey: record.apiKey.trim(),
-        envKey: record.envKey.trim(),
     };
     if (record.baseUrl && record.baseUrl.trim() !== "") {
         next.baseUrl = record.baseUrl.trim();

package/dist/domain/runtime-state.js

@@ -8,7 +8,8 @@ exports.inspectLiveStateDrift = inspectLiveStateDrift;
 function getStorageRoles() {
     return {
         managementSSOT: "providers.json",
-        runtimeMirrors: ["config.toml", "auth.json"],
+        runtimeMirrors: ["config.toml"],
+        authStateFile: "auth.json",
         rollbackState: "backups/latest.json",
     };
 }