android-localisation 1.5.0__tar.gz → 1.6.0__tar.gz

{android_localisation-1.5.0/android_localisation.egg-info → android_localisation-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: android-localisation
-Version: 1.5.0
+Version: 1.6.0
 Summary: Zero-dependency Android strings.xml and Google Play store listing translation using LLMs (Gemini, OpenAI, Anthropic, Ollama).
 License: MIT
 Project-URL: Homepage, https://github.com/BharathKmalviya/android-llm-localization
@@ -127,6 +127,10 @@ When you run `android-localise translate --api-key YOUR_KEY`, here's exactly wha
 4. Parses the response and checks duplicate/unexpected/missing resources, attributes, inline markup, item structure, control escapes and format arguments. A valid result replaces the file atomically; new folders are created only when saving. `--skip-existing` validates existing files and skips them without API calls. `--dry-run` shows a diff without writing any files or creating folders
 5. Waits 5 seconds between each language request to avoid hitting API rate limits
 
+Keys resolve from `--api-key`, then provider environment variables / `API_KEY`,
+then saved Windows credentials for built-in provider endpoints. The CLI never
+prompts for a key during translation; use `credentials set` yourself beforehand.
+
 **Defaults used when you don't specify anything:**
 
 | What | Default |
@@ -226,7 +230,7 @@ android-localise translate \
 
 | Flag | What it does | Default |
 |---|---|---|
-| `--api-key` | Your API key | reads from env var |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--provider` | Which AI to use: `gemini` `openai` `anthropic` `custom` | `gemini` |
 | `--model` | Specific model to use | see [Providers](#providers) |
 | `--languages` | Comma-separated Android/conventional codes and/or `all`, e.g. `all,zu` or `hi,es-ES,b+es+419` | scan existing destination locale folders |
@@ -305,7 +309,7 @@ Console import file. The CLI does not upload or publish a listing.
 | `--dry-run` | Generate, validate and display diffs without files/directories being written | off; API usage applies |
 | `--provider` | `gemini`, `openai`, `anthropic`, `custom` | `gemini` |
 | `--model` | Pin any supported model and disable fallbacks | provider default |
-| `--api-key` | Key, or provider-specific environment variable / `API_KEY` | environment |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--base-url` | OpenAI-compatible endpoint; required for `custom` | provider endpoint |
 | `--app-context` | Terminology context; source copy remains the source of facts | none |
 | `--sleep` | Delay between requests, including correction/fallback requests | `5.0` seconds |
@@ -525,9 +529,72 @@ android-localise translate \
 
 ---
 
+## Save a key once on Windows
+
+Run this yourself in your terminal:
+
+```bash
+android-localise credentials set --provider gemini
+```
+
+Enter your key at the hidden prompt. It is stored in **Windows Credential
+Manager**, for your Windows user on this computer, and persists across terminal
+and computer restarts. The CLI does not write a plaintext key file or modify
+environment variables. Running `set` again replaces that provider's saved key.
+There is no key argument or piped-input option for this command; it requires an
+interactive terminal and refuses a prompt that cannot hide input.
+
+Then you or an AI assistant can run ordinary commands without including a key:
+
+```bash
+android-localise translate --languages hi,es
+android-localise store-listing --source listing.json --languages hi-IN,es-ES
+android-localise credentials status --provider gemini
+android-localise credentials remove --provider gemini
+```
+
+`status` reports only `saved` or `not saved`; no command displays the saved value.
+`remove` deletes only this CLI's saved entry for that provider; it does not revoke
+the provider key or clear environment-variable overrides. The same commands also
+work with `python -m android_localisation credentials ...`.
+
+| Argument | Description | Default |
+|---|---|---|
+| `set`, `status`, `remove` | Hidden entry, presence check, or deletion | required action |
+| `--provider` | `gemini`, `openai` or `anthropic` | `gemini` |
+
+Both translation commands use this precedence: `--api-key` → provider-specific
+environment variable → `API_KEY` → saved Windows key. Existing overrides retain
+their behavior; if an old environment key is set, saving a new key does not
+override it. Saved OpenAI keys load only for its default endpoint; `custom`
+providers and other `--base-url` endpoints continue using explicit keys or
+environment variables. Saved keys are not automatically sent to custom hosts.
+Provider requests reject HTTP redirects, so use a custom endpoint's final URL.
+Gemini authentication uses a header rather than a URL query parameter, and
+API/network error messages redact the key used for that request before display.
+
+This keeps keys out of chat, command arguments and routine CLI output. It
+**does not isolate secrets from an AI or other program with unrestricted access
+under your Windows account**: Windows permits programs running as that user to
+read their credentials. The key is also present in memory during an API request.
+For stronger separation, use a restricted runner or separately secured proxy.
+See [Microsoft's credential API documentation](https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credreadw).
+
+Saved-key commands are Windows-only, with no plaintext fallback. Other platforms
+keep using environment variables or `--api-key`.
+
+Manual check: save a key yourself, confirm input is hidden, open a new terminal
+and check `status`. Run a small XML and listing preview without `--api-key`,
+review the output, then remove the entry and confirm `not saved`. Ensure any key
+environment overrides are absent when checking saved-key behavior.
+
+---
+
 ## Environment variables
 
