android-localisation 1.5.0__tar.gz → 1.6.2__tar.gz

{android_localisation-1.5.0/android_localisation.egg-info → android_localisation-1.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: android-localisation
-Version: 1.5.0
+Version: 1.6.2
 Summary: Zero-dependency Android strings.xml and Google Play store listing translation using LLMs (Gemini, OpenAI, Anthropic, Ollama).
 License: MIT
 Project-URL: Homepage, https://github.com/BharathKmalviya/android-llm-localization
@@ -127,12 +127,16 @@ When you run `android-localise translate --api-key YOUR_KEY`, here's exactly wha
 4. Parses the response and checks duplicate/unexpected/missing resources, attributes, inline markup, item structure, control escapes and format arguments. A valid result replaces the file atomically; new folders are created only when saving. `--skip-existing` validates existing files and skips them without API calls. `--dry-run` shows a diff without writing any files or creating folders
 5. Waits 5 seconds between each language request to avoid hitting API rate limits
 
+Keys resolve from `--api-key`, then provider environment variables / `API_KEY`,
+then saved Windows credentials for built-in provider endpoints. The CLI never
+prompts for a key during translation; use `credentials set` yourself beforehand.
+
 **Defaults used when you don't specify anything:**
 
 | What | Default |
 |---|---|
 | Provider | Gemini |
-| Model | `gemini-3.8-flash` |
+| Model | `gemini-3.5-flash-lite` |
 | Source directory | `app/src/main/res` |
 | Delay between requests | 5 seconds |
 | App context | none (generic prompt) |
@@ -226,7 +230,7 @@ android-localise translate \
 
 | Flag | What it does | Default |
 |---|---|---|
-| `--api-key` | Your API key | reads from env var |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--provider` | Which AI to use: `gemini` `openai` `anthropic` `custom` | `gemini` |
 | `--model` | Specific model to use | see [Providers](#providers) |
 | `--languages` | Comma-separated Android/conventional codes and/or `all`, e.g. `all,zu` or `hi,es-ES,b+es+419` | scan existing destination locale folders |
@@ -305,7 +309,7 @@ Console import file. The CLI does not upload or publish a listing.
 | `--dry-run` | Generate, validate and display diffs without files/directories being written | off; API usage applies |
 | `--provider` | `gemini`, `openai`, `anthropic`, `custom` | `gemini` |
 | `--model` | Pin any supported model and disable fallbacks | provider default |
-| `--api-key` | Key, or provider-specific environment variable / `API_KEY` | environment |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--base-url` | OpenAI-compatible endpoint; required for `custom` | provider endpoint |
 | `--app-context` | Terminology context; source copy remains the source of facts | none |
 | `--sleep` | Delay between requests, including correction/fallback requests | `5.0` seconds |
@@ -480,18 +484,18 @@ environment behavior. All commands can also run through `python -m android_local
 
 ## Providers
 
-By default the tool uses Gemini with `gemini-3.8-flash`. You can switch providers with `--provider` and optionally pin a specific model with `--model`. Configured defaults and fallbacks use only the latest general-purpose text-model lineup, with defaults favoring speed and cost within that lineup.
+By default the tool uses Gemini 3.5 Flash-Lite (`gemini-3.5-flash-lite`) for both XML and store listing translation. You can switch providers with `--provider` and optionally pin a specific model with `--model`.
 
-| Provider | Default model | Fallbacks | API key env var |
+| Provider | Default model | Fallback | API key env var |
 |---|---|---|---|
-| `gemini` _(default)_ | `gemini-3.8-flash` | none | `GEMINI_API_KEY` |
-| `openai` | `gpt-6-luna` | `gpt-6.1-sol` → `gpt-6-astra` | `OPENAI_API_KEY` |
-| `anthropic` | `claude-sonnet-5-5` | `claude-opus-5-5` | `ANTHROPIC_API_KEY` |
+| `gemini` _(default)_ | `gemini-3.5-flash-lite` | `gemini-3.5-flash` | `GEMINI_API_KEY` |
+| `openai` | `gpt-6-luna` | `gpt-5.6-terra` | `OPENAI_API_KEY` |
+| `anthropic` | `claude-haiku-4-5` | `claude-sonnet-5-5` | `ANTHROPIC_API_KEY` |
 | `custom` | set with `--model` | none | `OPENAI_API_KEY` (optional) |
 
-If the default model returns a "model not found" error (e.g. it was deprecated), the tool automatically retries with the next fallback. If you pin a model with `--model`, no fallback is used.
+Each hosted provider has exactly one automatic fallback. If the default model returns a "model not found" error (e.g. it was deprecated), the tool retries with that fallback. Authentication, quota and network errors do not trigger a model fallback. If you pin a model with `--model`, no fallback is used.
 
-Model IDs and compatibility checked against [Google's model catalog](https://ai.google.dev/gemini-api/docs/models), [OpenAI's model catalog](https://developers.openai.com/api/docs/models) and [Anthropic's model catalog](https://platform.claude.com/docs/en/models/overview) on **2026-10-02**. Older Gemini, GPT-5 and Haiku 4.5 models are excluded from automatic selection. Gemini has no fallback in its latest stable text generation. OpenAI and Anthropic fallbacks are higher-cost models; pin `--model` to avoid automatic tier changes. Explicit model selection and custom/local endpoints remain available. The catalog is bundled with each CLI release, rather than automatically discovering models at runtime.
+These default/fallback pairs follow the selected configuration. Gemini model IDs were checked against [Flash-Lite](https://ai.google.dev/gemini-api/docs/models/gemini-3.5-flash-lite) and [Flash](https://ai.google.dev/gemini-api/docs/models/gemini-3.5-flash) documentation; the OpenAI fallback against [GPT-5.6 Terra](https://developers.openai.com/api/docs/models/gpt-5.6-terra); and Anthropic's default/fallback against its [model migration guide](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide) on **2026-10-05**. The existing OpenAI default was checked on **2026-10-02**. Pin `--model` to avoid automatic model changes. Explicit model selection and custom/local endpoints remain available. The catalog is bundled with each CLI release, rather than automatically discovering models at runtime.
 
 OpenAI and local providers retain the Chat Completions request format. Provider replies indicating truncation or blocked/incomplete output are rejected. Anthropic allows up to 16,384 output tokens per request and text blocks are collected separately from thinking blocks. Large files can still exceed a model's limits; automatic batching is future work.
 
