@poolzin/pool-bot 2026.2.4 → 2026.2.6

package/dist/commands/auth-choice.apply.api-providers.js

@@ -1,10 +1,13 @@
 import { ensureAuthProfileStore, resolveAuthProfileOrder } from "../agents/auth-profiles.js";
 import { resolveEnvApiKey } from "../agents/model-auth.js";
 import { formatApiKeyPreview, normalizeApiKeyInput, validateApiKeyInput, } from "./auth-choice.api-key.js";
+import { applyAuthChoiceHuggingface } from "./auth-choice.apply.huggingface.js";
+import { applyAuthChoiceOpenRouter } from "./auth-choice.apply.openrouter.js";
 import { applyDefaultModelChoice } from "./auth-choice.default-model.js";
 import { applyGoogleGeminiModelDefault, GOOGLE_GEMINI_DEFAULT_MODEL, } from "./google-gemini-model-default.js";
-import { applyAuthProfileConfig, applyCloudflareAiGatewayConfig, applyCloudflareAiGatewayProviderConfig, applyQianfanConfig, applyQianfanProviderConfig, applyKimiCodeConfig, applyKimiCodeProviderConfig, applyMoonshotConfig, applyMoonshotConfigCn, applyMoonshotProviderConfig, applyMoonshotProviderConfigCn, applyOpencodeZenConfig, applyOpencodeZenProviderConfig, applyOpenrouterConfig, applyOpenrouterProviderConfig, applySyntheticConfig, applySyntheticProviderConfig, applyTogetherConfig, applyTogetherProviderConfig, applyVeniceConfig, applyVeniceProviderConfig, applyVercelAiGatewayConfig, applyVercelAiGatewayProviderConfig, applyXiaomiConfig, applyXiaomiProviderConfig, applyZaiConfig, CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, QIANFAN_DEFAULT_MODEL_REF, KIMI_CODING_MODEL_REF, MOONSHOT_DEFAULT_MODEL_REF, OPENROUTER_DEFAULT_MODEL_REF, SYNTHETIC_DEFAULT_MODEL_REF, TOGETHER_DEFAULT_MODEL_REF, VENICE_DEFAULT_MODEL_REF, VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, XIAOMI_DEFAULT_MODEL_REF, setCloudflareAiGatewayConfig, setQianfanApiKey, setGeminiApiKey, setKimiCodingApiKey, setMoonshotApiKey, setOpencodeZenApiKey, setOpenrouterApiKey, setSyntheticApiKey, setTogetherApiKey, setVeniceApiKey, setVercelAiGatewayApiKey, setXiaomiApiKey, setZaiApiKey, ZAI_DEFAULT_MODEL_REF, } from "./onboard-auth.js";
+import { applyAuthProfileConfig, applyCloudflareAiGatewayConfig, applyCloudflareAiGatewayProviderConfig, applyQianfanConfig, applyQianfanProviderConfig, applyKimiCodeConfig, applyKimiCodeProviderConfig, applyLitellmConfig, applyLitellmProviderConfig, applyMoonshotConfig, applyMoonshotConfigCn, applyMoonshotProviderConfig, applyMoonshotProviderConfigCn, applyNvidiaConfig, applyNvidiaProviderConfig, applyOpencodeZenConfig, applyOpencodeZenProviderConfig, applySyntheticConfig, applySyntheticProviderConfig, applyTogetherConfig, applyTogetherProviderConfig, applyVeniceConfig, applyVeniceProviderConfig, applyVercelAiGatewayConfig, applyVercelAiGatewayProviderConfig, applyXiaomiConfig, applyXiaomiProviderConfig, applyZaiConfig, applyZaiProviderConfig, CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, LITELLM_DEFAULT_MODEL_REF, NVIDIA_DEFAULT_MODEL_REF, QIANFAN_DEFAULT_MODEL_REF, KIMI_CODING_MODEL_REF, MOONSHOT_DEFAULT_MODEL_REF, SYNTHETIC_DEFAULT_MODEL_REF, TOGETHER_DEFAULT_MODEL_REF, VENICE_DEFAULT_MODEL_REF, VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, XIAOMI_DEFAULT_MODEL_REF, setCloudflareAiGatewayConfig, setQianfanApiKey, setGeminiApiKey, setLitellmApiKey, setKimiCodingApiKey, setMoonshotApiKey, setNvidiaApiKey, setOpencodeZenApiKey, setSyntheticApiKey, setTogetherApiKey, setVeniceApiKey, setVercelAiGatewayApiKey, setXiaomiApiKey, setZaiApiKey, ZAI_DEFAULT_MODEL_REF, } from "./onboard-auth.js";
 import { OPENCODE_ZEN_DEFAULT_MODEL } from "./opencode-zen-model-default.js";
+import { detectZaiEndpoint } from "./zai-endpoint-detect.js";
 export async function applyAuthChoiceApiProviders(params) {
     let nextConfig = params.config;
     let agentModelOverride;
@@ -22,6 +25,9 @@ export async function applyAuthChoiceApiProviders(params) {
         if (params.opts.tokenProvider === "openrouter") {