-Set your API key as an env variable so you don't have to pass it every time:
+Environment variables remain available on all platforms. For Windows saved
+credentials, use the commands above instead of putting a key in shell history.
+To use an environment variable:
 
 ```bash
 # macOS / Linux

{android_localisation-1.5.0 → android_localisation-1.6.0}/README.md

@@ -99,6 +99,10 @@ When you run `android-localise translate --api-key YOUR_KEY`, here's exactly wha
 4. Parses the response and checks duplicate/unexpected/missing resources, attributes, inline markup, item structure, control escapes and format arguments. A valid result replaces the file atomically; new folders are created only when saving. `--skip-existing` validates existing files and skips them without API calls. `--dry-run` shows a diff without writing any files or creating folders
 5. Waits 5 seconds between each language request to avoid hitting API rate limits
 
+Keys resolve from `--api-key`, then provider environment variables / `API_KEY`,
+then saved Windows credentials for built-in provider endpoints. The CLI never
+prompts for a key during translation; use `credentials set` yourself beforehand.
+
 **Defaults used when you don't specify anything:**
 
 | What | Default |
@@ -198,7 +202,7 @@ android-localise translate \
 
 | Flag | What it does | Default |
 |---|---|---|
-| `--api-key` | Your API key | reads from env var |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--provider` | Which AI to use: `gemini` `openai` `anthropic` `custom` | `gemini` |
 | `--model` | Specific model to use | see [Providers](#providers) |
 | `--languages` | Comma-separated Android/conventional codes and/or `all`, e.g. `all,zu` or `hi,es-ES,b+es+419` | scan existing destination locale folders |
@@ -277,7 +281,7 @@ Console import file. The CLI does not upload or publish a listing.
 | `--dry-run` | Generate, validate and display diffs without files/directories being written | off; API usage applies |
 | `--provider` | `gemini`, `openai`, `anthropic`, `custom` | `gemini` |
 | `--model` | Pin any supported model and disable fallbacks | provider default |
-| `--api-key` | Key, or provider-specific environment variable / `API_KEY` | environment |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--base-url` | OpenAI-compatible endpoint; required for `custom` | provider endpoint |
 | `--app-context` | Terminology context; source copy remains the source of facts | none |
 | `--sleep` | Delay between requests, including correction/fallback requests | `5.0` seconds |
@@ -497,9 +501,72 @@ android-localise translate \
 
 ---
 
+## Save a key once on Windows
+
+Run this yourself in your terminal:
+
+```bash
+android-localise credentials set --provider gemini
+```
+
+Enter your key at the hidden prompt. It is stored in **Windows Credential
+Manager**, for your Windows user on this computer, and persists across terminal
+and computer restarts. The CLI does not write a plaintext key file or modify
+environment variables. Running `set` again replaces that provider's saved key.
+There is no key argument or piped-input option for this command; it requires an
+interactive terminal and refuses a prompt that cannot hide input.
+
+Then you or an AI assistant can run ordinary commands without including a key:
+
+```bash
+android-localise translate --languages hi,es
+android-localise store-listing --source listing.json --languages hi-IN,es-ES
+android-localise credentials status --provider gemini
+android-localise credentials remove --provider gemini
+```
+
+`status` reports only `saved` or `not saved`; no command displays the saved value.
+`remove` deletes only this CLI's saved entry for that provider; it does not revoke
+the provider key or clear environment-variable overrides. The same commands also
+work with `python -m android_localisation credentials ...`.
+
+| Argument | Description | Default |
+|---|---|---|
+| `set`, `status`, `remove` | Hidden entry, presence check, or deletion | required action |
+| `--provider` | `gemini`, `openai` or `anthropic` | `gemini` |
+
+Both translation commands use this precedence: `--api-key` → provider-specific
+environment variable → `API_KEY` → saved Windows key. Existing overrides retain
+their behavior; if an old environment key is set, saving a new key does not
+override it. Saved OpenAI keys load only for its default endpoint; `custom`
+providers and other `--base-url` endpoints continue using explicit keys or
+environment variables. Saved keys are not automatically sent to custom hosts.
+Provider requests reject HTTP redirects, so use a custom endpoint's final URL.
+Gemini authentication uses a header rather than a URL query parameter, and
+API/network error messages redact the key used for that request before display.
+
+This keeps keys out of chat, command arguments and routine CLI output. It
+**does not isolate secrets from an AI or other program with unrestricted access
+under your Windows account**: Windows permits programs running as that user to
+read their credentials. The key is also present in memory during an API request.
+For stronger separation, use a restricted runner or separately secured proxy.
+See [Microsoft's credential API documentation](https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credreadw).
+
+Saved-key commands are Windows-only, with no plaintext fallback. Other platforms
+keep using environment variables or `--api-key`.
+
+Manual check: save a key yourself, confirm input is hidden, open a new terminal
+and check `status`. Run a small XML and listing preview without `--api-key`,
+review the output, then remove the entry and confirm `not saved`. Ensure any key
+environment overrides are absent when checking saved-key behavior.
+
+---
+
 ## Environment variables
 
-Set your API key as an env variable so you don't have to pass it every time:
+Environment variables remain available on all platforms. For Windows saved
+credentials, use the commands above instead of putting a key in shell history.
+To use an environment variable:
 
