agentnode-sdk 0.15.0__tar.gz → 0.16.0__tar.gz

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.16.0 — Registry providers in auth CLI and setup wizard
+
+### Added
+
+- **`agentnode auth status` now surfaces all registry providers** — OpenAI,
+  Anthropic, OpenRouter, DeepSeek, Mistral, Qwen, Gemini — with their storage
+  backend and effective source, plus **Ollama as a local keyless provider**
+  (shown as selected/configured/not selected instead of "missing"). Custom
+  providers configured under `llm.providers.<name>` appear automatically.
+- **`agentnode auth test` supports the registry providers.** Compatible
+  providers are validated with a free, no-completion `GET {base_url}/models`
+  probe; `agentnode auth test ollama` is a keyless reachability check
+  (exit 0 reachable, exit 3 unreachable — never "rejected", and it never
+  starts Ollama). Custom configured endpoints can be tested the same way.
+- **The setup wizard lists all registry providers**, grouped for readability
+  (Recommended / More / Local), with Skip remaining the default. Selecting
+  Ollama never asks for an API key — it sets `llm.default_provider` through
+  the wizard's normal save step.
+- Additive `vendor` field in host-side LLM bindings: logs and tooling can now
+  show the real provider name; the protocol discriminator used by the broker
+  is unchanged.
+
+### Changed
+
+- The auth CLI and the setup wizard now use the provider registry as their
+  single source of truth — no hardcoded provider lists or environment
+  variable names remain in those surfaces.
+- OpenRouter keeps its dedicated `/auth/key` validation path (its `/models`
+  endpoint is unauthenticated and validates nothing).
+
+### Hardened
+
+- Provider response bodies are never printed (they can echo key fragments);
+  keys are never printed, logged, or exposed in exceptions.
+- Ollama is never started or probed automatically — only an explicit
+  `agentnode auth test ollama` performs a localhost reachability check.
+- The `vendor` field stays host-side and does not change the broker/sandbox
+  wire shape.
+
+### BREAKING / Upgrade Notes
+
+- None. All changes are additive; existing `auth` and `setup` flows behave
+  identically for the previously supported providers.
+
 ## 0.15.0 — Generic OpenAI-compatible LLM providers
 
 ### Added

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentnode-sdk
-Version: 0.15.0
+Version: 0.16.0
 Summary: Python SDK for AgentNode — the open upgrade and discovery infrastructure for AI agents.
 Project-URL: Homepage, https://agentnode.net
 Project-URL: Repository, https://github.com/agentnode-ai/agentnode

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/agentnode_sdk/__init__.py

@@ -38,7 +38,7 @@ from agentnode_sdk.runtime import AgentNodeRuntime
 Client = AgentNodeClient
 ToolError = AgentNodeToolError
 
-__version__ = "0.15.0"
+__version__ = "0.16.0"
 __all__ = [
     "AgentNode",
     "AsyncAgentNode",

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/agentnode_sdk/cli/auth.py

@@ -10,7 +10,6 @@ import os
 import sys
 
 from agentnode_sdk.credential_store import (
-    LLM_PROVIDER_ENV,
     has_credential,
     list_credentials,
     load_credentials,
@@ -30,17 +29,28 @@ def _storage_short(storage: str) -> str:
     return "OS keychain" if storage == "keyring" else "plaintext file"
 
 
-def _llm_effective_source(provider: str) -> tuple[str | None, str]:
+def _host_config() -> dict:
+    try:
+        from agentnode_sdk.config import load_config
+        return load_config() or {}
+    except Exception:
+        return {}
+
+
+def _llm_effective_source(provider: str, host_config: dict | None = None) -> tuple[str | None, str]:
     """(effective key or None, human-readable source) for an LLM provider.
 