@@ -525,9 +529,72 @@ android-localise translate \
 
 ---
 
+## Save a key once on Windows
+
+Run this yourself in your terminal:
+
+```bash
+android-localise credentials set --provider gemini
+```
+
+Enter your key at the hidden prompt. It is stored in **Windows Credential
+Manager**, for your Windows user on this computer, and persists across terminal
+and computer restarts. The CLI does not write a plaintext key file or modify
+environment variables. Running `set` again replaces that provider's saved key.
+There is no key argument or piped-input option for this command; it requires an
+interactive terminal and refuses a prompt that cannot hide input.
+
+Then you or an AI assistant can run ordinary commands without including a key:
+
+```bash
+android-localise translate --languages hi,es
+android-localise store-listing --source listing.json --languages hi-IN,es-ES
+android-localise credentials status --provider gemini
+android-localise credentials remove --provider gemini
+```
+
+`status` reports only `saved` or `not saved`; no command displays the saved value.
+`remove` deletes only this CLI's saved entry for that provider; it does not revoke
+the provider key or clear environment-variable overrides. The same commands also
+work with `python -m android_localisation credentials ...`.
+
+| Argument | Description | Default |
+|---|---|---|
+| `set`, `status`, `remove` | Hidden entry, presence check, or deletion | required action |
+| `--provider` | `gemini`, `openai` or `anthropic` | `gemini` |
+
+Both translation commands use this precedence: `--api-key` → provider-specific
+environment variable → `API_KEY` → saved Windows key. Existing overrides retain
+their behavior; if an old environment key is set, saving a new key does not
+override it. Saved OpenAI keys load only for its default endpoint; `custom`
+providers and other `--base-url` endpoints continue using explicit keys or
+environment variables. Saved keys are not automatically sent to custom hosts.
+Provider requests reject HTTP redirects, so use a custom endpoint's final URL.
+Gemini authentication uses a header rather than a URL query parameter, and
+API/network error messages redact the key used for that request before display.
+
+This keeps keys out of chat, command arguments and routine CLI output. It
+**does not isolate secrets from an AI or other program with unrestricted access
+under your Windows account**: Windows permits programs running as that user to
+read their credentials. The key is also present in memory during an API request.
+For stronger separation, use a restricted runner or separately secured proxy.
+See [Microsoft's credential API documentation](https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credreadw).
+
+Saved-key commands are Windows-only, with no plaintext fallback. Other platforms
+keep using environment variables or `--api-key`.
+
+Manual check: save a key yourself, confirm input is hidden, open a new terminal
+and check `status`. Run a small XML and listing preview without `--api-key`,
+review the output, then remove the entry and confirm `not saved`. Ensure any key
+environment overrides are absent when checking saved-key behavior.
+
+---
+
 ## Environment variables
 