 ```bash
 # macOS / Linux

{android_localisation-1.5.0 → android_localisation-1.6.0}/android_localisation/__init__.py

@@ -2,4 +2,4 @@
 android-localisation: Zero-dependency Android XML and Play listing translation using LLMs.
 """
 
-__version__ = "1.5.0"
+__version__ = "1.6.0"

{android_localisation-1.5.0 → android_localisation-1.6.0}/android_localisation/cli.py

@@ -33,11 +33,12 @@ Other examples:
   android-localise store-listing --source listing.json --languages hi,es-ES
   android-localise translate --languages hi --missing-only --dry-run
   android-localise models --provider openai
+  android-localise credentials set --provider gemini (Windows, hidden prompt)
   python -m android_localisation setup-path          (Windows, one-time)
 
 Use android-localise COMMAND --help for flags, defaults and examples.
 All commands also work with: python -m android_localisation COMMAND
-Keys: GEMINI_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, or API_KEY.
+Keys: --api-key, environment variables, then saved Windows credentials.
 Update notices: set ANDROID_LOCALISE_NO_UPDATE_CHECK=1 to disable them.""",
     )
     parser.add_argument("--version", action="version", version=f"android-localisation {__version__}")
@@ -71,7 +72,7 @@ Use android-localise models to see current defaults and fallbacks.""",
     add_flexible_arguments(translate_parser)
     translate_parser.add_argument("--provider", choices=["gemini", "openai", "anthropic", "custom"], default="gemini", help="AI provider (default: gemini)")
     translate_parser.add_argument("--model", help="Pin any supported model and disable fallbacks (default: provider default; see models)")
-    translate_parser.add_argument("--api-key", help="API key, or set GEMINI_API_KEY / OPENAI_API_KEY / ANTHROPIC_API_KEY / API_KEY")
+    translate_parser.add_argument("--api-key", help="API key; otherwise use provider environment variable / API_KEY, then saved Windows key")
     translate_parser.add_argument("--base-url", help="Custom OpenAI-compatible endpoint URL (required for 'custom' provider)")
     translate_parser.add_argument("--app-context", help="Short description of your app for better translations")
     translate_parser.add_argument("--sleep", type=float, default=5.0, help="Seconds between API requests (default: 5.0)")
@@ -151,6 +152,25 @@ Custom/local providers require an explicit --model.""",
     models_parser.add_argument("--provider", choices=["gemini", "openai", "anthropic"], default=None,
                                help="Filter by provider (shows all if not set)")
 
+    from android_localisation.credentials import add_arguments as add_credential_arguments
+    credentials_parser = subparsers.add_parser(
+        "credentials", help="Manage saved Windows API keys without displaying them",
+        description="""Save provider keys in Windows Credential Manager for your user account.
+Run set yourself in an interactive terminal; the key prompt is hidden.
+Status reports presence only. Translation commands load saved keys automatically
+after argument/environment overrides. This does not isolate keys from programs
+or AI agents with unrestricted access under your Windows account.""",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""Examples:
+  android-localise credentials set --provider gemini
+  android-localise credentials status --provider gemini
+  android-localise credentials remove --provider gemini
+
+No key argument, piped input or plaintext storage fallback is supported.
+Custom endpoints continue using explicit keys or environment variables.""",
+    )
+    add_credential_arguments(credentials_parser)
+
     subparsers.add_parser(
         "setup-path", help="Add the installed Scripts folder to Windows user PATH",
         description="""One-time Windows setup for an installed CLI that PowerShell cannot find.
@@ -183,7 +203,11 @@ Exit code 1 reports unsupported platforms, virtual environments or setup failure
 
 
 def _run_command(args):
-    if args.command == "setup-path":
+    if args.command == "credentials":
+        from android_localisation.credentials import main as run
+        return run(args)
+
+    elif args.command == "setup-path":
         from android_localisation.setup_path import main as run
         return run(args)
 