     Mirrors the runtime's resolution: env (incl. ~/.agentnode/.env) overrides
-    the stored credential. Uses metadata only for the stored check here —
+    the stored credential. Env var names come from the provider REGISTRY
+    (single source of truth). Uses metadata only for the stored check here —
     the real keychain read happens in ``auth test``."""
+    from agentnode_sdk.llm_providers import resolve_provider_spec
     from agentnode_sdk.runtimes.agent_runner import _load_agentnode_env
     _load_agentnode_env()
 
-    env_var = LLM_PROVIDER_ENV[provider]
-    env_key = os.environ.get(env_var) or None
+    spec = resolve_provider_spec(provider, host_config) or {}
+    env_var = spec.get("api_key_env") or ""
+    env_key = (os.environ.get(env_var) or None) if env_var else None
     meta = load_credentials().get("providers", {}).get(provider)
     stored = isinstance(meta, dict)
     storage = (meta or {}).get("storage", "file")
@@ -54,6 +64,19 @@ def _llm_effective_source(provider: str) -> tuple[str | None, str]:
     return None, "not configured"
 
 
+def _registry_key_providers(host_config: dict | None) -> list[str]:
+    """Key-requiring providers from the registry (presets + custom config
+    entries), in stable registry order."""
+    from agentnode_sdk.llm_providers import known_provider_names, resolve_provider_spec
+
+    names: list[str] = []
+    for name in known_provider_names(host_config):
+        spec = resolve_provider_spec(name, host_config)
+        if spec and spec.get("requires_key", True):
+            names.append(name)
+    return names
+
+
 def _resolve_auth_type(provider: str) -> str:
     """Read auth_type from lockfile connector entry. Falls back to 'api_key'.
 
@@ -132,15 +155,25 @@ def cmd_auth_remove(provider: str) -> int:
 
 def cmd_auth_status() -> int:
     # --- LLM providers (host runtime / sandbox broker) -----------------------
+    host_cfg = _host_config()
     print()
     print(section("LLM Providers"))
     print(f"  {'Provider':<14}{'Status':<16}{'Effective source'}")
     print(f"  {'--------':<14}{'------':<16}{'----------------'}")
-    for provider in sorted(LLM_PROVIDER_ENV):
-        key, source = _llm_effective_source(provider)
+    for provider in _registry_key_providers(host_cfg):
+        key, source = _llm_effective_source(provider, host_cfg)
         configured = key is not None or source not in ("not configured",)
         status = "configured" if configured else "missing"
         print(f"  {provider:<14}{status:<16}{source}")
+    # ollama: keyless local provider — selection is config, not a credential
+    llm_cfg = host_cfg.get("llm") or {}
+    if llm_cfg.get("default_provider") == "ollama":
+        ollama_source = "selected via llm.default_provider"
+    elif "ollama" in (llm_cfg.get("providers") or {}):
+        ollama_source = "configured via llm.providers"
+    else:
+        ollama_source = "not selected — agentnode config set llm.default_provider ollama"
+    print(f"  {'ollama':<14}{'local (keyless)':<16}{ollama_source}")
     print(dim("  Env vars always override stored credentials. "
               "Test a key: agentnode auth test <provider>"))
 
@@ -183,61 +216,97 @@ def cmd_auth_status() -> int:
 
 
 # Free, cost-less validation endpoints (no completion call, no charge).
-# anthropic REQUIRES the anthropic-version header (a 400 without it would be
-# misread as a bad key); openrouter's /models is UNAUTHENTICATED (validates
-# nothing) — /auth/key is the correct probe.
-_TEST_REQUESTS = {
-    "openai": lambda key: (
+# GENERIC rule for OpenAI-compatible providers: GET {base_url}/models with a
+# Bearer token (authenticated on deepseek/mistral/qwen/gemini and most custom
+# endpoints). EXCEPTIONS: openai (official URL), anthropic (REQUIRES the
+# anthropic-version header — a 400 without it would be misread as a bad key),
+# openrouter (its /models is UNAUTHENTICATED, validates nothing — /auth/key is
+# the correct probe).
+_TEST_EXCEPTIONS = {
+    "openai": lambda key, spec: (
         "https://api.openai.com/v1/models",
         {"Authorization": f"Bearer {key}"},
     ),
-    "anthropic": lambda key: (
+    "anthropic": lambda key, spec: (
         "https://api.anthropic.com/v1/models",
         {"x-api-key": key, "anthropic-version": "2023-06-01"},
     ),
-    "openrouter": lambda key: (
+    "openrouter": lambda key, spec: (
         "https://openrouter.ai/api/v1/auth/key",
         {"Authorization": f"Bearer {key}"},
     ),
 }
 