-Set your API key as an env variable so you don't have to pass it every time:
+Environment variables remain available on all platforms. For Windows saved
+credentials, use the commands above instead of putting a key in shell history.
+To use an environment variable:
 
 ```bash
 # macOS / Linux

{android_localisation-1.5.0 → android_localisation-1.6.2}/README.md

@@ -99,12 +99,16 @@ When you run `android-localise translate --api-key YOUR_KEY`, here's exactly wha
 4. Parses the response and checks duplicate/unexpected/missing resources, attributes, inline markup, item structure, control escapes and format arguments. A valid result replaces the file atomically; new folders are created only when saving. `--skip-existing` validates existing files and skips them without API calls. `--dry-run` shows a diff without writing any files or creating folders
 5. Waits 5 seconds between each language request to avoid hitting API rate limits
 
+Keys resolve from `--api-key`, then provider environment variables / `API_KEY`,
+then saved Windows credentials for built-in provider endpoints. The CLI never
+prompts for a key during translation; use `credentials set` yourself beforehand.
+
 **Defaults used when you don't specify anything:**
 
 | What | Default |
 |---|---|
 | Provider | Gemini |
-| Model | `gemini-3.8-flash` |
+| Model | `gemini-3.5-flash-lite` |
 | Source directory | `app/src/main/res` |
 | Delay between requests | 5 seconds |
 | App context | none (generic prompt) |
@@ -198,7 +202,7 @@ android-localise translate \
 
 | Flag | What it does | Default |
 |---|---|---|
-| `--api-key` | Your API key | reads from env var |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--provider` | Which AI to use: `gemini` `openai` `anthropic` `custom` | `gemini` |
 | `--model` | Specific model to use | see [Providers](#providers) |
 | `--languages` | Comma-separated Android/conventional codes and/or `all`, e.g. `all,zu` or `hi,es-ES,b+es+419` | scan existing destination locale folders |
@@ -277,7 +281,7 @@ Console import file. The CLI does not upload or publish a listing.
 | `--dry-run` | Generate, validate and display diffs without files/directories being written | off; API usage applies |
 | `--provider` | `gemini`, `openai`, `anthropic`, `custom` | `gemini` |
 | `--model` | Pin any supported model and disable fallbacks | provider default |
-| `--api-key` | Key, or provider-specific environment variable / `API_KEY` | environment |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--base-url` | OpenAI-compatible endpoint; required for `custom` | provider endpoint |
 | `--app-context` | Terminology context; source copy remains the source of facts | none |
 | `--sleep` | Delay between requests, including correction/fallback requests | `5.0` seconds |
@@ -452,18 +456,18 @@ environment behavior. All commands can also run through `python -m android_local
 
 ## Providers
 
-By default the tool uses Gemini with `gemini-3.8-flash`. You can switch providers with `--provider` and optionally pin a specific model with `--model`. Configured defaults and fallbacks use only the latest general-purpose text-model lineup, with defaults favoring speed and cost within that lineup.
+By default the tool uses Gemini 3.5 Flash-Lite (`gemini-3.5-flash-lite`) for both XML and store listing translation. You can switch providers with `--provider` and optionally pin a specific model with `--model`.
 
-| Provider | Default model | Fallbacks | API key env var |
+| Provider | Default model | Fallback | API key env var |
 |---|---|---|---|
-| `gemini` _(default)_ | `gemini-3.8-flash` | none | `GEMINI_API_KEY` |
-| `openai` | `gpt-6-luna` | `gpt-6.1-sol` → `gpt-6-astra` | `OPENAI_API_KEY` |
-| `anthropic` | `claude-sonnet-5-5` | `claude-opus-5-5` | `ANTHROPIC_API_KEY` |
+| `gemini` _(default)_ | `gemini-3.5-flash-lite` | `gemini-3.5-flash` | `GEMINI_API_KEY` |
+| `openai` | `gpt-6-luna` | `gpt-5.6-terra` | `OPENAI_API_KEY` |
+| `anthropic` | `claude-haiku-4-5` | `claude-sonnet-5-5` | `ANTHROPIC_API_KEY` |
 | `custom` | set with `--model` | none | `OPENAI_API_KEY` (optional) |
 
-If the default model returns a "model not found" error (e.g. it was deprecated), the tool automatically retries with the next fallback. If you pin a model with `--model`, no fallback is used.
+Each hosted provider has exactly one automatic fallback. If the default model returns a "model not found" error (e.g. it was deprecated), the tool retries with that fallback. Authentication, quota and network errors do not trigger a model fallback. If you pin a model with `--model`, no fallback is used.
 
-Model IDs and compatibility checked against [Google's model catalog](https://ai.google.dev/gemini-api/docs/models), [OpenAI's model catalog](https://developers.openai.com/api/docs/models) and [Anthropic's model catalog](https://platform.claude.com/docs/en/models/overview) on **2026-10-02**. Older Gemini, GPT-5 and Haiku 4.5 models are excluded from automatic selection. Gemini has no fallback in its latest stable text generation. OpenAI and Anthropic fallbacks are higher-cost models; pin `--model` to avoid automatic tier changes. Explicit model selection and custom/local endpoints remain available. The catalog is bundled with each CLI release, rather than automatically discovering models at runtime.
+These default/fallback pairs follow the selected configuration. Gemini model IDs were checked against [Flash-Lite](https://ai.google.dev/gemini-api/docs/models/gemini-3.5-flash-lite) and [Flash](https://ai.google.dev/gemini-api/docs/models/gemini-3.5-flash) documentation; the OpenAI fallback against [GPT-5.6 Terra](https://developers.openai.com/api/docs/models/gpt-5.6-terra); and Anthropic's default/fallback against its [model migration guide](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide) on **2026-10-05**. The existing OpenAI default was checked on **2026-10-02**. Pin `--model` to avoid automatic model changes. Explicit model selection and custom/local endpoints remain available. The catalog is bundled with each CLI release, rather than automatically discovering models at runtime.
 
 OpenAI and local providers retain the Chat Completions request format. Provider replies indicating truncation or blocked/incomplete output are rejected. Anthropic allows up to 16,384 output tokens per request and text blocks are collected separately from thinking blocks. Large files can still exceed a model's limits; automatic batching is future work.
 
@@ -497,9 +501,72 @@ android-localise translate \
 
 ---
 
+## Save a key once on Windows
+
+Run this yourself in your terminal:
+
+```bash
+android-localise credentials set --provider gemini
+```
+
+Enter your key at the hidden prompt. It is stored in **Windows Credential
+Manager**, for your Windows user on this computer, and persists across terminal
+and computer restarts. The CLI does not write a plaintext key file or modify
+environment variables. Running `set` again replaces that provider's saved key.
+There is no key argument or piped-input option for this command; it requires an
+interactive terminal and refuses a prompt that cannot hide input.
+
+Then you or an AI assistant can run ordinary commands without including a key:
+
+```bash
+android-localise translate --languages hi,es
+android-localise store-listing --source listing.json --languages hi-IN,es-ES
+android-localise credentials status --provider gemini
+android-localise credentials remove --provider gemini
+```
+
+`status` reports only `saved` or `not saved`; no command displays the saved value.
+`remove` deletes only this CLI's saved entry for that provider; it does not revoke
+the provider key or clear environment-variable overrides. The same commands also
+work with `python -m android_localisation credentials ...`.
+
+| Argument | Description | Default |
+|---|---|---|
+| `set`, `status`, `remove` | Hidden entry, presence check, or deletion | required action |
+| `--provider` | `gemini`, `openai` or `anthropic` | `gemini` |
+
+Both translation commands use this precedence: `--api-key` → provider-specific
+environment variable → `API_KEY` → saved Windows key. Existing overrides retain
+their behavior; if an old environment key is set, saving a new key does not
+override it. Saved OpenAI keys load only for its default endpoint; `custom`
+providers and other `--base-url` endpoints continue using explicit keys or
+environment variables. Saved keys are not automatically sent to custom hosts.
+Provider requests reject HTTP redirects, so use a custom endpoint's final URL.
+Gemini authentication uses a header rather than a URL query parameter, and
+API/network error messages redact the key used for that request before display.
+
+This keeps keys out of chat, command arguments and routine CLI output. It
+**does not isolate secrets from an AI or other program with unrestricted access
+under your Windows account**: Windows permits programs running as that user to
+read their credentials. The key is also present in memory during an API request.
+For stronger separation, use a restricted runner or separately secured proxy.
+See [Microsoft's credential API documentation](https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credreadw).
+
+Saved-key commands are Windows-only, with no plaintext fallback. Other platforms
+keep using environment variables or `--api-key`.
+
+Manual check: save a key yourself, confirm input is hidden, open a new terminal
+and check `status`. Run a small XML and listing preview without `--api-key`,
+review the output, then remove the entry and confirm `not saved`. Ensure any key
+environment overrides are absent when checking saved-key behavior.
+
+---
+
 ## Environment variables
 
-Set your API key as an env variable so you don't have to pass it every time:
+Environment variables remain available on all platforms. For Windows saved
+credentials, use the commands above instead of putting a key in shell history.
+To use an environment variable:
 
 ```bash
 # macOS / Linux

{android_localisation-1.5.0 → android_localisation-1.6.2}/android_localisation/__init__.py

@@ -2,4 +2,4 @@
 android-localisation: Zero-dependency Android XML and Play listing translation using LLMs.
 """
 
-__version__ = "1.5.0"
+__version__ = "1.6.2"

{android_localisation-1.5.0 → android_localisation-1.6.2}/android_localisation/cli.py

@@ -33,11 +33,12 @@ Other examples:
   android-localise store-listing --source listing.json --languages hi,es-ES
   android-localise translate --languages hi --missing-only --dry-run
   android-localise models --provider openai
+  android-localise credentials set --provider gemini (Windows, hidden prompt)
   python -m android_localisation setup-path          (Windows, one-time)
 