android_localisation-1.6.0/android_localisation/credentials.py

@@ -0,0 +1,185 @@
+"""Explicit, user-scoped API key storage in Windows Credential Manager."""
+
+import argparse
+import ctypes
+import getpass
+import os
+import sys
+import warnings
+from ctypes import wintypes
+
+
+PROVIDERS = ("gemini", "openai", "anthropic")
+OPENAI_ENDPOINT = "https://api.openai.com/v1/chat/completions"
+_GENERIC = 1
+_LOCAL_MACHINE = 2  # Persistent on this computer, still scoped to the user.
+_NOT_FOUND = 1168
+_MAX_BLOB = 2560
+
+
+class _Credential(ctypes.Structure):
+    _fields_ = [
+        ("Flags", wintypes.DWORD), ("Type", wintypes.DWORD),
+        ("TargetName", wintypes.LPWSTR), ("Comment", wintypes.LPWSTR),
+        ("LastWritten", wintypes.FILETIME), ("CredentialBlobSize", wintypes.DWORD),
+        ("CredentialBlob", ctypes.POINTER(wintypes.BYTE)), ("Persist", wintypes.DWORD),
+        ("AttributeCount", wintypes.DWORD), ("Attributes", ctypes.c_void_p),
+        ("TargetAlias", wintypes.LPWSTR), ("UserName", wintypes.LPWSTR),
+    ]
+
+
+def _target(provider):
+    if provider not in PROVIDERS:
+        raise ValueError("Saved keys support gemini, openai and anthropic only.")
+    return "android-localisation:api-key:" + provider
+
+
+def _windows_api():
+    if os.name != "nt":
+        raise OSError("Saved key commands require Windows Credential Manager. Use environment variables on other platforms.")
+    api = ctypes.WinDLL("advapi32", use_last_error=True)
+    pointer = ctypes.POINTER(_Credential)
+    api.CredWriteW.argtypes = [pointer, wintypes.DWORD]
+    api.CredWriteW.restype = wintypes.BOOL
+    api.CredReadW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD,
+                            ctypes.POINTER(pointer)]
+    api.CredReadW.restype = wintypes.BOOL
+    api.CredDeleteW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD]
+    api.CredDeleteW.restype = wintypes.BOOL
+    api.CredFree.argtypes = [ctypes.c_void_p]
+    api.CredFree.restype = None
+    return api
+
+
+def _failure():
+    # Do not include credential values or structures in diagnostics.
+    return OSError("Windows Credential Manager failed (error {}).".format(ctypes.get_last_error()))
+
+
+def save_key(provider, key):
+    target = _target(provider)
+    if not key or any(ord(char) < 33 or ord(char) > 126 for char in key):
+        raise ValueError("API key must be nonempty printable ASCII without whitespace.")
+    encoded = key.encode("ascii")
+    if len(encoded) > _MAX_BLOB:
+        raise ValueError("API key exceeds Windows Credential Manager's size limit.")
+    api = _windows_api()
+    blob = (wintypes.BYTE * len(encoded)).from_buffer_copy(encoded)
+    credential = _Credential()
+    credential.Type = _GENERIC
+    credential.TargetName = target
+    credential.Comment = "API key for android-localisation"
+    credential.CredentialBlobSize = len(encoded)
+    credential.CredentialBlob = blob
+    credential.Persist = _LOCAL_MACHINE
+    credential.UserName = provider
+    try:
+        if not api.CredWriteW(ctypes.byref(credential), 0):
+            raise _failure()
+    finally:
+        ctypes.memset(blob, 0, len(encoded))
+
+
+def _read_key(provider, presence_only=False):
+    target = _target(provider)
+    api = _windows_api()
+    pointer = ctypes.POINTER(_Credential)()
+    if not api.CredReadW(target, _GENERIC, 0, ctypes.byref(pointer)):
+        if ctypes.get_last_error() == _NOT_FOUND:
+            return False if presence_only else None
+        raise _failure()
+    try:
+        credential = pointer.contents
+        if presence_only:
+            return True
+        size = credential.CredentialBlobSize
+        if not 0 < size <= _MAX_BLOB or not credential.CredentialBlob:
+            raise ValueError("Saved API key is invalid; save it again with credentials set.")
+        try:
+            key = ctypes.string_at(credential.CredentialBlob, size).decode("ascii")
+        except UnicodeDecodeError:
+            raise ValueError("Saved API key is invalid; save it again with credentials set.") from None
+        if any(ord(char) < 33 or ord(char) > 126 for char in key):
+            raise ValueError("Saved API key is invalid; save it again with credentials set.")
+        return key
+    finally:
+        # The Python string still exists while needed; this is not a memory vault.
+        if pointer.contents.CredentialBlob and pointer.contents.CredentialBlobSize <= _MAX_BLOB:
+            ctypes.memset(pointer.contents.CredentialBlob, 0, pointer.contents.CredentialBlobSize)
+        api.CredFree(pointer)
+
+
+def remove_key(provider):
+    target = _target(provider)
+    api = _windows_api()
+    if api.CredDeleteW(target, _GENERIC, 0):
+        return True
+    if ctypes.get_last_error() == _NOT_FOUND:
+        return False
+    raise _failure()
+
+
+def resolve_api_key(provider, supplied=None, base_url=None):
+    """Preserve argument/env precedence; use saved keys only for built-in endpoints."""
+    env_name = {"gemini": "GEMINI_API_KEY", "openai": "OPENAI_API_KEY",
+                "anthropic": "ANTHROPIC_API_KEY", "custom": "OPENAI_API_KEY"}.get(provider)
+    key = supplied or (os.environ.get(env_name) if env_name else None) or os.environ.get("API_KEY")
+    if key:
+        return key
+    if os.name != "nt" or provider not in PROVIDERS:
+        return None
+    if provider == "openai" and base_url and base_url != OPENAI_ENDPOINT:
+        return None  # Never silently forward a saved OpenAI key to a custom host.
+    return _read_key(provider)
+
+
+def add_arguments(parser):
+    parser.add_argument("action", choices=("set", "status", "remove"),
+                        help="Save via hidden prompt, report presence, or remove the saved key")
+    parser.add_argument("--provider", choices=PROVIDERS, default="gemini",
+                        help="Provider credential to manage (default: gemini)")
+
+
+def _parse_args(args=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    add_arguments(parser)
+    return parser.parse_args(args)
+
+
+def main(args=None):
+    if args is None or isinstance(args, list):
+        args = _parse_args(args)
+    try:
+        if args.action == "set":
+            if os.name != "nt":
+                raise OSError("Saved key commands require Windows Credential Manager. Use environment variables on other platforms.")
+            if not sys.stdin.isatty():
+                raise ValueError("Run credentials set yourself in an interactive terminal; piped keys are not accepted.")
+            with warnings.catch_warnings():
+                warnings.simplefilter("error", getpass.GetPassWarning)
+                key = getpass.getpass("{} API key (hidden): ".format(args.provider))
+            try:
+                save_key(args.provider, key)
+            finally:
+                key = None
+            print("Saved {} API key in Windows Credential Manager for this user.".format(args.provider))
+        elif args.action == "status":
+            present = _read_key(args.provider, presence_only=True)
+            print("{}: {}".format(args.provider, "saved" if present else "not saved"))
+        elif args.action == "remove":
+            removed = remove_key(args.provider)
+            print("{}: {}".format(args.provider, "saved key removed" if removed else "no saved key"))
+        else:
+            raise ValueError("Unknown credentials action.")
+    except (OSError, ValueError, getpass.GetPassWarning) as error:
+        # Specific errors above are safe; getpass fallback must never echo a key.
+        print("ERROR: {}".format(error))
+        return 1
+    except (EOFError, KeyboardInterrupt):
+        print("Key entry cancelled; saved credentials unchanged.")
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{android_localisation-1.5.0 → android_localisation-1.6.0}/android_localisation/store_listing.py