 
+def _test_request(provider: str, key: str | None, spec: dict) -> tuple[str, dict] | None:
+    if provider in _TEST_EXCEPTIONS:
+        return _TEST_EXCEPTIONS[provider](key, spec)
+    base = (spec.get("base_url") or "").rstrip("/")
+    if not base:
+        return None  # no compat endpoint to probe
+    headers = {"Authorization": f"Bearer {key}"} if key else {}
+    return (base + "/models", headers)
+
+
 def cmd_auth_test(provider: str) -> int:
     """Validate the EFFECTIVE key for an LLM provider (env beats vault) via a
-    free endpoint. Exit codes: 0 valid / 1 rejected (401/403) / 2 not
-    configured or unsupported / 3 indeterminate (network/5xx — never reported
-    as invalid). Never prints the key (masked last-4 only) and never echoes
-    the provider's response body (it can contain key fragments)."""
+    free endpoint — registry-driven, so custom ``llm.providers`` entries work
+    too. Exit codes: 0 valid (key providers) / reachable (keyless) · 1
+    rejected (401/403, key providers only) · 2 not configured or unsupported ·
+    3 indeterminate (network/5xx — never reported as invalid; for keyless
+    providers this means unreachable). Never prints the key (masked last-4
+    only), never echoes provider response bodies (they can contain key
+    fragments), never starts anything."""
     provider = provider.lower().strip()
-    if provider not in _TEST_REQUESTS:
-        supported = ", ".join(sorted(_TEST_REQUESTS))
-        print(f"  auth test supports: {supported}", file=sys.stderr)
+    host_cfg = _host_config()
+    from agentnode_sdk.llm_providers import resolve_provider_spec
+    spec = resolve_provider_spec(provider, host_cfg)
+    if spec is None:
+        print(f"  Unknown provider '{provider}'. Known: see `agentnode auth status`; "
+              "custom endpoints go under llm.providers.<name>.", file=sys.stderr)
         return 2
 
-    key, source = _llm_effective_source(provider)
-    if key is None:
-        # No env override — resolve the stored credential (real keychain read).
-        from agentnode_sdk.credential_store import get_llm_api_key
-        key = get_llm_api_key(provider)
-    if not key:
-        print(f"\n  {provider}: not configured. Run `agentnode auth set {provider}`.\n")
+    requires_key = spec.get("requires_key", True)
+    if requires_key:
+        key, source = _llm_effective_source(provider, host_cfg)
+        if key is None:
+            # No env override — resolve the stored credential (real keychain read).
+            from agentnode_sdk.credential_store import get_llm_api_key
+            key = get_llm_api_key(provider)
+        if not key:
+            print(f"\n  {provider}: not configured. Run `agentnode auth set {provider}`.\n")
+            return 2
+        shown = f"{_masked(key)}, {source}"
+    else:
+        key, shown = None, "local (keyless)"
+
+    req = _test_request(provider, key, spec)
+    if req is None:
+        print(f"\n  {provider}: no endpoint to probe (no base_url configured).\n")
         return 2
+    url, headers = req
 