             authChoice = "openrouter-api-key";
         }
+        else if (params.opts.tokenProvider === "litellm") {
+            authChoice = "litellm-api-key";
+        }
         else if (params.opts.tokenProvider === "vercel-ai-gateway") {
             authChoice = "ai-gateway-api-key";
         }
@@ -53,83 +59,78 @@ export async function applyAuthChoiceApiProviders(params) {
         else if (params.opts.tokenProvider === "together") {
             authChoice = "together-api-key";
         }
+        else if (params.opts.tokenProvider === "huggingface") {
+            authChoice = "huggingface-api-key";
+        }
         else if (params.opts.tokenProvider === "opencode") {
             authChoice = "opencode-zen";
         }
         else if (params.opts.tokenProvider === "qianfan") {
             authChoice = "qianfan-api-key";
         }
+        else if (params.opts.tokenProvider === "nvidia") {
+            authChoice = "nvidia-api-key";
+        }
     }
     if (authChoice === "openrouter-api-key") {
-        const store = ensureAuthProfileStore(params.agentDir, {
-            allowKeychainPrompt: false,
-        });
-        const profileOrder = resolveAuthProfileOrder({
-            cfg: nextConfig,
-            store,
-            provider: "openrouter",
-        });
+        return applyAuthChoiceOpenRouter(params);
+    }
+    if (authChoice === "litellm-api-key") {
+        const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
+        const profileOrder = resolveAuthProfileOrder({ cfg: nextConfig, store, provider: "litellm" });
         const existingProfileId = profileOrder.find((profileId) => Boolean(store.profiles[profileId]));
         const existingCred = existingProfileId ? store.profiles[existingProfileId] : undefined;
-        let profileId = "openrouter:default";
-        let mode = "api_key";
+        let profileId = "litellm:default";
         let hasCredential = false;
-        if (existingProfileId && existingCred?.type) {
+        if (existingProfileId && existingCred?.type === "api_key") {
             profileId = existingProfileId;
-            mode =
-                existingCred.type === "oauth"
-                    ? "oauth"
-                    : existingCred.type === "token"
-                        ? "token"
-                        : "api_key";
             hasCredential = true;
         }
-        if (!hasCredential && params.opts?.token && params.opts?.tokenProvider === "openrouter") {
-            await setOpenrouterApiKey(normalizeApiKeyInput(params.opts.token), params.agentDir);
+        if (!hasCredential && params.opts?.token && params.opts?.tokenProvider === "litellm") {
+            await setLitellmApiKey(normalizeApiKeyInput(params.opts.token), params.agentDir);
             hasCredential = true;
         }
         if (!hasCredential) {
-            const envKey = resolveEnvApiKey("openrouter");
+            await params.prompter.note("LiteLLM provides a unified API to 100+ LLM providers.\nGet your API key from your LiteLLM proxy or https://litellm.ai\nDefault proxy runs on http://localhost:4000", "LiteLLM");
+            const envKey = resolveEnvApiKey("litellm");
             if (envKey) {
                 const useExisting = await params.prompter.confirm({
-                    message: `Use existing OPENROUTER_API_KEY (${envKey.source}, ${formatApiKeyPreview(envKey.apiKey)})?`,
+                    message: `Use existing LITELLM_API_KEY (${envKey.source}, ${formatApiKeyPreview(envKey.apiKey)})?`,
                     initialValue: true,
                 });
                 if (useExisting) {
-                    await setOpenrouterApiKey(envKey.apiKey, params.agentDir);
+                    await setLitellmApiKey(envKey.apiKey, params.agentDir);
                     hasCredential = true;
                 }
             }
-        }