@@ -11,6 +11,7 @@ import time
 import unicodedata
 
 from android_localisation.resources import atomic_write
+from android_localisation.credentials import resolve_api_key
 from android_localisation.locales import (
     GOOGLE_PLAY_LOCALES, language_items, normalize_play_locale, select_locales,
 )
@@ -47,7 +48,7 @@ def add_arguments(parser):
     parser.add_argument("--dry-run", action="store_true", help="Generate and validate a diff without saving (API usage applies)")
     parser.add_argument("--provider", choices=list(PROVIDER_MODELS), default="gemini", help="AI provider (default: gemini)")
     parser.add_argument("--model", help="Pin a model and disable automatic fallbacks (default: provider default; see models)")
-    parser.add_argument("--api-key", help="API key, or provider-specific environment variable / API_KEY")
+    parser.add_argument("--api-key", help="API key; otherwise provider environment variable / API_KEY, then saved Windows key")
     parser.add_argument("--base-url", help="Custom OpenAI-compatible endpoint (required for custom provider)")
     parser.add_argument("--app-context", help="Short app description for terminology; listing remains the source of facts")
     parser.add_argument("--sleep", type=float, default=5.0, help="Seconds between requests, including validation retries (default: 5.0)")
@@ -176,11 +177,9 @@ def main(args=None):
         if args.provider == "custom" and (not args.model or not args.base_url):
             raise ValueError("custom provider requires --model and --base-url")
         models = [args.model] if args.model else model_list
-        env_name = {"gemini": "GEMINI_API_KEY", "openai": "OPENAI_API_KEY",
-                    "anthropic": "ANTHROPIC_API_KEY", "custom": "OPENAI_API_KEY"}[args.provider]
-        api_key = args.api_key or os.environ.get(env_name) or os.environ.get("API_KEY")
+        api_key = resolve_api_key(args.provider, args.api_key, args.base_url)
         if not api_key and args.provider != "custom":
-            raise ValueError("provide --api-key or set {} / API_KEY".format(env_name))
+            raise ValueError("provide --api-key, a provider environment variable, or save a Windows key with credentials set; saved keys are not used with custom endpoints")
     except (OSError, ValueError, KeyError) as exc:
         print("ERROR: {}".format(exc))
         return 1

