broapp 0.4.5 → 0.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "broapp",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "type": "module",
   "description": "Build tooling and runtime for local applications made of a Bun host, a browser UI, and a Brobridge connection between them",
   "license": "MIT",

package/src/ai/host/create-ai.ts

@@ -20,15 +20,16 @@ import type { Bridge } from 'brobridge';
 // this code from being bundled into a page.
 import { createPendingApprovals, createReservedHostApp } from '../../host/index.ts';
 import type { HostApp, HostLogger, StreamSink } from '../../host/app.ts';
-import { publicError } from '../../shared/errors.ts';
+import { isPublicError, publicError, type PublicError } from '../../shared/errors.ts';
 import { aiContract, type AiContract } from '../shared/contract.ts';
-import type { ChatTurn, ProviderInfo } from '../shared/types.ts';
+import { formatModelRef } from '../shared/model-ref.ts';
+import type { BroappModel, ChatTurn, ProviderInfo } from '../shared/types.ts';
 
 import { AdapterError, toPublicError, type AdapterConfig, type ProviderAdapter } from './adapter.ts';
 import { createRegistry, type Registry } from './registry.ts';
 import { runChat, type RunDeps } from './run.ts';
 import type { ChatEvent } from './run-types.ts';
-import { createFileSecretStore, createMemorySecretStore } from './secrets.ts';
+import { apiKeySecretName, createFileSecretStore, createMemorySecretStore } from './secrets.ts';
 import { createSettingsStore } from './settings.ts';
 import { openThreads, type ThreadStore } from './threads.ts';
 import { GUARDED, type AiContextProviders, type AiTool, type ContextDocument } from './tool.ts';
@@ -64,7 +65,7 @@ export interface DeliveredContext {
 export interface InProcessTurn {
   readonly runId: string;
   readonly message: string;
-  /** The model for this turn, within the configured provider. */
+  /** The model for this turn: a model reference, bare or naming an enabled provider. */
   readonly modelId?: string;
   /**
    * Earlier turns, as a browser would send them. An assistant turn naming a
@@ -228,6 +229,73 @@ const ANSWER_INTERVAL_MS = 5;
 /** How long a provider is given to answer a listing or a connection test. */
 const PROVIDER_TIMEOUT_MS = 20_000;
 
+/** The contract's bound on `ai.modelsList`, over every provider's list together. */
+const MAX_LISTED_MODELS = 1000;
+
+const NOT_SET_UP = 'AI is not set up yet. Open Settings to choose a provider.';
+
+/**
+ * A model id no provider offers, for asking `resolve` whether a provider's
+ * key and address are there. `resolve` checks the model last and never sends
+ * anything, so the id is never used.
+ */
+const NO_MODEL = '-';
+
+/** One provider's list, read. */
+interface Listed {
+  readonly adapter: ProviderAdapter;
+  readonly models: BroappModel[];
+}
+
+/** One provider that could not be listed, and the error that says why. */
+interface Unlisted {
+  readonly adapter: ProviderAdapter;
+  readonly failure: PublicError;
+}
+
+/**
+ * What stops a provider being tested, in `resolve`'s words, or `null`.
+ *
+ * Written here as well as in the registry because a provider that is off
+ * cannot go through `resolve` — which refuses it for being off — and still has
+ * to be testable. A test holds the two sets of sentences equal.
+ */
+function unmet(adapter: ProviderAdapter, config: AdapterConfig): string | null {
+  if (adapter.needs.apiKey === 'required' && (config.apiKey === null || config.apiKey === '')) {
+    return `An API key is required for ${adapter.label}.`;
+  }
+  if (adapter.needs.baseUrl === 'required' && (config.baseUrl === null || config.baseUrl === '')) {
+    return `A server address is required for ${adapter.label}.`;
+  }
+  return null;
+}
+
+/**
+ * Split `limit` rows between lists of the given lengths so that no list gives
+ * up rows while another keeps more than it: a short list is shown whole, and
+ * what is left is shared equally between the long ones.
+ */
+export function fairShares(lengths: readonly number[], limit: number): number[] {
+  const shares = lengths.map(() => 0);
+  let left = limit;
+  let open = lengths.map((_, index) => index).filter((index) => (lengths[index] ?? 0) > 0);
+  // Each round gives every list still wanting rows an equal part of what is
+  // left, at least one, so the loop ends: rows run out or every list is whole.
+  while (open.length > 0 && left > 0) {
+    const each = Math.max(1, Math.floor(left / open.length));
+    const next: number[] = [];
+    for (const index of open) {
+      if (left === 0) break;
+      const given = Math.min((lengths[index] ?? 0) - (shares[index] ?? 0), each, left);
+      shares[index] = (shares[index] ?? 0) + given;
+      left -= given;
+      if ((shares[index] ?? 0) < (lengths[index] ?? 0)) next.push(index);
+    }
+    open = next;
+  }
+  return shares;
+}
+
 /** Defaults for the run loop, all overridable per application. */
 const DEFAULT_CONTEXT_BUDGET_CHARS = 40_000;
 const DEFAULT_MAX_STEPS = 8;
@@ -263,11 +331,14 @@ export function createAi(options: CreateAiOptions): Ai {
   // Both stores are built once and kept. `remember` chooses between them, and
   // switching has to move a key from one to the other rather than construct a
   // new store and lose what the old one held.
+  const settingsStore = createSettingsStore(options.dataDir);
+  const fileSecrets = createFileSecretStore(options.dataDir);
+  const memorySecrets = createMemorySecretStore();
   const registry = createRegistry({
     adapters: options.providers,
-    settingsStore: createSettingsStore(options.dataDir),
-    fileSecrets: createFileSecretStore(options.dataDir),
-    memorySecrets: createMemorySecretStore(),
+    settingsStore,
+    fileSecrets,
+    memorySecrets,
     fetch: options.fetch ?? globalThis.fetch,
   });
 