-        if (!hasCredential) {
-            const key = await params.prompter.text({
-                message: "Enter OpenRouter API key",
-                validate: validateApiKeyInput,
-            });
-            await setOpenrouterApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
-            hasCredential = true;
+            if (!hasCredential) {
+                const key = await params.prompter.text({
+                    message: "Enter LiteLLM API key",
+                    validate: validateApiKeyInput,
+                });
+                await setLitellmApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
+                hasCredential = true;
+            }
         }
         if (hasCredential) {
             nextConfig = applyAuthProfileConfig(nextConfig, {
                 profileId,
-                provider: "openrouter",
-                mode,
-            });
-        }
-        {
-            const applied = await applyDefaultModelChoice({
-                config: nextConfig,
-                setDefaultModel: params.setDefaultModel,
-                defaultModel: OPENROUTER_DEFAULT_MODEL_REF,
-                applyDefaultConfig: applyOpenrouterConfig,
-                applyProviderConfig: applyOpenrouterProviderConfig,
-                noteDefault: OPENROUTER_DEFAULT_MODEL_REF,
-                noteAgentModel,
-                prompter: params.prompter,
+                provider: "litellm",
+                mode: "api_key",
             });
-            nextConfig = applied.config;
-            agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
         }
+        const applied = await applyDefaultModelChoice({
+            config: nextConfig,
+            setDefaultModel: params.setDefaultModel,
+            defaultModel: LITELLM_DEFAULT_MODEL_REF,
+            applyDefaultConfig: applyLitellmConfig,
+            applyProviderConfig: applyLitellmProviderConfig,
+            noteDefault: LITELLM_DEFAULT_MODEL_REF,
+            noteAgentModel,
+            prompter: params.prompter,
+        });
+        nextConfig = applied.config;
+        agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
         return { config: nextConfig, agentModelOverride };
     }
     if (authChoice === "ai-gateway-api-key") {
@@ -156,7 +157,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Vercel AI Gateway API key",
                 validate: validateApiKeyInput,
             });
-            await setVercelAiGatewayApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setVercelAiGatewayApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "vercel-ai-gateway:default",
@@ -187,16 +188,16 @@ export async function applyAuthChoiceApiProviders(params) {
             if (!accountId) {
                 const value = await params.prompter.text({
                     message: "Enter Cloudflare Account ID",
-                    validate: (val) => (String(val).trim() ? undefined : "Account ID is required"),
+                    validate: (val) => (String(val ?? "").trim() ? undefined : "Account ID is required"),
                 });
-                accountId = String(value).trim();
+                accountId = String(value ?? "").trim();
             }
             if (!gatewayId) {
                 const value = await params.prompter.text({
                     message: "Enter Cloudflare AI Gateway ID",
-                    validate: (val) => (String(val).trim() ? undefined : "Gateway ID is required"),
+                    validate: (val) => (String(val ?? "").trim() ? undefined : "Gateway ID is required"),
                 });
-                gatewayId = String(value).trim();
+                gatewayId = String(value ?? "").trim();
             }
         };
         const optsApiKey = normalizeApiKeyInput(params.opts?.cloudflareAiGatewayApiKey ?? "");
@@ -227,7 +228,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Cloudflare AI Gateway API key",