{android_localisation-1.5.0 → android_localisation-1.6.0}/android_localisation/translate.py

@@ -5,6 +5,7 @@ import socket
 import argparse
 import urllib.request
 import urllib.error
+import urllib.parse
 import json
 import math
 import difflib
@@ -22,6 +23,7 @@ from android_localisation.resources import (
 from android_localisation.locales import (
     all_android_locales, android_locale, language_items, normalize_play_locale, select_locales,
 )
+from android_localisation.credentials import resolve_api_key
 
 DEFAULT_RES_DIR = "app/src/main/res"
 DEFAULT_API_TIMEOUT = 180  # seconds (3 minutes) — large strings.xml files can exceed 60s
@@ -148,7 +150,7 @@ def clean_xml_response(result):
 
 def _read_error_body(e):
     try:
-        return e.read().decode("utf-8", errors="replace")[:500]
+        return e.read().decode("utf-8", errors="replace")
     except Exception:
         return "(could not read error body)"
 
@@ -173,27 +175,43 @@ def _is_timeout_error(exc):
     )
 
 
-def _urlopen_with_retries(req, provider_label, timeout):
+def _redact_error(value, api_key):
+    text = str(value)
+    if api_key:
+        for secret in sorted({api_key, urllib.parse.quote(api_key, safe=""),
+                              urllib.parse.quote_plus(api_key), json.dumps(api_key)[1:-1]},
+                             key=len, reverse=True):
+            text = text.replace(secret, "[REDACTED]")
+    return text[:500]
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None  # Do not forward authentication headers to redirect targets.
+
+
+def _urlopen_with_retries(req, provider_label, timeout, api_key=None):
     """
     Execute an HTTP request with timeout/network error handling and retries on timeout.
     Returns (response_bytes, model_not_found).
     """
+    opener = urllib.request.build_opener(_NoRedirect())
     for attempt in range(MAX_TIMEOUT_RETRIES + 1):
         if attempt > 0:
             wait = attempt * 3
             print(f"  🔁 {provider_label} timed out — retrying ({attempt}/{MAX_TIMEOUT_RETRIES}) in {wait}s...")
             time.sleep(wait)
         try:
-            with urllib.request.urlopen(req, timeout=timeout) as response:
+            with opener.open(req, timeout=timeout) as response:
                 return response.read(), False
         except urllib.error.HTTPError as e:
             body = _read_error_body(e)
             model_gone = _is_model_not_found(e.code, body)
-            print(f"  ❌ {provider_label} API Error: {e.code} - {body}")
+            print(f"  ❌ {provider_label} API Error: {e.code} - {_redact_error(body, api_key)}")
             return None, model_gone
         except (TimeoutError, socket.timeout, urllib.error.URLError) as e:
             if not _is_timeout_error(e):
-                print(f"  ❌ {provider_label} network error: {e.reason}")
+                print(f"  ❌ {provider_label} network error: {_redact_error(e.reason, api_key)}")
                 return None, False
             if attempt < MAX_TIMEOUT_RETRIES:
                 continue
@@ -203,11 +221,11 @@ def _urlopen_with_retries(req, provider_label, timeout):
 
 
 def call_gemini(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
-    url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent?key={api_key}"
-    headers = {"Content-Type": "application/json"}
+    url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent"
+    headers = {"Content-Type": "application/json", "x-goog-api-key": api_key}
     data = {"contents": [{"parts": [{"text": prompt}]}]}
     req = urllib.request.Request(url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
-    raw, model_gone = _urlopen_with_retries(req, "Gemini", timeout)
+    raw, model_gone = _urlopen_with_retries(req, "Gemini", timeout, api_key)
     if raw is None:
         return None, model_gone
     result = json.loads(raw.decode("utf-8"))
@@ -217,7 +235,7 @@ def call_gemini(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
         return None, False
     candidate = candidates[0]
     if candidate.get("finishReason") not in (None, "STOP"):
-        print("  ❌ Gemini response was incomplete or blocked: {}".format(candidate.get("finishReason")))
+        print("  ❌ Gemini response was incomplete or blocked: {}".format(_redact_error(candidate.get("finishReason"), api_key)))
         return None, False
     return "".join(part.get("text", "") for part in candidate.get("content", {}).get("parts", [])
                    if not part.get("thought")), False
@@ -233,7 +251,7 @@ def call_openai_compatible(api_key, base_url, model, prompt, timeout=DEFAULT_API
         "messages": [{"role": "user", "content": prompt}],
     }
     req = urllib.request.Request(base_url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
-    raw, model_gone = _urlopen_with_retries(req, "OpenAI (compatible)", timeout)
+    raw, model_gone = _urlopen_with_retries(req, "OpenAI (compatible)", timeout, api_key)
     if raw is None:
         return None, model_gone
     result = json.loads(raw.decode("utf-8"))
@@ -242,7 +260,7 @@ def call_openai_compatible(api_key, base_url, model, prompt, timeout=DEFAULT_API
         print("  ❌ OpenAI returned no choices.")
         return None, False
     if choices[0].get("finish_reason") not in (None, "stop"):
-        print("  ❌ OpenAI-compatible response was incomplete: {}".format(choices[0].get("finish_reason")))
+        print("  ❌ OpenAI-compatible response was incomplete: {}".format(_redact_error(choices[0].get("finish_reason"), api_key)))
         return None, False
     return choices[0].get("message", {}).get("content", ""), False
 