@@ -295,13 +366,38 @@ export function createAi(options: CreateAiOptions): Ai {
   }));
 
   host.operation('ai.modelsList', async () => {
-    const { adapter, config } = await requireConfig();
-    try {
-      const models = await adapter.models(config, AbortSignal.timeout(PROVIDER_TIMEOUT_MS));
-      return { models };
-    } catch (cause) {
-      throw toPublicError(cause);
+    // Nothing set up is still "not set up", in today's words, whatever else is
+    // turned on: a launcher with no provider in use has not been set up.
+    await requireConfig();
+    const settings = await registry.settings();
+    const enabled = options.providers.filter((adapter) =>
+      settings.providers.some((entry) => entry.id === adapter.id && entry.enabled),
+    );
+    // Every enabled provider at once, each under its own deadline, so one that
+    // is slow or down costs its own group and not the whole list.
+    const answers = await Promise.all(enabled.map((adapter) => listOf(adapter)));
+    const read = answers.filter((answer): answer is Listed => 'models' in answer);
+    const failed = answers.filter((answer): answer is Unlisted => 'failure' in answer);
+    if (read.length === 0) {
+      // An application with one provider sees exactly what it saw: that
+      // provider's own error. With several, the first in the build's order.
+      const first = failed[0];
+      throw first === undefined ? publicError.unavailable(NOT_SET_UP) : first.failure;
     }
+    const shares = fairShares(read.map((answer) => answer.models.length), MAX_LISTED_MODELS);
+    const unavailable = failed.map((answer) => ({ provider: answer.adapter.id, message: answer.failure.message }));
+    const models: BroappModel[] = [];
+    read.forEach((answer, index) => {
+      const share = shares[index] ?? 0;
+      models.push(...answer.models.slice(0, share));
+      if (share < answer.models.length) {
+        unavailable.push({
+          provider: answer.adapter.id,
+          message: `${answer.adapter.label}: only the first ${String(share)} models are shown.`,
+        });
+      }
+    });
+    return { models, unavailable };
   });
 