                 validate: validateApiKeyInput,
             });
-            await setCloudflareAiGatewayConfig(accountId, gatewayId, normalizeApiKeyInput(String(key)), params.agentDir);
+            await setCloudflareAiGatewayConfig(accountId, gatewayId, normalizeApiKeyInput(String(key ?? "")), params.agentDir);
             hasCredential = true;
         }
         if (hasCredential) {
@@ -281,7 +282,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Moonshot API key",
                 validate: validateApiKeyInput,
             });
-            await setMoonshotApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setMoonshotApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "moonshot:default",
@@ -325,7 +326,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Moonshot API key (.cn)",
                 validate: validateApiKeyInput,
             });
-            await setMoonshotApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setMoonshotApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "moonshot:default",
@@ -378,7 +379,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Kimi Coding API key",
                 validate: validateApiKeyInput,
             });
-            await setKimiCodingApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setKimiCodingApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "kimi-coding:default",
@@ -423,7 +424,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Gemini API key",
                 validate: validateApiKeyInput,
             });
-            await setGeminiApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setGeminiApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "google:default",
@@ -443,10 +444,30 @@ export async function applyAuthChoiceApiProviders(params) {
         }
         return { config: nextConfig, agentModelOverride };
     }
-    if (authChoice === "zai-api-key") {
+    if (authChoice === "zai-api-key" ||
+        authChoice === "zai-coding-global" ||
+        authChoice === "zai-coding-cn" ||
+        authChoice === "zai-global" ||
+        authChoice === "zai-cn") {
+        let endpoint;
+        if (authChoice === "zai-coding-global") {
+            endpoint = "coding-global";
+        }
+        else if (authChoice === "zai-coding-cn") {
+            endpoint = "coding-cn";
+        }
+        else if (authChoice === "zai-global") {
+            endpoint = "global";
+        }
+        else if (authChoice === "zai-cn") {
+            endpoint = "cn";
+        }
+        // Input API key
         let hasCredential = false;
+        let apiKey = "";
         if (!hasCredential && params.opts?.token && params.opts?.tokenProvider === "zai") {
-            await setZaiApiKey(normalizeApiKeyInput(params.opts.token), params.agentDir);
+            apiKey = normalizeApiKeyInput(params.opts.token);
+            await setZaiApiKey(apiKey, params.agentDir);
             hasCredential = true;
         }
         const envKey = resolveEnvApiKey("zai");
@@ -456,7 +477,8 @@ export async function applyAuthChoiceApiProviders(params) {
                 initialValue: true,
             });
             if (useExisting) {
-                await setZaiApiKey(envKey.apiKey, params.agentDir);
+                apiKey = envKey.apiKey;
+                await setZaiApiKey(apiKey, params.agentDir);
                 hasCredential = true;
             }
         }
@@ -465,42 +487,71 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Z.AI API key",
                 validate: validateApiKeyInput,
             });
-            await setZaiApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            apiKey = normalizeApiKeyInput(String(key ?? ""));
+            await setZaiApiKey(apiKey, params.agentDir);
+        }
+        // zai-api-key: auto-detect endpoint + choose a working default model.