@@ -260,7 +278,7 @@ def call_anthropic(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
         "messages": [{"role": "user", "content": prompt}],
     }
     req = urllib.request.Request(url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
-    raw, model_gone = _urlopen_with_retries(req, "Anthropic", timeout)
+    raw, model_gone = _urlopen_with_retries(req, "Anthropic", timeout, api_key)
     if raw is None:
         return None, model_gone
     result = json.loads(raw.decode("utf-8"))
@@ -269,7 +287,7 @@ def call_anthropic(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
         print("  ❌ Anthropic returned no content.")
         return None, False
     if result.get("stop_reason") not in (None, "end_turn"):
-        print("  ❌ Anthropic response was incomplete: {}".format(result.get("stop_reason")))
+        print("  ❌ Anthropic response was incomplete: {}".format(_redact_error(result.get("stop_reason"), api_key)))
         return None, False
     return "".join(block.get("text", "") for block in content if block.get("type") == "text"), False
 
@@ -327,7 +345,7 @@ def _parse_args(args=None):
     add_flexible_arguments(parser)
     parser.add_argument("--provider", choices=["gemini", "openai", "anthropic", "custom"], default="gemini", help="AI provider (default: gemini)")
     parser.add_argument("--model", help="Pin any supported model and disable fallbacks (default: provider default; see models)")
-    parser.add_argument("--api-key", help="API key, or set GEMINI_API_KEY / OPENAI_API_KEY / ANTHROPIC_API_KEY / API_KEY")
+    parser.add_argument("--api-key", help="API key; otherwise use provider environment variable / API_KEY, then saved Windows key")
     parser.add_argument("--base-url", help="Custom OpenAI-compatible endpoint URL (required for 'custom' provider)")
     parser.add_argument("--app-context", help="Short description of your app for better translations")
     parser.add_argument("--sleep", type=float, default=5.0, help="Seconds between API requests (default: 5.0)")
@@ -382,16 +400,14 @@ def main(args=None):
         fallback_models = model_list[1:]
 
     # Resolve API key
-    api_key = args.api_key
-    if not api_key:
-        if provider == "gemini":                  api_key = os.environ.get("GEMINI_API_KEY")
-        elif provider in ("openai", "custom"):    api_key = os.environ.get("OPENAI_API_KEY")
-        elif provider == "anthropic":             api_key = os.environ.get("ANTHROPIC_API_KEY")
-        if not api_key:
-            api_key = os.environ.get("API_KEY")
+    try:
+        api_key = resolve_api_key(provider, args.api_key, args.base_url)
+    except (OSError, ValueError) as exc:
+        print("❌ ERROR: {}".format(exc))
+        return 1
 
     if not api_key and provider != "custom":
-        print("❌ ERROR: Please provide an API key via --api-key or the appropriate environment variable.")
+        print("❌ ERROR: Provide --api-key, a provider environment variable, or save a Windows key with credentials set. Saved keys are not used with custom endpoints.")
         return 1
 
     if provider == "custom" and not args.base_url:

{android_localisation-1.5.0 → android_localisation-1.6.0/android_localisation.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: android-localisation
-Version: 1.5.0
+Version: 1.6.0
 Summary: Zero-dependency Android strings.xml and Google Play store listing translation using LLMs (Gemini, OpenAI, Anthropic, Ollama).
 License: MIT
 Project-URL: Homepage, https://github.com/BharathKmalviya/android-llm-localization
@@ -127,6 +127,10 @@ When you run `android-localise translate --api-key YOUR_KEY`, here's exactly wha
 4. Parses the response and checks duplicate/unexpected/missing resources, attributes, inline markup, item structure, control escapes and format arguments. A valid result replaces the file atomically; new folders are created only when saving. `--skip-existing` validates existing files and skips them without API calls. `--dry-run` shows a diff without writing any files or creating folders
 5. Waits 5 seconds between each language request to avoid hitting API rate limits
 