   host.operation('ai.connectionTest', async () => {
@@ -309,6 +405,30 @@ export function createAi(options: CreateAiOptions): Ai {
     // missing its key would just ask the provider to reject it, and the layer
     // already knows the answer and can say it in better words.
     const { adapter, config } = await registry.resolve();
+    return tryConnection(adapter, config);
+  });
+
+  host.operation('ai.providerTest', async ({ provider }) => {
+    const adapter = registry.adapter(provider);
+    if (adapter === null) throw publicError.invalidInput('Unknown provider.');
+    // Its own stored address and key, whether or not it is turned on: a person
+    // tests a provider before they decide to use it. Testing leaves it as it was.
+    const settings = settingsStore.read();
+    const secrets = settings.remember ? fileSecrets : memorySecrets;
+    const config: AdapterConfig = {
+      ...registry.configFor(adapter),
+      apiKey: await secrets.get(apiKeySecretName(adapter.id)),
+    };
+    const problem = unmet(adapter, config);
+    if (problem !== null) throw publicError.unavailable(problem);
+    return tryConnection(adapter, config);
+  });
+
+  /** One test of one provider: an answer either way, never a failed route for a provider's refusal. */
+  async function tryConnection(
+    adapter: ProviderAdapter,
+    config: AdapterConfig,
+  ): Promise<{ ok: boolean; message: string; latencyMs: number }> {
     const started = Bun.nanoseconds();
     const elapsed = (): number => Math.round((Bun.nanoseconds() - started) / 1_000_000);
     try {
@@ -321,7 +441,23 @@ export function createAi(options: CreateAiOptions): Ai {
       if (!(cause instanceof AdapterError)) throw cause;
       return { ok: false, message: cause.message, latencyMs: elapsed() };
     }
-  });
+  }
+
+  /**
+   * One enabled provider's list, or why there is none. A provider whose key
+   * or address is missing is not asked: `resolve` names what is missing, in
+   * the same words a turn would hear, so the rule stays written once.
+   */
+  async function listOf(adapter: ProviderAdapter): Promise<Listed | Unlisted> {
+    try {
+      const { config } = await registry.resolve({ modelId: formatModelRef(adapter.id, NO_MODEL) });
+      return { adapter, models: await adapter.models(config, AbortSignal.timeout(PROVIDER_TIMEOUT_MS)) };
+    } catch (cause) {
+      if (cause instanceof AdapterError) return { adapter, failure: toPublicError(cause) };
+      if (isPublicError(cause)) return { adapter, failure: cause };
+      throw cause;
+    }
+  }
 
   // Opened on the first conversation route and not before: an application
   // whose user never opens the panel should not find a database in its data
@@ -374,7 +510,7 @@ export function createAi(options: CreateAiOptions): Ai {
   async function requireConfig(): Promise<{ adapter: ProviderAdapter; config: AdapterConfig }> {
     const current = await registry.currentConfig();
     if (current === null) {
-      throw publicError.unavailable('AI is not set up yet. Open Settings to choose a provider.');
+      throw publicError.unavailable(NOT_SET_UP);
     }
     return current;
   }

package/src/ai/host/registry.ts

@@ -8,47 +8,70 @@
  * conditions that can drift from the first.
  */
 import { isPublicError, publicError } from '../../shared/errors.ts';
-import type { AiSettings } from '../shared/types.ts';
+import { parseModelRef } from '../shared/model-ref.ts';
+import type { AiSettings, ProviderSettings } from '../shared/types.ts';
 
 import type { AdapterConfig, ProviderAdapter } from './adapter.ts';
 import { apiKeySecretName, type SecretStore } from './secrets.ts';
-import type { SettingsStore, StoredSettings } from './settings.ts';
+import type { ProviderEntry, SettingsStore, StoredSettings } from './settings.ts';
+
 
 /** Everything needed to run one chat turn. */
 export interface ResolvedModel {
   readonly adapter: ProviderAdapter;
   readonly config: AdapterConfig;
+  /** The provider's own id for the model: never a qualified reference. */
   readonly modelId: string;
 }
 
 /** The fields `ai.settings.update` may change. */
 export interface UpdatePatch {
+  /** Make this provider the one in use. */
   readonly provider?: string | undefined;
+  /**
+   * The provider `modelId`, `baseUrl`, `apiKey` and `enabled` apply to. Absent
+   * means the provider in use, which is what every field meant before there
+   * was more than one.
+   */
+  readonly target?: string | undefined;
   readonly modelId?: string | undefined;
   readonly baseUrl?: string | null | undefined;
   readonly apiKey?: string | null | undefined;
+  readonly enabled?: boolean | undefined;
   readonly remember?: boolean | undefined;
 }
 