 Use android-localise COMMAND --help for flags, defaults and examples.
 All commands also work with: python -m android_localisation COMMAND
-Keys: GEMINI_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, or API_KEY.
+Keys: --api-key, environment variables, then saved Windows credentials.
 Update notices: set ANDROID_LOCALISE_NO_UPDATE_CHECK=1 to disable them.""",
     )
     parser.add_argument("--version", action="version", version=f"android-localisation {__version__}")
@@ -71,7 +72,7 @@ Use android-localise models to see current defaults and fallbacks.""",
     add_flexible_arguments(translate_parser)
     translate_parser.add_argument("--provider", choices=["gemini", "openai", "anthropic", "custom"], default="gemini", help="AI provider (default: gemini)")
     translate_parser.add_argument("--model", help="Pin any supported model and disable fallbacks (default: provider default; see models)")
-    translate_parser.add_argument("--api-key", help="API key, or set GEMINI_API_KEY / OPENAI_API_KEY / ANTHROPIC_API_KEY / API_KEY")
+    translate_parser.add_argument("--api-key", help="API key; otherwise use provider environment variable / API_KEY, then saved Windows key")
     translate_parser.add_argument("--base-url", help="Custom OpenAI-compatible endpoint URL (required for 'custom' provider)")
     translate_parser.add_argument("--app-context", help="Short description of your app for better translations")
     translate_parser.add_argument("--sleep", type=float, default=5.0, help="Seconds between API requests (default: 5.0)")
@@ -151,6 +152,25 @@ Custom/local providers require an explicit --model.""",
     models_parser.add_argument("--provider", choices=["gemini", "openai", "anthropic"], default=None,
                                help="Filter by provider (shows all if not set)")
 
+    from android_localisation.credentials import add_arguments as add_credential_arguments
+    credentials_parser = subparsers.add_parser(
+        "credentials", help="Manage saved Windows API keys without displaying them",
+        description="""Save provider keys in Windows Credential Manager for your user account.
+Run set yourself in an interactive terminal; the key prompt is hidden.
+Status reports presence only. Translation commands load saved keys automatically
+after argument/environment overrides. This does not isolate keys from programs
+or AI agents with unrestricted access under your Windows account.""",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""Examples:
+  android-localise credentials set --provider gemini
+  android-localise credentials status --provider gemini
+  android-localise credentials remove --provider gemini
+
+No key argument, piped input or plaintext storage fallback is supported.
+Custom endpoints continue using explicit keys or environment variables.""",
+    )
+    add_credential_arguments(credentials_parser)
+
     subparsers.add_parser(
         "setup-path", help="Add the installed Scripts folder to Windows user PATH",
         description="""One-time Windows setup for an installed CLI that PowerShell cannot find.
@@ -183,7 +203,11 @@ Exit code 1 reports unsupported platforms, virtual environments or setup failure
 
 
 def _run_command(args):
-    if args.command == "setup-path":
+    if args.command == "credentials":
+        from android_localisation.credentials import main as run
+        return run(args)
+
+    elif args.command == "setup-path":
         from android_localisation.setup_path import main as run
         return run(args)
 