+Keys resolve from `--api-key`, then provider environment variables / `API_KEY`,
+then saved Windows credentials for built-in provider endpoints. The CLI never
+prompts for a key during translation; use `credentials set` yourself beforehand.
+
 **Defaults used when you don't specify anything:**
 
 | What | Default |
@@ -226,7 +230,7 @@ android-localise translate \
 
 | Flag | What it does | Default |
 |---|---|---|
-| `--api-key` | Your API key | reads from env var |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--provider` | Which AI to use: `gemini` `openai` `anthropic` `custom` | `gemini` |
 | `--model` | Specific model to use | see [Providers](#providers) |
 | `--languages` | Comma-separated Android/conventional codes and/or `all`, e.g. `all,zu` or `hi,es-ES,b+es+419` | scan existing destination locale folders |
@@ -305,7 +309,7 @@ Console import file. The CLI does not upload or publish a listing.
 | `--dry-run` | Generate, validate and display diffs without files/directories being written | off; API usage applies |
 | `--provider` | `gemini`, `openai`, `anthropic`, `custom` | `gemini` |
 | `--model` | Pin any supported model and disable fallbacks | provider default |
-| `--api-key` | Key, or provider-specific environment variable / `API_KEY` | environment |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--base-url` | OpenAI-compatible endpoint; required for `custom` | provider endpoint |
 | `--app-context` | Terminology context; source copy remains the source of facts | none |
 | `--sleep` | Delay between requests, including correction/fallback requests | `5.0` seconds |
@@ -525,9 +529,72 @@ android-localise translate \
 
 ---
 
+## Save a key once on Windows
+
+Run this yourself in your terminal:
+
+```bash
+android-localise credentials set --provider gemini
+```
+
+Enter your key at the hidden prompt. It is stored in **Windows Credential
+Manager**, for your Windows user on this computer, and persists across terminal
+and computer restarts. The CLI does not write a plaintext key file or modify
+environment variables. Running `set` again replaces that provider's saved key.
+There is no key argument or piped-input option for this command; it requires an
+interactive terminal and refuses a prompt that cannot hide input.
+
+Then you or an AI assistant can run ordinary commands without including a key:
+
+```bash
+android-localise translate --languages hi,es
+android-localise store-listing --source listing.json --languages hi-IN,es-ES
+android-localise credentials status --provider gemini
+android-localise credentials remove --provider gemini
+```
+
+`status` reports only `saved` or `not saved`; no command displays the saved value.
+`remove` deletes only this CLI's saved entry for that provider; it does not revoke
+the provider key or clear environment-variable overrides. The same commands also
+work with `python -m android_localisation credentials ...`.
+
+| Argument | Description | Default |
+|---|---|---|
+| `set`, `status`, `remove` | Hidden entry, presence check, or deletion | required action |
+| `--provider` | `gemini`, `openai` or `anthropic` | `gemini` |
+
+Both translation commands use this precedence: `--api-key` → provider-specific
+environment variable → `API_KEY` → saved Windows key. Existing overrides retain
+their behavior; if an old environment key is set, saving a new key does not
+override it. Saved OpenAI keys load only for its default endpoint; `custom`
+providers and other `--base-url` endpoints continue using explicit keys or
+environment variables. Saved keys are not automatically sent to custom hosts.
+Provider requests reject HTTP redirects, so use a custom endpoint's final URL.
+Gemini authentication uses a header rather than a URL query parameter, and
+API/network error messages redact the key used for that request before display.
+
+This keeps keys out of chat, command arguments and routine CLI output. It
+**does not isolate secrets from an AI or other program with unrestricted access
+under your Windows account**: Windows permits programs running as that user to
+read their credentials. The key is also present in memory during an API request.
+For stronger separation, use a restricted runner or separately secured proxy.
+See [Microsoft's credential API documentation](https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credreadw).
+
+Saved-key commands are Windows-only, with no plaintext fallback. Other platforms
+keep using environment variables or `--api-key`.
+
+Manual check: save a key yourself, confirm input is hidden, open a new terminal
+and check `status`. Run a small XML and listing preview without `--api-key`,
+review the output, then remove the entry and confirm `not saved`. Ensure any key
+environment overrides are absent when checking saved-key behavior.
+
+---
+
 ## Environment variables
 
-Set your API key as an env variable so you don't have to pass it every time:
+Environment variables remain available on all platforms. For Windows saved
+credentials, use the commands above instead of putting a key in shell history.
+To use an environment variable:
 
 ```bash
 # macOS / Linux

{android_localisation-1.5.0 → android_localisation-1.6.0}/android_localisation.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ pyproject.toml
 android_localisation/__init__.py
 android_localisation/__main__.py
 android_localisation/cli.py
+android_localisation/credentials.py
 android_localisation/fix.py
 android_localisation/locales.py
 android_localisation/resources.py

{android_localisation-1.5.0 → android_localisation-1.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "android-localisation"
-version = "1.5.0"
+version = "1.6.0"
 description = "Zero-dependency Android strings.xml and Google Play store listing translation using LLMs (Gemini, OpenAI, Anthropic, Ollama)."
 readme = "README.md"
 license = { text = "MIT" }