-/** The adapters this build has, and the settings pointing at one of them. */
+/** The adapters this build has, and the settings pointing at them. */
 export interface Registry {
   readonly adapters: readonly ProviderAdapter[];
   adapter(id: string): ProviderAdapter | null;
-  /** Current settings plus the key, for adapter calls. */
+  /**
+   * The id of the provider in use, read now and without a key: for a caller
+   * that must say, as a turn ends, whether it ran somewhere else.
+   */
+  activeProvider(): string | null;
+  /** The provider in use and its key, for adapter calls. */
   currentConfig(): Promise<{ adapter: ProviderAdapter; config: AdapterConfig } | null>;
+  /**
+   * One provider's own address and key, for adapter calls; `null` when this
+   * build has no such provider or it is not turned on — a provider that is
+   * off is sent nothing, not even a request for its list.
+   */
+  configOf(providerId: string): Promise<{ adapter: ProviderAdapter; config: AdapterConfig } | null>;
   /**
    * Everything needed to run a chat, or a `PublicError` explaining what is
    * missing.
    *
-   * `override.modelId` replaces the model Settings names, for this call only
-   * and only within the configured provider — a conversation may pin a model,
-   * never a vendor.
+   * `override.modelId` replaces the model Settings names, for this call only.
+   * It is a model reference: bare, it is a model of the provider in use; as
+   * `<provider>:<model>` it runs on that provider, with that provider's own
+   * key and address, provided the person turned it on.
    */
   resolve(override?: { readonly modelId?: string | undefined }): Promise<ResolvedModel>;
   /** The public view: settings without the key. */
   settings(): Promise<AiSettings>;
   update(patch: UpdatePatch): Promise<AiSettings>;
-  /** The config an adapter would get today, ignoring which one is selected. */
+  /** The config an adapter would get today from its own entry, whether or not it is in use. No key. */
   configFor(adapter: ProviderAdapter): AdapterConfig;
 }
 
@@ -73,10 +96,28 @@ function hint(key: string | null): string | null {
   return key.slice(-4);
 }
 
+/**
+ * A provider's entry, or what one it has never had would hold: its default
+ * address, no model, and off.
+ */
+function entryOf(settings: StoredSettings, adapter: ProviderAdapter): ProviderEntry {
+  return settings.providers[adapter.id] ?? { baseUrl: adapter.defaultBaseUrl, modelId: null, enabled: false };
+}
+
+/** The provider in use is always on, whatever its entry says. */
+function isEnabled(settings: StoredSettings, providerId: string): boolean {
+  return settings.active === providerId || settings.providers[providerId]?.enabled === true;
+}
+
+function hasValue(value: string | null): value is string {
+  return value !== null && value !== '';
+}
+
 export function createRegistry(options: RegistryOptions): Registry {
   const byId = new Map(options.adapters.map((adapter) => [adapter.id, adapter]));
+  const ids = options.adapters.map((adapter) => adapter.id);
 
-  /** The store the key currently lives in, which `remember` decides. */
+  /** The store the keys currently live in, which `remember` decides. */
   function store(settings: StoredSettings): SecretStore {
     return settings.remember ? options.fileSecrets : options.memorySecrets;
   }
@@ -85,62 +126,89 @@ export function createRegistry(options: RegistryOptions): Registry {
     return store(settings).get(apiKeySecretName(providerId));
   }
 
-  function configFrom(settings: StoredSettings, adapter: ProviderAdapter, apiKey: string | null): AdapterConfig {
+  /**
+   * The config a provider gets: its own entry's address and its own key. An
+   * address is only ever applied to the provider it was typed for.
+   */
+  function configFrom(entry: ProviderEntry, adapter: ProviderAdapter, apiKey: string | null): AdapterConfig {
     return {
       apiKey,
-      baseUrl: settings.baseUrl ?? adapter.defaultBaseUrl,
+      baseUrl: entry.baseUrl ?? adapter.defaultBaseUrl,
       fetch: options.fetch,
     };
   }
 
+  /**
+   * What stops a provider being used, in the words a person is shown, or
+   * `null` when its key and address are both there. The key and the address
+   * come before the model on purpose: the list of models is fetched *from* the
+   * provider, so telling a user to choose one before they can see any is an
+   * instruction they cannot follow.
+   */
+  function missing(adapter: ProviderAdapter, config: AdapterConfig): string | null {
+    if (adapter.needs.apiKey === 'required' && !hasValue(config.apiKey)) {
+      return `An API key is required for ${adapter.label}.`;
+    }
+    if (adapter.needs.baseUrl === 'required' && !hasValue(config.baseUrl)) {
+      return `A server address is required for ${adapter.label}.`;
+    }
+    return null;
+  }
+
   const registry: Registry = {
     adapters: options.adapters,
 