-    url, headers = _TEST_REQUESTS[provider](key)
     import httpx
     try:
         resp = httpx.get(url, headers=headers, timeout=10.0)
     except Exception:
-        print(f"\n  {provider} ({_masked(key)}, {source}): could not reach the "
-              "provider — key validity unknown.\n")
+        if not requires_key:
+            print(f"\n  {provider} ({shown}): could not reach {url} — "
+                  "is the local server (e.g. Ollama) running?\n")
+        else:
+            print(f"\n  {provider} ({shown}): could not reach the "
+                  "provider — key validity unknown.\n")
         return 3
     if resp.status_code == 200:
-        print(f"\n  {provider} ({_masked(key)}, {source}): key is valid.\n")
+        if requires_key:
+            print(f"\n  {provider} ({shown}): key is valid.\n")
+        else:
+            print(f"\n  {provider} ({shown}): endpoint is reachable.\n")
         return 0
-    if resp.status_code in (401, 403):
-        print(f"\n  {provider} ({_masked(key)}, {source}): key was rejected by "
+    if requires_key and resp.status_code in (401, 403):
+        print(f"\n  {provider} ({shown}): key was rejected by "
               f"the provider (HTTP {resp.status_code}).\n")
         return 1
-    print(f"\n  {provider} ({_masked(key)}, {source}): unexpected provider "
-          f"response (HTTP {resp.status_code}) — key validity unknown.\n")
+    print(f"\n  {provider} ({shown}): unexpected response "
+          f"(HTTP {resp.status_code}) — status unknown.\n")
     return 3

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/agentnode_sdk/cli/setup_wizard.py

@@ -22,7 +22,14 @@ from agentnode_sdk.config import (
 )
 from agentnode_sdk.cli.output import bold, dim, kv, section
 
-_LLM_CHOICES = {"1": "openai", "2": "anthropic", "3": "openrouter"}
+# Key-provider menu (grouped for readability); choice 8 = ollama (keyless,
+# handled separately — never a key prompt), choice 9 = skip (the default).
+_LLM_CHOICES = {
+    "1": "openai", "2": "anthropic", "3": "openrouter",
+    "4": "deepseek", "5": "mistral", "6": "qwen", "7": "gemini",
+}
+_OLLAMA_CHOICE = "8"
+_SKIP_CHOICE = "9"
 
 
 def run_wizard() -> int:
@@ -59,15 +66,16 @@ def _store_llm_key(provider: str) -> str | None:
     import os
 
     from agentnode_sdk.cli.auth import _masked, _storage_short, cmd_auth_test
-    from agentnode_sdk.credential_store import LLM_PROVIDER_ENV, set_credential
+    from agentnode_sdk.credential_store import set_credential
 
-    env_var = LLM_PROVIDER_ENV[provider]
+    from agentnode_sdk.llm_providers import resolve_provider_spec
+    env_var = (resolve_provider_spec(provider) or {}).get("api_key_env") or ""
     try:
         from agentnode_sdk.runtimes.agent_runner import _load_agentnode_env
         _load_agentnode_env()
     except Exception:
         pass
-    env_val = (os.environ.get(env_var) or "").strip()
+    env_val = (os.environ.get(env_var) or "").strip() if env_var else ""
 
     token = ""
     if env_val:
@@ -101,9 +109,11 @@ def _store_llm_key(provider: str) -> str | None:
     return _storage_short(storage)
 
 
-def _credentials_screen() -> list[tuple[str, str]]:
-    """Screen 5: LLM credentials (optional, default = skip). Returns the
-    (provider, storage label) pairs stored in this run."""
+def _credentials_screen(cfg: dict) -> list[tuple[str, str]]:
+    """Screen 5: LLM credentials (optional, default = skip). Key providers
+    come from the registry-backed menu; ollama is a keyless CONFIG selection
+    (written to the wizard cfg, persisted only via the normal Save confirm).
+    Returns the (provider, storage label) pairs selected in this run."""
     import sys
 