android_localisation-1.6.2/android_localisation/credentials.py

@@ -0,0 +1,185 @@
+"""Explicit, user-scoped API key storage in Windows Credential Manager."""
+
+import argparse
+import ctypes
+import getpass
+import os
+import sys
+import warnings
+from ctypes import wintypes
+
+
+PROVIDERS = ("gemini", "openai", "anthropic")
+OPENAI_ENDPOINT = "https://api.openai.com/v1/chat/completions"
+_GENERIC = 1
+_LOCAL_MACHINE = 2  # Persistent on this computer, still scoped to the user.
+_NOT_FOUND = 1168
+_MAX_BLOB = 2560
+
+
+class _Credential(ctypes.Structure):
+    _fields_ = [
+        ("Flags", wintypes.DWORD), ("Type", wintypes.DWORD),
+        ("TargetName", wintypes.LPWSTR), ("Comment", wintypes.LPWSTR),
+        ("LastWritten", wintypes.FILETIME), ("CredentialBlobSize", wintypes.DWORD),
+        ("CredentialBlob", ctypes.POINTER(wintypes.BYTE)), ("Persist", wintypes.DWORD),
+        ("AttributeCount", wintypes.DWORD), ("Attributes", ctypes.c_void_p),
+        ("TargetAlias", wintypes.LPWSTR), ("UserName", wintypes.LPWSTR),
+    ]
+
+
+def _target(provider):
+    if provider not in PROVIDERS:
+        raise ValueError("Saved keys support gemini, openai and anthropic only.")
+    return "android-localisation:api-key:" + provider
+
+
+def _windows_api():
+    if os.name != "nt":
+        raise OSError("Saved key commands require Windows Credential Manager. Use environment variables on other platforms.")
+    api = ctypes.WinDLL("advapi32", use_last_error=True)
+    pointer = ctypes.POINTER(_Credential)
+    api.CredWriteW.argtypes = [pointer, wintypes.DWORD]
+    api.CredWriteW.restype = wintypes.BOOL
+    api.CredReadW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD,
+                            ctypes.POINTER(pointer)]
+    api.CredReadW.restype = wintypes.BOOL
+    api.CredDeleteW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD]
+    api.CredDeleteW.restype = wintypes.BOOL
+    api.CredFree.argtypes = [ctypes.c_void_p]
+    api.CredFree.restype = None
+    return api
+
+
+def _failure():
+    # Do not include credential values or structures in diagnostics.
+    return OSError("Windows Credential Manager failed (error {}).".format(ctypes.get_last_error()))
+
+
+def save_key(provider, key):
+    target = _target(provider)
+    if not key or any(ord(char) < 33 or ord(char) > 126 for char in key):
+        raise ValueError("API key must be nonempty printable ASCII without whitespace.")
+    encoded = key.encode("ascii")
+    if len(encoded) > _MAX_BLOB:
+        raise ValueError("API key exceeds Windows Credential Manager's size limit.")
+    api = _windows_api()
+    blob = (wintypes.BYTE * len(encoded)).from_buffer_copy(encoded)
+    credential = _Credential()
+    credential.Type = _GENERIC
+    credential.TargetName = target
+    credential.Comment = "API key for android-localisation"
+    credential.CredentialBlobSize = len(encoded)
+    credential.CredentialBlob = blob
+    credential.Persist = _LOCAL_MACHINE
+    credential.UserName = provider
+    try:
+        if not api.CredWriteW(ctypes.byref(credential), 0):
+            raise _failure()
+    finally:
+        ctypes.memset(blob, 0, len(encoded))
+
+
+def _read_key(provider, presence_only=False):
+    target = _target(provider)
+    api = _windows_api()
+    pointer = ctypes.POINTER(_Credential)()
+    if not api.CredReadW(target, _GENERIC, 0, ctypes.byref(pointer)):
+        if ctypes.get_last_error() == _NOT_FOUND:
+            return False if presence_only else None
+        raise _failure()
+    try:
+        credential = pointer.contents
+        if presence_only:
+            return True
+        size = credential.CredentialBlobSize
+        if not 0 < size <= _MAX_BLOB or not credential.CredentialBlob:
+            raise ValueError("Saved API key is invalid; save it again with credentials set.")
+        try:
+            key = ctypes.string_at(credential.CredentialBlob, size).decode("ascii")
+        except UnicodeDecodeError:
+            raise ValueError("Saved API key is invalid; save it again with credentials set.") from None
+        if any(ord(char) < 33 or ord(char) > 126 for char in key):
+            raise ValueError("Saved API key is invalid; save it again with credentials set.")
+        return key
+    finally:
+        # The Python string still exists while needed; this is not a memory vault.
+        if pointer.contents.CredentialBlob and pointer.contents.CredentialBlobSize <= _MAX_BLOB:
+            ctypes.memset(pointer.contents.CredentialBlob, 0, pointer.contents.CredentialBlobSize)
+        api.CredFree(pointer)
+
+
+def remove_key(provider):
+    target = _target(provider)
+    api = _windows_api()
+    if api.CredDeleteW(target, _GENERIC, 0):
+        return True
+    if ctypes.get_last_error() == _NOT_FOUND:
+        return False
+    raise _failure()
+
+
+def resolve_api_key(provider, supplied=None, base_url=None):
+    """Preserve argument/env precedence; use saved keys only for built-in endpoints."""
+    env_name = {"gemini": "GEMINI_API_KEY", "openai": "OPENAI_API_KEY",
+                "anthropic": "ANTHROPIC_API_KEY", "custom": "OPENAI_API_KEY"}.get(provider)
+    key = supplied or (os.environ.get(env_name) if env_name else None) or os.environ.get("API_KEY")
+    if key:
+        return key
+    if os.name != "nt" or provider not in PROVIDERS:
+        return None
+    if provider == "openai" and base_url and base_url != OPENAI_ENDPOINT:
+        return None  # Never silently forward a saved OpenAI key to a custom host.
+    return _read_key(provider)
+
+
+def add_arguments(parser):
+    parser.add_argument("action", choices=("set", "status", "remove"),
+                        help="Save via hidden prompt, report presence, or remove the saved key")
+    parser.add_argument("--provider", choices=PROVIDERS, default="gemini",
+                        help="Provider credential to manage (default: gemini)")
+
+
+def _parse_args(args=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    add_arguments(parser)
+    return parser.parse_args(args)
+
+
+def main(args=None):
+    if args is None or isinstance(args, list):
+        args = _parse_args(args)
+    try:
+        if args.action == "set":
+            if os.name != "nt":
+                raise OSError("Saved key commands require Windows Credential Manager. Use environment variables on other platforms.")
+            if not sys.stdin.isatty():
+                raise ValueError("Run credentials set yourself in an interactive terminal; piped keys are not accepted.")
+            with warnings.catch_warnings():
+                warnings.simplefilter("error", getpass.GetPassWarning)
+                key = getpass.getpass("{} API key (hidden): ".format(args.provider))
+            try:
+                save_key(args.provider, key)
+            finally:
+                key = None
+            print("Saved {} API key in Windows Credential Manager for this user.".format(args.provider))
+        elif args.action == "status":
+            present = _read_key(args.provider, presence_only=True)
+            print("{}: {}".format(args.provider, "saved" if present else "not saved"))
+        elif args.action == "remove":
+            removed = remove_key(args.provider)
+            print("{}: {}".format(args.provider, "saved key removed" if removed else "no saved key"))
+        else:
+            raise ValueError("Unknown credentials action.")
+    except (OSError, ValueError, getpass.GetPassWarning) as error:
+        # Specific errors above are safe; getpass fallback must never echo a key.
+        print("ERROR: {}".format(error))
+        return 1
+    except (EOFError, KeyboardInterrupt):
+        print("Key entry cancelled; saved credentials unchanged.")
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{android_localisation-1.5.0 → android_localisation-1.6.2}/android_localisation/store_listing.py

@@ -11,6 +11,7 @@ import time
 import unicodedata
 
 from android_localisation.resources import atomic_write
+from android_localisation.credentials import resolve_api_key
 from android_localisation.locales import (
     GOOGLE_PLAY_LOCALES, language_items, normalize_play_locale, select_locales,
 )
@@ -47,7 +48,7 @@ def add_arguments(parser):
     parser.add_argument("--dry-run", action="store_true", help="Generate and validate a diff without saving (API usage applies)")
     parser.add_argument("--provider", choices=list(PROVIDER_MODELS), default="gemini", help="AI provider (default: gemini)")
     parser.add_argument("--model", help="Pin a model and disable automatic fallbacks (default: provider default; see models)")
-    parser.add_argument("--api-key", help="API key, or provider-specific environment variable / API_KEY")
+    parser.add_argument("--api-key", help="API key; otherwise provider environment variable / API_KEY, then saved Windows key")
     parser.add_argument("--base-url", help="Custom OpenAI-compatible endpoint (required for custom provider)")
     parser.add_argument("--app-context", help="Short app description for terminology; listing remains the source of facts")
     parser.add_argument("--sleep", type=float, default=5.0, help="Seconds between requests, including validation retries (default: 5.0)")
@@ -176,11 +177,9 @@ def main(args=None):
         if args.provider == "custom" and (not args.model or not args.base_url):
             raise ValueError("custom provider requires --model and --base-url")
         models = [args.model] if args.model else model_list
-        env_name = {"gemini": "GEMINI_API_KEY", "openai": "OPENAI_API_KEY",
-                    "anthropic": "ANTHROPIC_API_KEY", "custom": "OPENAI_API_KEY"}[args.provider]
-        api_key = args.api_key or os.environ.get(env_name) or os.environ.get("API_KEY")
+        api_key = resolve_api_key(args.provider, args.api_key, args.base_url)
         if not api_key and args.provider != "custom":
-            raise ValueError("provide --api-key or set {} / API_KEY".format(env_name))
+            raise ValueError("provide --api-key, a provider environment variable, or save a Windows key with credentials set; saved keys are not used with custom endpoints")
     except (OSError, ValueError, KeyError) as exc:
         print("ERROR: {}".format(exc))
         return 1

{android_localisation-1.5.0 → android_localisation-1.6.2}/android_localisation/translate.py