     adapter: (id) => byId.get(id) ?? null,
 
+    activeProvider: () => options.settingsStore.read().active,
+
     configFor(adapter) {
-      const settings = options.settingsStore.read();
-      // The stored base URL belongs to the *selected* provider. Applying it to
-      // the others would have told the user that Anthropic runs on their
-      // computer, simply because they had Ollama selected a moment ago.
-      const scoped: StoredSettings =
-        settings.provider === adapter.id ? settings : { ...settings, baseUrl: null };
-      // No key either: whether a provider stays on this machine is a property
-      // of the address, and the answer must not depend on what is stored.
-      return configFrom(scoped, adapter, null);
+      // Each provider's own entry, so the fault this once had cannot come
+      // back: an address typed for Ollama applied to Anthropic told the user
+      // that Anthropic runs on their computer. No key either: whether a
+      // provider stays on this machine is a property of the address, and the
+      // answer must not depend on what is stored.
+      return configFrom(entryOf(options.settingsStore.read(), adapter), adapter, null);
     },
 
     async currentConfig() {
       const settings = options.settingsStore.read();
-      if (settings.provider === null) return null;
-      const adapter = byId.get(settings.provider);
-      if (adapter === undefined) return null;
+      if (settings.active === null) return null;
+      return registry.configOf(settings.active);
+    },
+
+    async configOf(providerId) {
+      const settings = options.settingsStore.read();
+      const adapter = byId.get(providerId);
+      if (adapter === undefined || !isEnabled(settings, providerId)) return null;
       const apiKey = await keyFor(settings, adapter.id);
-      return { adapter, config: configFrom(settings, adapter, apiKey) };
+      return { adapter, config: configFrom(entryOf(settings, adapter), adapter, apiKey) };
     },
 
     async resolve(override) {
       const settings = options.settingsStore.read();
-      if (settings.provider === null) throw publicError.unavailable(NOT_SET_UP);
-      const adapter = byId.get(settings.provider);
+      // First even for a reference naming another provider: a launcher with
+      // nothing set up is not set up.
+      if (settings.active === null) throw publicError.unavailable(NOT_SET_UP);
+      const ref = override?.modelId === undefined ? null : parseModelRef(override.modelId, ids);
+      const providerId = ref?.provider ?? settings.active;
+      const adapter = byId.get(providerId);
       if (adapter === undefined) {
         throw publicError.unavailable('The configured AI provider is not available in this build.');
       }
-      // The key and the address come before the model on purpose: the list of
-      // models is fetched *from* the provider, so telling a user to choose one
-      // before they can see any is an instruction they cannot follow.
-      const apiKey = await keyFor(settings, adapter.id);
-      if (adapter.needs.apiKey === 'required' && (apiKey === null || apiKey === '')) {
-        throw publicError.unavailable(`An API key is required for ${adapter.label}.`);
-      }
-      const config = configFrom(settings, adapter, apiKey);
-      if (adapter.needs.baseUrl === 'required' && (config.baseUrl === null || config.baseUrl === '')) {
-        throw publicError.unavailable(`A server address is required for ${adapter.label}.`);
+      // Before the key is read and before anything is sent: a line in a tier
+      // file must not reach a provider the person never turned on.
+      if (!isEnabled(settings, providerId)) {
+        throw publicError.unavailable(`${adapter.label} is not turned on in Settings.`);
       }
+      const entry = entryOf(settings, adapter);
+      const config = configFrom(entry, adapter, await keyFor(settings, adapter.id));
+      const problem = missing(adapter, config);
+      if (problem !== null) throw publicError.unavailable(problem);
       // Read after the provider, the key and the address, so a conversation
       // carrying its own model still hears "AI is not set up yet" first: the
       // model is the last thing missing, never the first.
-      const modelId = override?.modelId ?? settings.modelId;
+      const modelId = ref?.modelId ?? entry.modelId;
       if (modelId === null) {
         // Distinct from "not set up": the user is looking at the settings panel
         // with a provider selected, and being told to choose a provider is an
@@ -152,8 +220,25 @@ export function createRegistry(options: RegistryOptions): Registry {
 