     print()
@@ -120,19 +130,38 @@ def _credentials_screen() -> list[tuple[str, str]]:
         return []
 
     stored: list[tuple[str, str]] = []
+    all_options = list(_LLM_CHOICES) + [_OLLAMA_CHOICE, _SKIP_CHOICE]
     while True:
-        print("  [1] OpenAI   [2] Anthropic   [3] OpenRouter   [4] Skip for now")
-        c = _choice("  Choice", ["1", "2", "3", "4"], "4")
-        if c == "4":
+        print("  Recommended:  [1] OpenAI    [2] Anthropic   [3] OpenRouter")
+        print("  More:         [4] DeepSeek  [5] Mistral     [6] Qwen      [7] Gemini")
+        print("  Local:        [8] Ollama — keyless, requires a running Ollama")
+        print("  [9] Skip for now")
+        c = _choice("  Choice", all_options, _SKIP_CHOICE)
+        if c == _SKIP_CHOICE:
             break
-        provider = _LLM_CHOICES[c]
-        if any(p == provider for p, _ in stored):
-            print(f"  {provider} already added in this run.")
+        if c == _OLLAMA_CHOICE:
+            # keyless local provider: a config selection, NOT a credential.
+            # No key prompt, no probing, no starting anything.
+            if any(p == "ollama" for p, _ in stored):
+                print("  ollama already selected in this run.")
+            else:
+                print("  Ollama runs models locally — no API key, no per-token cost.")
+                print(dim("  Requires a running Ollama (https://ollama.com); the wizard"))
+                print(dim("  does not start or probe it."))
+                use = _prompt("  Use Ollama as your default LLM provider? [Y/n]: ", "y")
+                if use.lower() != "n":
+                    cfg["llm"]["default_provider"] = "ollama"
+                    stored.append(("ollama", "local, keyless"))
+                    print(dim("  Selected. Test later with `agentnode auth test ollama`."))
         else:
-            label = _store_llm_key(provider)
-            if label is not None:
-                stored.append((provider, label))
-        if len(stored) >= len(_LLM_CHOICES):
+            provider = _LLM_CHOICES[c]
+            if any(p == provider for p, _ in stored):
+                print(f"  {provider} already added in this run.")
+            else:
+                label = _store_llm_key(provider)
+                if label is not None:
+                    stored.append((provider, label))
+        if len(stored) >= len(_LLM_CHOICES) + 1:
             break
         more = _prompt("  Add another provider? [y/N]: ", "n")
         if more.lower() != "y":
@@ -283,8 +312,9 @@ def _wizard_flow() -> dict | None:
         c = _choice("  Choice", ["1", "2", "3"], "1")
         cfg["trust"]["minimum_trust_level"] = {"1": "verified", "2": "trusted", "3": "curated"}[c]
 
-    # Screen 5: LLM credentials (optional — UX-3A)
-    stored_providers = _credentials_screen()
+    # Screen 5: LLM credentials (optional — UX-3A; provider list from the
+    # registry incl. keyless ollama — Endpoint-B)
+    stored_providers = _credentials_screen(cfg)
 
     # Screen 6: Local sandbox (UX-3B)
     sandbox_status, image_missing = _sandbox_screen(cfg)

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/agentnode_sdk/credential_store.py

@@ -47,12 +47,19 @@ CREDENTIALS_FILE = "credentials.json"
 CURRENT_VERSION = 1
 
 # Canonical env vars for the LLM providers the host runtime understands.
+# DERIVED from the provider registry (single source of truth, Endpoint-B).
 # Env always OVERRIDES the stored credential (explicit/CI intent wins).
-LLM_PROVIDER_ENV: dict[str, str] = {
-    "openai": "OPENAI_API_KEY",
-    "anthropic": "ANTHROPIC_API_KEY",
-    "openrouter": "OPENROUTER_API_KEY",
-}
+def _derive_llm_provider_env() -> dict[str, str]:
+    from agentnode_sdk.llm_providers import KNOWN_PROVIDERS
+
+    return {
+        name: spec["api_key_env"]
+        for name, spec in KNOWN_PROVIDERS.items()
+        if spec.get("api_key_env")
+    }
+
+
+LLM_PROVIDER_ENV: dict[str, str] = _derive_llm_provider_env()
 