@@ -5,6 +5,7 @@ import socket
 import argparse
 import urllib.request
 import urllib.error
+import urllib.parse
 import json
 import math
 import difflib
@@ -22,6 +23,7 @@ from android_localisation.resources import (
 from android_localisation.locales import (
     all_android_locales, android_locale, language_items, normalize_play_locale, select_locales,
 )
+from android_localisation.credentials import resolve_api_key
 
 DEFAULT_RES_DIR = "app/src/main/res"
 DEFAULT_API_TIMEOUT = 180  # seconds (3 minutes) — large strings.xml files can exceed 60s
@@ -29,20 +31,19 @@ MAX_TIMEOUT_RETRIES = 2
 
 # Ordered list of models per provider.
 # First entry = default. Rest = automatic fallbacks (used only when user hasn't pinned a model).
-# Latest text-model lineup checked against official catalogs on 2026-10-02.
-# Do not add older-generation models as automatic fallbacks.
+# User-selected defaults with one fallback each; changed model IDs checked on 2026-10-05.
 PROVIDER_MODELS = {
     "gemini": [
-        "gemini-3.8-flash",
+        "gemini-3.5-flash-lite",
+        "gemini-3.5-flash",
     ],
     "openai": [
         "gpt-6-luna",
-        "gpt-6.1-sol",
-        "gpt-6-astra",
+        "gpt-5.6-terra",
     ],
     "anthropic": [
+        "claude-haiku-4-5",
         "claude-sonnet-5-5",
-        "claude-opus-5-5",
     ],
     "custom": [],  # user must specify --model
 }
@@ -148,7 +149,7 @@ def clean_xml_response(result):
 
 def _read_error_body(e):
     try:
-        return e.read().decode("utf-8", errors="replace")[:500]
+        return e.read().decode("utf-8", errors="replace")
     except Exception:
         return "(could not read error body)"
 
@@ -173,27 +174,43 @@ def _is_timeout_error(exc):
     )
 
 
-def _urlopen_with_retries(req, provider_label, timeout):
+def _redact_error(value, api_key):
+    text = str(value)
+    if api_key:
+        for secret in sorted({api_key, urllib.parse.quote(api_key, safe=""),
+                              urllib.parse.quote_plus(api_key), json.dumps(api_key)[1:-1]},
+                             key=len, reverse=True):
+            text = text.replace(secret, "[REDACTED]")
+    return text[:500]
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None  # Do not forward authentication headers to redirect targets.
+
+
+def _urlopen_with_retries(req, provider_label, timeout, api_key=None):
     """
     Execute an HTTP request with timeout/network error handling and retries on timeout.
     Returns (response_bytes, model_not_found).
     """
+    opener = urllib.request.build_opener(_NoRedirect())
     for attempt in range(MAX_TIMEOUT_RETRIES + 1):
         if attempt > 0:
             wait = attempt * 3
             print(f"  🔁 {provider_label} timed out — retrying ({attempt}/{MAX_TIMEOUT_RETRIES}) in {wait}s...")
             time.sleep(wait)
         try:
-            with urllib.request.urlopen(req, timeout=timeout) as response:
+            with opener.open(req, timeout=timeout) as response:
                 return response.read(), False
         except urllib.error.HTTPError as e:
             body = _read_error_body(e)
             model_gone = _is_model_not_found(e.code, body)
-            print(f"  ❌ {provider_label} API Error: {e.code} - {body}")
+            print(f"  ❌ {provider_label} API Error: {e.code} - {_redact_error(body, api_key)}")
             return None, model_gone
         except (TimeoutError, socket.timeout, urllib.error.URLError) as e:
             if not _is_timeout_error(e):
-                print(f"  ❌ {provider_label} network error: {e.reason}")
+                print(f"  ❌ {provider_label} network error: {_redact_error(e.reason, api_key)}")
                 return None, False
             if attempt < MAX_TIMEOUT_RETRIES:
                 continue
@@ -203,11 +220,11 @@ def _urlopen_with_retries(req, provider_label, timeout):
 
 
 def call_gemini(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
-    url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent?key={api_key}"
-    headers = {"Content-Type": "application/json"}
+    url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent"
+    headers = {"Content-Type": "application/json", "x-goog-api-key": api_key}
     data = {"contents": [{"parts": [{"text": prompt}]}]}
     req = urllib.request.Request(url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
-    raw, model_gone = _urlopen_with_retries(req, "Gemini", timeout)
+    raw, model_gone = _urlopen_with_retries(req, "Gemini", timeout, api_key)
     if raw is None:
         return None, model_gone
     result = json.loads(raw.decode("utf-8"))
@@ -217,7 +234,7 @@ def call_gemini(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
         return None, False
     candidate = candidates[0]
     if candidate.get("finishReason") not in (None, "STOP"):
-        print("  ❌ Gemini response was incomplete or blocked: {}".format(candidate.get("finishReason")))
+        print("  ❌ Gemini response was incomplete or blocked: {}".format(_redact_error(candidate.get("finishReason"), api_key)))
         return None, False
     return "".join(part.get("text", "") for part in candidate.get("content", {}).get("parts", [])
                    if not part.get("thought")), False
@@ -233,7 +250,7 @@ def call_openai_compatible(api_key, base_url, model, prompt, timeout=DEFAULT_API
         "messages": [{"role": "user", "content": prompt}],
     }
     req = urllib.request.Request(base_url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
-    raw, model_gone = _urlopen_with_retries(req, "OpenAI (compatible)", timeout)
+    raw, model_gone = _urlopen_with_retries(req, "OpenAI (compatible)", timeout, api_key)
     if raw is None:
         return None, model_gone
     result = json.loads(raw.decode("utf-8"))
@@ -242,7 +259,7 @@ def call_openai_compatible(api_key, base_url, model, prompt, timeout=DEFAULT_API
         print("  ❌ OpenAI returned no choices.")
         return None, False
     if choices[0].get("finish_reason") not in (None, "stop"):
-        print("  ❌ OpenAI-compatible response was incomplete: {}".format(choices[0].get("finish_reason")))
+        print("  ❌ OpenAI-compatible response was incomplete: {}".format(_redact_error(choices[0].get("finish_reason"), api_key)))
         return None, False
     return choices[0].get("message", {}).get("content", ""), False
 