+        let modelIdOverride;
+        if (!endpoint) {
+            const detected = await detectZaiEndpoint({ apiKey });
+            if (detected) {
+                endpoint = detected.endpoint;
+                modelIdOverride = detected.modelId;
+                await params.prompter.note(detected.note, "Z.AI endpoint");
+            }
+            else {
+                endpoint = await params.prompter.select({
+                    message: "Select Z.AI endpoint",
+                    options: [
+                        {
+                            value: "coding-global",
+                            label: "Coding-Plan-Global",
+                            hint: "GLM Coding Plan Global (api.z.ai)",
+                        },
+                        {
+                            value: "coding-cn",
+                            label: "Coding-Plan-CN",
+                            hint: "GLM Coding Plan CN (open.bigmodel.cn)",
+                        },
+                        {
+                            value: "global",
+                            label: "Global",
+                            hint: "Z.AI Global (api.z.ai)",
+                        },
+                        {
+                            value: "cn",
+                            label: "CN",
+                            hint: "Z.AI CN (open.bigmodel.cn)",
+                        },
+                    ],
+                    initialValue: "global",
+                });
+            }
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "zai:default",
             provider: "zai",
             mode: "api_key",
         });
-        {
-            const applied = await applyDefaultModelChoice({
-                config: nextConfig,
-                setDefaultModel: params.setDefaultModel,
-                defaultModel: ZAI_DEFAULT_MODEL_REF,
-                applyDefaultConfig: applyZaiConfig,
-                applyProviderConfig: (config) => ({
-                    ...config,
-                    agents: {
-                        ...config.agents,
-                        defaults: {
-                            ...config.agents?.defaults,
-                            models: {
-                                ...config.agents?.defaults?.models,
-                                [ZAI_DEFAULT_MODEL_REF]: {
-                                    ...config.agents?.defaults?.models?.[ZAI_DEFAULT_MODEL_REF],
-                                    alias: config.agents?.defaults?.models?.[ZAI_DEFAULT_MODEL_REF]?.alias ?? "GLM",
-                                },
-                            },
-                        },
-                    },
-                }),
-                noteDefault: ZAI_DEFAULT_MODEL_REF,
-                noteAgentModel,
-                prompter: params.prompter,
-            });
-            nextConfig = applied.config;
-            agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
-        }
+        const defaultModel = modelIdOverride ? `zai/${modelIdOverride}` : ZAI_DEFAULT_MODEL_REF;
+        const applied = await applyDefaultModelChoice({
+            config: nextConfig,
+            setDefaultModel: params.setDefaultModel,
+            defaultModel,
+            applyDefaultConfig: (config) => applyZaiConfig(config, {
+                endpoint,
+                ...(modelIdOverride ? { modelId: modelIdOverride } : {}),
+            }),
+            applyProviderConfig: (config) => applyZaiProviderConfig(config, {
+                endpoint,
+                ...(modelIdOverride ? { modelId: modelIdOverride } : {}),
+            }),
+            noteDefault: defaultModel,
+            noteAgentModel,
+            prompter: params.prompter,
+        });
+        nextConfig = applied.config;
+        agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
         return { config: nextConfig, agentModelOverride };
     }
     if (authChoice === "xiaomi-api-key") {
@@ -525,7 +576,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Xiaomi API key",
                 validate: validateApiKeyInput,
             });
-            await setXiaomiApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setXiaomiApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "xiaomi:default",
@@ -550,14 +601,14 @@ export async function applyAuthChoiceApiProviders(params) {
     }
     if (authChoice === "synthetic-api-key") {
         if (params.opts?.token && params.opts?.tokenProvider === "synthetic") {
-            await setSyntheticApiKey(String(params.opts.token).trim(), params.agentDir);
+            await setSyntheticApiKey(String(params.opts.token ?? "").trim(), params.agentDir);
         }
         else {
             const key = await params.prompter.text({
                 message: "Enter Synthetic API key",
                 validate: (value) => (value?.trim() ? undefined : "Required"),
             });
-            await setSyntheticApiKey(String(key).trim(), params.agentDir);
+            await setSyntheticApiKey(String(key ?? "").trim(), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "synthetic:default",