 # One keychain item per provider: service "agentnode:<provider>", a fixed
 # username. (NOT service="agentnode" + username=provider — Windows WinVault

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/agentnode_sdk/runtimes/agent_runner.py

@@ -216,7 +216,10 @@ def _create_llm_from_config(llm_config: dict) -> dict | None:
             kwargs: dict = {"api_key": api_key}
             if provider == "openrouter":
                 kwargs["base_url"] = "https://openrouter.ai/api/v1"
-            return {"client": OpenAI(**kwargs), "provider": "openai", "model": model}
+            # "provider" is the PROTOCOL discriminator (broker compat);
+            # "vendor" carries the real provider name for logs/status.
+            return {"client": OpenAI(**kwargs), "provider": "openai",
+                    "model": model, "vendor": provider}
         except ImportError:
             logger.debug("openai package not installed")
         except Exception as exc:
@@ -224,7 +227,8 @@ def _create_llm_from_config(llm_config: dict) -> dict | None:
     elif provider == "anthropic":
         try:
             from anthropic import Anthropic
-            return {"client": Anthropic(api_key=api_key), "provider": "anthropic", "model": model}
+            return {"client": Anthropic(api_key=api_key), "provider": "anthropic",
+                    "model": model, "vendor": "anthropic"}
         except ImportError:
             logger.debug("anthropic package not installed")
         except Exception as exc:
@@ -232,7 +236,8 @@ def _create_llm_from_config(llm_config: dict) -> dict | None:
     elif provider == "gemini":
         try:
             from google import genai
-            return {"client": genai.Client(api_key=api_key), "provider": "gemini", "model": model}
+            return {"client": genai.Client(api_key=api_key), "provider": "gemini",
+                    "model": model, "vendor": "gemini"}
         except ImportError:
             logger.debug("google-genai package not installed")
         except Exception as exc:
@@ -294,7 +299,8 @@ def _llm_binding_from_providers() -> dict | None:
         if name == "anthropic":
             try:
                 from anthropic import Anthropic
-                return {"client": Anthropic(api_key=key), "provider": "anthropic", "model": ""}
+                return {"client": Anthropic(api_key=key), "provider": "anthropic",
+                        "model": "", "vendor": "anthropic"}
             except ImportError:
                 logger.debug("key for anthropic set but anthropic package not installed")
             except Exception as exc:
@@ -313,7 +319,10 @@ def _llm_binding_from_providers() -> dict | None:
             kwargs: dict = {"api_key": key or "ollama"}
             if base_url:
                 kwargs["base_url"] = base_url
-            return {"client": OpenAI(**kwargs), "provider": "openai", "model": model}
+            # "provider" = protocol (broker compat); "vendor" = real name for
+            # logs/status. Host-side only — never crosses into the sandbox.
+            return {"client": OpenAI(**kwargs), "provider": "openai",
+                    "model": model, "vendor": name}
         except ImportError:
             logger.debug("key for %s set but openai package not installed", name)
         except Exception as exc:
@@ -353,7 +362,7 @@ def _auto_detect_llm(slug: str = "") -> dict | None:
         try:
             from openai import OpenAI
             client = OpenAI(api_key=openai_key)
-            return {"client": client, "provider": "openai", "model": ""}
+            return {"client": client, "provider": "openai", "model": "", "vendor": "openai"}
         except ImportError:
             logger.debug("OPENAI_API_KEY set but openai package not installed")
         except Exception as exc:
@@ -364,7 +373,7 @@ def _auto_detect_llm(slug: str = "") -> dict | None:
         try:
             from anthropic import Anthropic
             client = Anthropic(api_key=anthropic_key)
-            return {"client": client, "provider": "anthropic", "model": ""}
+            return {"client": client, "provider": "anthropic", "model": "", "vendor": "anthropic"}
         except ImportError:
             logger.debug("ANTHROPIC_API_KEY set but anthropic package not installed")
         except Exception as exc:

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentnode-sdk"
-version = "0.15.0"
+version = "0.16.0"
 description = "Python SDK for AgentNode — the open upgrade and discovery infrastructure for AI agents."
 readme = "README.md"
 requires-python = ">=3.10"

{agentnode_sdk-0.15.0 → agentnode_sdk-0.16.0}/tests/test_auth_cli_vault.py

@@ -44,7 +44,9 @@ def _isolated(tmp_path, monkeypatch):
     # keep the test hermetic
     monkeypatch.setattr(
         "agentnode_sdk.runtimes.agent_runner._load_agentnode_env", lambda: None)
-    for var in ("OPENAI_API_KEY", "ANTHROPIC_API_KEY", "OPENROUTER_API_KEY"):
+    for var in ("OPENAI_API_KEY", "ANTHROPIC_API_KEY", "OPENROUTER_API_KEY",
+                "DEEPSEEK_API_KEY", "MISTRAL_API_KEY", "DASHSCOPE_API_KEY",
+                "GEMINI_API_KEY", "OLLAMA_API_KEY"):
         monkeypatch.delenv(var, raising=False)
     yield
 
@@ -207,6 +209,132 @@ def test_list_shows_storage_column_no_leak(monkeypatch, capsys):
     assert SECRET not in out
 
 
+# --- Endpoint-B: registry-driven status/test ---------------------------------
+
+def test_status_shows_all_registry_providers(monkeypatch, capsys):
+    _use_keyring(monkeypatch, None)
+    assert cmd_auth_status() == 0
+    out = capsys.readouterr().out
+    for provider in ("openai", "anthropic", "openrouter", "deepseek",
+                     "mistral", "qwen", "gemini"):
+        assert provider in out
+    assert "ollama" in out
+    assert "local (keyless)" in out                   # never shown as "missing"
+    assert "not selected" in out
+
+
+def test_status_shows_ollama_selected(monkeypatch, capsys):
+    monkeypatch.setattr("agentnode_sdk.config.load_config",
+                        lambda: {"llm": {"default_provider": "ollama"}})
+    assert cmd_auth_status() == 0
+    out = capsys.readouterr().out
+    assert "selected via llm.default_provider" in out
+
+
+def test_status_shows_custom_provider(monkeypatch, capsys):
+    monkeypatch.setattr(
+        "agentnode_sdk.config.load_config",
+        lambda: {"llm": {"providers": {"myvllm": {
+            "base_url": "http://10.0.0.5:8000/v1", "model": "llama"}}}})
+    assert cmd_auth_status() == 0
+    assert "myvllm" in capsys.readouterr().out
+
+
+@respx.mock
+def test_auth_test_deepseek_generic_models_probe(monkeypatch, capsys):
+    _use_keyring(monkeypatch, None)
+    cs.set_credential("deepseek", SECRET, auth_type="api_key")
+    route = respx.get("https://api.deepseek.com/v1/models").mock(
+        return_value=httpx.Response(200, json={"data": []}))
+    assert cmd_auth_test("deepseek") == 0
+    assert route.calls.last.request.headers["Authorization"] == f"Bearer {SECRET}"
+    out = capsys.readouterr().out
+    assert SECRET not in out and "valid" in out
+
+
+@respx.mock
+def test_auth_test_deepseek_rejected_no_body_echo(monkeypatch, capsys):
+    _use_keyring(monkeypatch, None)
+    cs.set_credential("deepseek", SECRET, auth_type="api_key")
+    respx.get("https://api.deepseek.com/v1/models").mock(
+        return_value=httpx.Response(401, json={"error": f"bad key {SECRET}"}))
+    assert cmd_auth_test("deepseek") == 1
+    out = capsys.readouterr().out