@@ -260,7 +277,7 @@ def call_anthropic(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
         "messages": [{"role": "user", "content": prompt}],
     }
     req = urllib.request.Request(url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
-    raw, model_gone = _urlopen_with_retries(req, "Anthropic", timeout)
+    raw, model_gone = _urlopen_with_retries(req, "Anthropic", timeout, api_key)
     if raw is None:
         return None, model_gone
     result = json.loads(raw.decode("utf-8"))
@@ -269,7 +286,7 @@ def call_anthropic(api_key, model, prompt, timeout=DEFAULT_API_TIMEOUT):
         print("  ❌ Anthropic returned no content.")
         return None, False
     if result.get("stop_reason") not in (None, "end_turn"):
-        print("  ❌ Anthropic response was incomplete: {}".format(result.get("stop_reason")))
+        print("  ❌ Anthropic response was incomplete: {}".format(_redact_error(result.get("stop_reason"), api_key)))
         return None, False
     return "".join(block.get("text", "") for block in content if block.get("type") == "text"), False
 
@@ -327,7 +344,7 @@ def _parse_args(args=None):
     add_flexible_arguments(parser)
     parser.add_argument("--provider", choices=["gemini", "openai", "anthropic", "custom"], default="gemini", help="AI provider (default: gemini)")
     parser.add_argument("--model", help="Pin any supported model and disable fallbacks (default: provider default; see models)")
-    parser.add_argument("--api-key", help="API key, or set GEMINI_API_KEY / OPENAI_API_KEY / ANTHROPIC_API_KEY / API_KEY")
+    parser.add_argument("--api-key", help="API key; otherwise use provider environment variable / API_KEY, then saved Windows key")
     parser.add_argument("--base-url", help="Custom OpenAI-compatible endpoint URL (required for 'custom' provider)")
     parser.add_argument("--app-context", help="Short description of your app for better translations")
     parser.add_argument("--sleep", type=float, default=5.0, help="Seconds between API requests (default: 5.0)")
@@ -382,16 +399,14 @@ def main(args=None):
         fallback_models = model_list[1:]
 
     # Resolve API key
-    api_key = args.api_key
-    if not api_key:
-        if provider == "gemini":                  api_key = os.environ.get("GEMINI_API_KEY")
-        elif provider in ("openai", "custom"):    api_key = os.environ.get("OPENAI_API_KEY")
-        elif provider == "anthropic":             api_key = os.environ.get("ANTHROPIC_API_KEY")
-        if not api_key:
-            api_key = os.environ.get("API_KEY")
+    try:
+        api_key = resolve_api_key(provider, args.api_key, args.base_url)
+    except (OSError, ValueError) as exc:
+        print("❌ ERROR: {}".format(exc))
+        return 1
 
     if not api_key and provider != "custom":
-        print("❌ ERROR: Please provide an API key via --api-key or the appropriate environment variable.")
+        print("❌ ERROR: Provide --api-key, a provider environment variable, or save a Windows key with credentials set. Saved keys are not used with custom endpoints.")
         return 1
 
     if provider == "custom" and not args.base_url:

{android_localisation-1.5.0 → android_localisation-1.6.2/android_localisation.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: android-localisation
-Version: 1.5.0
+Version: 1.6.2
 Summary: Zero-dependency Android strings.xml and Google Play store listing translation using LLMs (Gemini, OpenAI, Anthropic, Ollama).
 License: MIT
 Project-URL: Homepage, https://github.com/BharathKmalviya/android-llm-localization
@@ -127,12 +127,16 @@ When you run `android-localise translate --api-key YOUR_KEY`, here's exactly wha
 4. Parses the response and checks duplicate/unexpected/missing resources, attributes, inline markup, item structure, control escapes and format arguments. A valid result replaces the file atomically; new folders are created only when saving. `--skip-existing` validates existing files and skips them without API calls. `--dry-run` shows a diff without writing any files or creating folders
 5. Waits 5 seconds between each language request to avoid hitting API rate limits
 
+Keys resolve from `--api-key`, then provider environment variables / `API_KEY`,
+then saved Windows credentials for built-in provider endpoints. The CLI never
+prompts for a key during translation; use `credentials set` yourself beforehand.
+
 **Defaults used when you don't specify anything:**
 
 | What | Default |
 |---|---|
 | Provider | Gemini |
-| Model | `gemini-3.8-flash` |
+| Model | `gemini-3.5-flash-lite` |
 | Source directory | `app/src/main/res` |
 | Delay between requests | 5 seconds |
 | App context | none (generic prompt) |
@@ -226,7 +230,7 @@ android-localise translate \
 
 | Flag | What it does | Default |
 |---|---|---|
-| `--api-key` | Your API key | reads from env var |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--provider` | Which AI to use: `gemini` `openai` `anthropic` `custom` | `gemini` |
 | `--model` | Specific model to use | see [Providers](#providers) |
 | `--languages` | Comma-separated Android/conventional codes and/or `all`, e.g. `all,zu` or `hi,es-ES,b+es+419` | scan existing destination locale folders |
@@ -305,7 +309,7 @@ Console import file. The CLI does not upload or publish a listing.
 | `--dry-run` | Generate, validate and display diffs without files/directories being written | off; API usage applies |
 | `--provider` | `gemini`, `openai`, `anthropic`, `custom` | `gemini` |
 | `--model` | Pin any supported model and disable fallbacks | provider default |
-| `--api-key` | Key, or provider-specific environment variable / `API_KEY` | environment |
+| `--api-key` | Explicit key override; omit for environment or saved Windows credentials | environment, then saved Windows key |
 | `--base-url` | OpenAI-compatible endpoint; required for `custom` | provider endpoint |
 | `--app-context` | Terminology context; source copy remains the source of facts | none |
 | `--sleep` | Delay between requests, including correction/fallback requests | `5.0` seconds |
@@ -480,18 +484,18 @@ environment behavior. All commands can also run through `python -m android_local
 
 ## Providers
 
-By default the tool uses Gemini with `gemini-3.8-flash`. You can switch providers with `--provider` and optionally pin a specific model with `--model`. Configured defaults and fallbacks use only the latest general-purpose text-model lineup, with defaults favoring speed and cost within that lineup.
+By default the tool uses Gemini 3.5 Flash-Lite (`gemini-3.5-flash-lite`) for both XML and store listing translation. You can switch providers with `--provider` and optionally pin a specific model with `--model`.
 