@@ -609,7 +660,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Venice AI API key",
                 validate: validateApiKeyInput,
             });
-            await setVeniceApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setVeniceApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "venice:default",
@@ -661,7 +712,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter OpenCode Zen API key",
                 validate: validateApiKeyInput,
             });
-            await setOpencodeZenApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setOpencodeZenApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "opencode:default",
@@ -712,7 +763,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter Together AI API key",
                 validate: validateApiKeyInput,
             });
-            await setTogetherApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            await setTogetherApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "together:default",
@@ -735,6 +786,9 @@ export async function applyAuthChoiceApiProviders(params) {
         }
         return { config: nextConfig, agentModelOverride };
     }
+    if (authChoice === "huggingface-api-key") {
+        return applyAuthChoiceHuggingface({ ...params, authChoice });
+    }
     if (authChoice === "qianfan-api-key") {
         let hasCredential = false;
         if (!hasCredential && params.opts?.token && params.opts?.tokenProvider === "qianfan") {
@@ -763,7 +817,7 @@ export async function applyAuthChoiceApiProviders(params) {
                 message: "Enter QIANFAN API key",
                 validate: validateApiKeyInput,
             });
-            setQianfanApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+            setQianfanApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
         }
         nextConfig = applyAuthProfileConfig(nextConfig, {
             profileId: "qianfan:default",
@@ -786,5 +840,56 @@ export async function applyAuthChoiceApiProviders(params) {
         }
         return { config: nextConfig, agentModelOverride };
     }
+    if (authChoice === "nvidia-api-key") {
+        let hasCredential = false;
+        if (!hasCredential && params.opts?.token && params.opts?.tokenProvider === "nvidia") {
+            setNvidiaApiKey(normalizeApiKeyInput(params.opts.token), params.agentDir);
+            hasCredential = true;
+        }
+        if (!hasCredential) {
+            await params.prompter.note([
+                "Get your API key at: https://build.nvidia.com/settings/api-key",
+                "Free tier includes 1,000 requests/day across 23+ frontier models.",
+            ].join("\n"), "NVIDIA");
+        }
+        const envKey = resolveEnvApiKey("nvidia");
+        if (envKey) {
+            const useExisting = await params.prompter.confirm({
+                message: `Use existing NVIDIA_API_KEY (${envKey.source}, ${formatApiKeyPreview(envKey.apiKey)})?`,
+                initialValue: true,
+            });
+            if (useExisting) {
+                setNvidiaApiKey(envKey.apiKey, params.agentDir);
+                hasCredential = true;
+            }
+        }
+        if (!hasCredential) {
+            const key = await params.prompter.text({
+                message: "Enter NVIDIA API key",
+                validate: validateApiKeyInput,
+            });
+            setNvidiaApiKey(normalizeApiKeyInput(String(key ?? "")), params.agentDir);
+        }
+        nextConfig = applyAuthProfileConfig(nextConfig, {
+            profileId: "nvidia:default",
+            provider: "nvidia",
+            mode: "api_key",
+        });
+        {
+            const applied = await applyDefaultModelChoice({
+                config: nextConfig,
+                setDefaultModel: params.setDefaultModel,
+                defaultModel: NVIDIA_DEFAULT_MODEL_REF,
+                applyDefaultConfig: applyNvidiaConfig,
+                applyProviderConfig: applyNvidiaProviderConfig,
+                noteDefault: NVIDIA_DEFAULT_MODEL_REF,
+                noteAgentModel,
+                prompter: params.prompter,
+            });
+            nextConfig = applied.config;
+            agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
+        }
+        return { config: nextConfig, agentModelOverride };
+    }
     return null;
 }

package/dist/commands/auth-choice.apply.huggingface.js

@@ -0,0 +1,130 @@
+import { discoverHuggingfaceModels, isHuggingfacePolicyLocked, } from "../agents/huggingface-models.js";
+import { resolveEnvApiKey } from "../agents/model-auth.js";
+import { formatApiKeyPreview, normalizeApiKeyInput, validateApiKeyInput, } from "./auth-choice.api-key.js";
+import { applyDefaultModelChoice } from "./auth-choice.default-model.js";
+import { ensureModelAllowlistEntry } from "./model-allowlist.js";
+import { applyAuthProfileConfig, applyHuggingfaceProviderConfig, setHuggingfaceApiKey, HUGGINGFACE_DEFAULT_MODEL_REF, } from "./onboard-auth.js";
+export async function applyAuthChoiceHuggingface(params) {