     async settings() {
       const settings = options.settingsStore.read();
-      const apiKey =
-        settings.provider === null ? null : await keyFor(settings, settings.provider);
+      const providers: ProviderSettings[] = [];
+      for (const adapter of options.adapters) {
+        const entry = entryOf(settings, adapter);
+        const apiKey = await keyFor(settings, adapter.id);
+        providers.push({
+          id: adapter.id,
+          baseUrl: entry.baseUrl,
+          modelId: entry.modelId,
+          enabled: isEnabled(settings, adapter.id),
+          hasKey: hasValue(apiKey),
+          keyHint: hint(apiKey),
+          configured: missing(adapter, configFrom(entry, adapter, apiKey)) === null,
+        });
+      }
+      // The top-level fields are the provider in use, so an application
+      // written before there was more than one reads what it always read.
+      const active = providers.find((element) => element.id === settings.active) ??
+        (settings.active === null ? undefined : settings.providers[settings.active]);
+      const apiKey = settings.active === null ? null : await keyFor(settings, settings.active);
       let configured = true;
       try {
         await registry.resolve();
@@ -164,41 +249,66 @@ export function createRegistry(options: RegistryOptions): Registry {
         configured = false;
       }
       return {
-        provider: settings.provider,
-        modelId: settings.modelId,
-        baseUrl: settings.baseUrl,
-        hasKey: apiKey !== null && apiKey !== '',
+        provider: settings.active,
+        modelId: active?.modelId ?? null,
+        baseUrl: active?.baseUrl ?? null,
+        hasKey: hasValue(apiKey),
         keyHint: hint(apiKey),
         remember: settings.remember,
         configured,
+        providers,
       };
     },
 
     async update(patch) {
       const before = options.settingsStore.read();
-      const next: StoredSettings = { ...before };
+      const next: StoredSettings = {
+        ...before,
+        providers: Object.fromEntries(
+          Object.entries(before.providers).map(([id, entry]) => [id, { ...entry }]),
+        ),
+      };
+      /** A provider's entry in `next`, made from its defaults the first time it is touched. */
+      const entry = (adapter: ProviderAdapter): ProviderEntry =>
+        (next.providers[adapter.id] ??= { ...entryOf(before, adapter) });
 
+      if (patch.target !== undefined && !byId.has(patch.target)) {
+        throw publicError.invalidInput('Unknown provider.');
+      }
       if (patch.provider !== undefined) {
-        if (!byId.has(patch.provider)) throw publicError.invalidInput('Unknown provider.');
-        if (patch.provider !== before.provider) {
-          next.provider = patch.provider;
-          // A model id belongs to the provider that offers it, and a base URL
-          // points at that provider's server. Carrying either across a change
-          // would leave the settings describing something that does not exist.
-          next.modelId = null;
-          next.baseUrl = byId.get(patch.provider)?.defaultBaseUrl ?? null;
+        const chosen = byId.get(patch.provider);
+        if (chosen === undefined) throw publicError.invalidInput('Unknown provider.');
+        if (patch.target !== undefined && patch.target !== patch.provider) {
+          throw publicError.invalidInput('A provider can be made the one in use only by naming it as the target too.');
+        }
+        // Each provider keeps its own address and model, so changing provider
+        // restores the one chosen's rather than clearing both: a model id
+        // belongs to the provider that offers it, and it stays with that
+        // provider instead of being carried to another or thrown away.
+        next.active = patch.provider;
+        entry(chosen).enabled = true;
+      }
+
+      const targetId = patch.target ?? next.active;
+      const target = targetId === null ? undefined : byId.get(targetId);
+      if (target !== undefined) {
+        if (patch.modelId !== undefined) entry(target).modelId = patch.modelId;
+        if (patch.baseUrl !== undefined) entry(target).baseUrl = patch.baseUrl;
+        if (patch.enabled !== undefined) {
+          if (!patch.enabled && target.id === next.active) {
+            throw publicError.invalidInput('The provider in use cannot be turned off. Choose another first.');
+          }
+          entry(target).enabled = patch.enabled;
         }
       }
-      if (patch.modelId !== undefined) next.modelId = patch.modelId;
-      if (patch.baseUrl !== undefined) next.baseUrl = patch.baseUrl;
 
       if (patch.remember !== undefined && patch.remember !== before.remember) {
         next.remember = patch.remember;
         await moveKeys(before, next);
       }
 
-      if (patch.apiKey !== undefined && next.provider !== null) {
-        const name = apiKeySecretName(next.provider);
+      if (patch.apiKey !== undefined && target !== undefined) {
+        const name = apiKeySecretName(target.id);
         const value = patch.apiKey === null || patch.apiKey === '' ? null : patch.apiKey;
         if (value === null) await store(next).delete(name);
         else await store(next).set(name, value);
@@ -214,7 +324,7 @@ export function createRegistry(options: RegistryOptions): Registry {
    *
    * Turning `remember` off must not merely stop future writes: the key already
    * on disk has to leave the disk, or the setting would be a promise the
-   * layer does not keep.
+   * layer does not keep. Every provider's key, not only the one in use.
    */
   async function moveKeys(before: StoredSettings, after: StoredSettings): Promise<void> {
     const from = store(before);