-| Provider | Default model | Fallbacks | API key env var |
+| Provider | Default model | Fallback | API key env var |
 |---|---|---|---|
-| `gemini` _(default)_ | `gemini-3.8-flash` | none | `GEMINI_API_KEY` |
-| `openai` | `gpt-6-luna` | `gpt-6.1-sol` → `gpt-6-astra` | `OPENAI_API_KEY` |
-| `anthropic` | `claude-sonnet-5-5` | `claude-opus-5-5` | `ANTHROPIC_API_KEY` |
+| `gemini` _(default)_ | `gemini-3.5-flash-lite` | `gemini-3.5-flash` | `GEMINI_API_KEY` |
+| `openai` | `gpt-6-luna` | `gpt-5.6-terra` | `OPENAI_API_KEY` |
+| `anthropic` | `claude-haiku-4-5` | `claude-sonnet-5-5` | `ANTHROPIC_API_KEY` |
 | `custom` | set with `--model` | none | `OPENAI_API_KEY` (optional) |
 
-If the default model returns a "model not found" error (e.g. it was deprecated), the tool automatically retries with the next fallback. If you pin a model with `--model`, no fallback is used.
+Each hosted provider has exactly one automatic fallback. If the default model returns a "model not found" error (e.g. it was deprecated), the tool retries with that fallback. Authentication, quota and network errors do not trigger a model fallback. If you pin a model with `--model`, no fallback is used.
 
-Model IDs and compatibility checked against [Google's model catalog](https://ai.google.dev/gemini-api/docs/models), [OpenAI's model catalog](https://developers.openai.com/api/docs/models) and [Anthropic's model catalog](https://platform.claude.com/docs/en/models/overview) on **2026-10-02**. Older Gemini, GPT-5 and Haiku 4.5 models are excluded from automatic selection. Gemini has no fallback in its latest stable text generation. OpenAI and Anthropic fallbacks are higher-cost models; pin `--model` to avoid automatic tier changes. Explicit model selection and custom/local endpoints remain available. The catalog is bundled with each CLI release, rather than automatically discovering models at runtime.
+These default/fallback pairs follow the selected configuration. Gemini model IDs were checked against [Flash-Lite](https://ai.google.dev/gemini-api/docs/models/gemini-3.5-flash-lite) and [Flash](https://ai.google.dev/gemini-api/docs/models/gemini-3.5-flash) documentation; the OpenAI fallback against [GPT-5.6 Terra](https://developers.openai.com/api/docs/models/gpt-5.6-terra); and Anthropic's default/fallback against its [model migration guide](https://platform.claude.com/docs/en/models/sonnet-5-5/migration-guide) on **2026-10-05**. The existing OpenAI default was checked on **2026-10-02**. Pin `--model` to avoid automatic model changes. Explicit model selection and custom/local endpoints remain available. The catalog is bundled with each CLI release, rather than automatically discovering models at runtime.
 
 OpenAI and local providers retain the Chat Completions request format. Provider replies indicating truncation or blocked/incomplete output are rejected. Anthropic allows up to 16,384 output tokens per request and text blocks are collected separately from thinking blocks. Large files can still exceed a model's limits; automatic batching is future work.
 
@@ -525,9 +529,72 @@ android-localise translate \
 
 ---
 
+## Save a key once on Windows
+
+Run this yourself in your terminal:
+
+```bash
+android-localise credentials set --provider gemini
+```
+
+Enter your key at the hidden prompt. It is stored in **Windows Credential
+Manager**, for your Windows user on this computer, and persists across terminal
+and computer restarts. The CLI does not write a plaintext key file or modify
+environment variables. Running `set` again replaces that provider's saved key.
+There is no key argument or piped-input option for this command; it requires an
+interactive terminal and refuses a prompt that cannot hide input.
+
+Then you or an AI assistant can run ordinary commands without including a key:
+
+```bash
+android-localise translate --languages hi,es
+android-localise store-listing --source listing.json --languages hi-IN,es-ES
+android-localise credentials status --provider gemini
+android-localise credentials remove --provider gemini
+```
+
+`status` reports only `saved` or `not saved`; no command displays the saved value.
+`remove` deletes only this CLI's saved entry for that provider; it does not revoke
+the provider key or clear environment-variable overrides. The same commands also
+work with `python -m android_localisation credentials ...`.
+
+| Argument | Description | Default |
+|---|---|---|
+| `set`, `status`, `remove` | Hidden entry, presence check, or deletion | required action |
+| `--provider` | `gemini`, `openai` or `anthropic` | `gemini` |
+
+Both translation commands use this precedence: `--api-key` → provider-specific
+environment variable → `API_KEY` → saved Windows key. Existing overrides retain
+their behavior; if an old environment key is set, saving a new key does not
+override it. Saved OpenAI keys load only for its default endpoint; `custom`
+providers and other `--base-url` endpoints continue using explicit keys or
+environment variables. Saved keys are not automatically sent to custom hosts.
+Provider requests reject HTTP redirects, so use a custom endpoint's final URL.
+Gemini authentication uses a header rather than a URL query parameter, and
+API/network error messages redact the key used for that request before display.
+
+This keeps keys out of chat, command arguments and routine CLI output. It
+**does not isolate secrets from an AI or other program with unrestricted access
+under your Windows account**: Windows permits programs running as that user to
+read their credentials. The key is also present in memory during an API request.
+For stronger separation, use a restricted runner or separately secured proxy.
+See [Microsoft's credential API documentation](https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credreadw).
+
+Saved-key commands are Windows-only, with no plaintext fallback. Other platforms
+keep using environment variables or `--api-key`.
+
+Manual check: save a key yourself, confirm input is hidden, open a new terminal
+and check `status`. Run a small XML and listing preview without `--api-key`,
+review the output, then remove the entry and confirm `not saved`. Ensure any key
+environment overrides are absent when checking saved-key behavior.
+
+---
+
 ## Environment variables
 
-Set your API key as an env variable so you don't have to pass it every time:
+Environment variables remain available on all platforms. For Windows saved
+credentials, use the commands above instead of putting a key in shell history.
+To use an environment variable:
 
 ```bash
 # macOS / Linux

{android_localisation-1.5.0 → android_localisation-1.6.2}/android_localisation.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ pyproject.toml
 android_localisation/__init__.py
 android_localisation/__main__.py
 android_localisation/cli.py
+android_localisation/credentials.py
 android_localisation/fix.py
 android_localisation/locales.py
 android_localisation/resources.py

{android_localisation-1.5.0 → android_localisation-1.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "android-localisation"
-version = "1.5.0"
+version = "1.6.2"
 description = "Zero-dependency Android strings.xml and Google Play store listing translation using LLMs (Gemini, OpenAI, Anthropic, Ollama)."
 readme = "README.md"
 license = { text = "MIT" }