+    if (params.authChoice !== "huggingface-api-key") {
+        return null;
+    }
+    let nextConfig = params.config;
+    let agentModelOverride;
+    const noteAgentModel = async (model) => {
+        if (!params.agentId) {
+            return;
+        }
+        await params.prompter.note(`Default model set to ${model} for agent "${params.agentId}".`, "Model configured");
+    };
+    let hasCredential = false;
+    let hfKey = "";
+    if (!hasCredential && params.opts?.token && params.opts.tokenProvider === "huggingface") {
+        hfKey = normalizeApiKeyInput(params.opts.token);
+        await setHuggingfaceApiKey(hfKey, params.agentDir);
+        hasCredential = true;
+    }
+    if (!hasCredential) {
+        await params.prompter.note([
+            "Hugging Face Inference Providers offer OpenAI-compatible chat completions.",
+            "Create a token at: https://huggingface.co/settings/tokens (fine-grained, 'Make calls to Inference Providers').",
+        ].join("\n"), "Hugging Face");
+    }
+    if (!hasCredential) {
+        const envKey = resolveEnvApiKey("huggingface");
+        if (envKey) {
+            const useExisting = await params.prompter.confirm({
+                message: `Use existing Hugging Face token (${envKey.source}, ${formatApiKeyPreview(envKey.apiKey)})?`,
+                initialValue: true,
+            });
+            if (useExisting) {
+                hfKey = envKey.apiKey;
+                await setHuggingfaceApiKey(hfKey, params.agentDir);
+                hasCredential = true;
+            }
+        }
+    }
+    if (!hasCredential) {
+        const key = await params.prompter.text({
+            message: "Enter Hugging Face API key (HF token)",
+            validate: validateApiKeyInput,
+        });
+        hfKey = normalizeApiKeyInput(String(key ?? ""));
+        await setHuggingfaceApiKey(hfKey, params.agentDir);
+    }
+    nextConfig = applyAuthProfileConfig(nextConfig, {
+        profileId: "huggingface:default",
+        provider: "huggingface",
+        mode: "api_key",
+    });
+    const models = await discoverHuggingfaceModels(hfKey);
+    const modelRefPrefix = "huggingface/";
+    const options = [];
+    for (const m of models) {
+        const baseRef = `${modelRefPrefix}${m.id}`;
+        const label = m.name ?? m.id;
+        options.push({ value: baseRef, label });
+        options.push({ value: `${baseRef}:cheapest`, label: `${label} (cheapest)` });
+        options.push({ value: `${baseRef}:fastest`, label: `${label} (fastest)` });
+    }
+    const defaultRef = HUGGINGFACE_DEFAULT_MODEL_REF;
+    options.sort((a, b) => {
+        if (a.value === defaultRef) {
+            return -1;
+        }
+        if (b.value === defaultRef) {
+            return 1;
+        }
+        return a.label.localeCompare(b.label, undefined, { sensitivity: "base" });
+    });
+    const selectedModelRef = options.length === 0
+        ? defaultRef
+        : options.length === 1
+            ? options[0].value
+            : await params.prompter.select({
+                message: "Default Hugging Face model",
+                options,
+                initialValue: options.some((o) => o.value === defaultRef)
+                    ? defaultRef
+                    : options[0].value,
+            });
+    if (isHuggingfacePolicyLocked(selectedModelRef)) {
+        await params.prompter.note("Provider locked — router will choose backend by cost or speed.", "Hugging Face");
+    }
+    const applied = await applyDefaultModelChoice({
+        config: nextConfig,
+        setDefaultModel: params.setDefaultModel,
+        defaultModel: selectedModelRef,
+        applyDefaultConfig: (config) => {
+            const withProvider = applyHuggingfaceProviderConfig(config);
+            const existingModel = withProvider.agents?.defaults?.model;
+            const withPrimary = {
+                ...withProvider,
+                agents: {
+                    ...withProvider.agents,
+                    defaults: {
+                        ...withProvider.agents?.defaults,
+                        model: {
+                            ...(existingModel && typeof existingModel === "object" && "fallbacks" in existingModel
+                                ? {
+                                    fallbacks: existingModel.fallbacks,
+                                }
+                                : {}),
+                            primary: selectedModelRef,
+                        },
+                    },
+                },
+            };
+            return ensureModelAllowlistEntry({
+                cfg: withPrimary,
+                modelRef: selectedModelRef,
+            });
+        },
+        applyProviderConfig: applyHuggingfaceProviderConfig,
+        noteDefault: selectedModelRef,
+        noteAgentModel,
+        prompter: params.prompter,
+    });
+    nextConfig = applied.config;
+    agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
+    return { config: nextConfig, agentModelOverride };
+}