+    assert SECRET not in out                          # body never echoed
+
+
+@respx.mock
+def test_auth_test_gemini_uses_compat_endpoint(monkeypatch):
+    _use_keyring(monkeypatch, None)
+    cs.set_credential("gemini", SECRET, auth_type="api_key")
+    route = respx.get(
+        "https://generativelanguage.googleapis.com/v1beta/openai/models").mock(
+        return_value=httpx.Response(200, json={"data": []}))
+    assert cmd_auth_test("gemini") == 0
+    assert route.called
+
+
+@respx.mock
+def test_auth_test_openrouter_still_auth_key_endpoint(monkeypatch):
+    # /models is unauthenticated on OpenRouter — the exception must survive
+    _use_keyring(monkeypatch, None)
+    cs.set_credential("openrouter", SECRET, auth_type="api_key")
+    route = respx.get("https://openrouter.ai/api/v1/auth/key").mock(
+        return_value=httpx.Response(200, json={"data": {}}))
+    assert cmd_auth_test("openrouter") == 0
+    assert route.called
+
+
+@respx.mock
+def test_auth_test_ollama_reachable_exit_0(monkeypatch, capsys):
+    route = respx.get("http://localhost:11434/v1/models").mock(
+        return_value=httpx.Response(200, json={"data": []}))
+    assert cmd_auth_test("ollama") == 0               # keyless: no exit-2 gate
+    assert route.called
+    out = capsys.readouterr().out
+    assert "reachable" in out
+    assert "authorization" not in route.calls.last.request.headers  # keyless probe
+
+
+@respx.mock
+def test_auth_test_ollama_unreachable_exit_3_never_rejected(monkeypatch, capsys):
+    respx.get("http://localhost:11434/v1/models").mock(
+        side_effect=httpx.ConnectError("refused"))
+    assert cmd_auth_test("ollama") == 3               # unreachable ≠ rejected
+    out = capsys.readouterr().out
+    assert "running" in out                            # "is ... Ollama running?"
+
+
+@respx.mock
+def test_auth_test_custom_provider_via_config(monkeypatch):
+    _use_keyring(monkeypatch, None)
+    monkeypatch.setattr(
+        "agentnode_sdk.config.load_config",
+        lambda: {"llm": {"providers": {"myvllm": {
+            "base_url": "http://10.0.0.5:8000/v1", "model": "llama",
+            "requires_key": False}}}})
+    route = respx.get("http://10.0.0.5:8000/v1/models").mock(
+        return_value=httpx.Response(200, json={"data": []}))
+    assert cmd_auth_test("myvllm") == 0
+    assert route.called
+
+
+def test_auth_test_unknown_provider_exit_2_b(monkeypatch):
+    assert cmd_auth_test("skynet") == 2
+
+
+def test_registry_is_single_source_of_truth():
+    """auth CLI and wizard must not hardcode provider env vars — those come
+    from the registry only."""
+    import agentnode_sdk
+    from pathlib import Path
+    for mod in ("cli/auth.py", "cli/setup_wizard.py"):
+        src = (Path(agentnode_sdk.__file__).parent / mod).read_text(encoding="utf-8")
+        for literal in ("DEEPSEEK_API_KEY", "MISTRAL_API_KEY", "DASHSCOPE_API_KEY",
+                        "GEMINI_API_KEY", "OPENROUTER_API_KEY", "OLLAMA_API_KEY"):
+            assert literal not in src, f"{literal} hardcoded in {mod}"
+
+
 def test_no_secret_in_logs(monkeypatch, caplog):
     """No log record in the store paths ever carries the token."""
     class WriteFails(FakeKeyring):