Clarify provider selection and synchronize live TUI state (4/4)

CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.
 
+## Unreleased
+
+### Features
+
+* **providers:** add `zero providers repair-config [--name <name>]` to recover a single legacy unnamed provider profile while preserving the legacy effective provider and active reference; identity-changing repairs of stored-key profiles refuse before writing, so they cannot point at another credential
+
+### Bug Fixes
+
+* **oauth:** validate provider configuration before authorization and immediately before token replacement across CLI, TUI, setup, and device flows, preserving existing credentials when validation fails
+* **providers:** redact credential-shaped values in CLI removal/rename errors and TUI provider-manager ownership and mutation errors
+
 ## [0.9.0](https://github.com/Gitlawb/zero/compare/v0.8.0...v0.9.0) (2026-09-15)
 
 
@@ -81,7 +92,6 @@ tagged. Until then, source builds report the version `dev`.
 * **modelregistry:** expose reasoning effort for DeepSeek V4 models ([#931](https://github.com/Gitlawb/zero/issues/931)) ([90dcfd1](https://github.com/Gitlawb/zero/commit/90dcfd127e8a6d9902ec9f4e72f6d03fef1a0fc6))
 * **providers:** discover ChatGPT capabilities ([#890](https://github.com/Gitlawb/zero/issues/890)) ([2d2450e](https://github.com/Gitlawb/zero/commit/2d2450e9a744349f0d01b1d4e9ba29c24ba5650d))
 * **sandbox:** normalize launcher names before the command-prefix denylist ([#934](https://github.com/Gitlawb/zero/issues/934)) ([6edf9a8](https://github.com/Gitlawb/zero/commit/6edf9a8b78dc030dc44598919db1c7fa9d4f809a))
-
 ## [0.7.0](https://github.com/Gitlawb/zero/compare/v0.6.0...v0.7.0) (2026-08-10)
 
 

README.md

@@ -123,6 +123,14 @@ zero models list
 zero doctor
 ```
 
+If an upgraded `config.json` contains one legacy provider profile without a
+name, repair it with `zero providers repair-config`. The command preserves the
+saved `activeProvider` name (falling back to `openai`). If a row already has that
+exact name, the command preserves the field merge older releases used, with
+later nonempty fields taking precedence. An explicit `--name <unique-name>`
+keeps the legacy row separate instead. Case-only collisions and multiple
+unnamed rows are not merged by guessing; follow the error's repair guidance.
+
 For API providers, set the matching environment variable before setup or enter
 the key in the wizard:
 
@@ -307,7 +315,7 @@ zero exec             one-shot or scripted agent run
 zero setup            first-run provider setup
 zero auth             OAuth/login helpers for supported providers
 zero models           model registry and capabilities
-zero providers        provider profiles and detection
+zero providers        provider profiles, recovery, and detection
 zero doctor           setup, key, and connectivity checks
 zero context          context-budget report
 zero repo-map         deterministic repository map

README_ZH.md

@@ -99,6 +99,14 @@ zero models list
 zero doctor
 ```
 
+如果升级后的 `config.json` 中有一个旧版未命名的提供商配置，请运行
+`zero providers repair-config` 进行修复。该命令会保留已保存的
+`activeProvider` 名称（未设置时回退到 `openai`）。如果已有配置行使用完全相同的
+名称，该命令会保留旧版本的字段合并规则，后出现的非空字段优先。
+通过 `--name <唯一名称>` 显式指定名称则会将旧配置行单独保留。
+对于仅大小写不同的名称冲突或多个未命名的配置行，Zero 不会猜测并合并；
+请按照错误消息中的修复指引操作。
+
 对于 API 提供商，在设置之前设置匹配的环境变量或在向导中输入密钥：
 
 ```bash
@@ -212,7 +220,7 @@ zero exec             一次性或脚本化智能体运行
 zero setup            首次运行提供商设置
 zero auth             支持提供商的 OAuth/登录辅助
 zero models           模型注册表和能力
-zero providers        提供商配置和检测
+zero providers        提供商配置、修复和检测
 zero doctor           设置、密钥和连接检查
 zero context          上下文预算报告
 zero repo-map         确定性仓库映射

docs/oauth-subscriptions.md

@@ -32,6 +32,13 @@ When a login exists for a provider, the **OpenAI and Anthropic** providers send
 before. Tokens are stored 0600 (or the OS keyring with
 `ZERO_OAUTH_STORAGE=keyring`) and never logged. See `zero auth --help`.
 
+Provider OAuth login validates the persisted user configuration before opening
+authorization and revalidates it immediately before replacing a stored token.
+This applies to CLI login, the TUI/setup wizard, and device-code completion. If
+the configuration is invalid at either check, Zero aborts without overwriting
+the previous OAuth credential. If the error identifies one legacy unnamed
+provider profile, repair it with `zero providers repair-config`.
+
 ### In the setup wizard (`/provider`)
 
 Running `/provider` opens a **"How do you want to connect?"** chooser:

internal/cli/app.go

@@ -22,6 +22,7 @@ import (
 	"github.com/Gitlawb/zero/internal/localcontrol"
 	"github.com/Gitlawb/zero/internal/mcp"
 	"github.com/Gitlawb/zero/internal/modelregistry"
+	"github.com/Gitlawb/zero/internal/oauth"
 	"github.com/Gitlawb/zero/internal/observability"
 	"github.com/Gitlawb/zero/internal/peermsg"
 	"github.com/Gitlawb/zero/internal/plugins"
@@ -69,6 +70,7 @@ type appDeps struct {
 	discoverProviderModels       func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error)
 	detectLocalRuntimes          func(context.Context, provideronboarding.LocalDetectOptions) []provideronboarding.DetectedLocalRuntime
 	openRouterLogin              func(context.Context, provideroauth.OpenRouterOptions) (string, error)
+	chatGPTLogin                 func(context.Context, provideroauth.ChatGPTOptions) (oauth.Token, error)
 	newSessionStore              func() *sessions.Store
 	loadPlugins                  func(plugins.LoadOptions) (plugins.LoadResult, error)
 	loadHooks                    func(hooks.LoadOptions) (hooks.LoadResult, error)
@@ -172,6 +174,7 @@ func defaultAppDeps() appDeps {
 		discoverProviderModels: defaultDiscoverProviderModels,
 		detectLocalRuntimes:    provideronboarding.DetectLocalRuntimes,
 		openRouterLogin:        provideroauth.OpenRouterLogin,
+		chatGPTLogin:           provideroauth.ChatGPTLogin,
 		newSessionStore: func() *sessions.Store {
 			return sessions.NewStore(sessions.StoreOptions{})
 		},
@@ -545,6 +548,9 @@ func fillAppDeps(deps appDeps) appDeps {
 	if deps.openRouterLogin == nil {
 		deps.openRouterLogin = defaults.openRouterLogin
 	}
+	if deps.chatGPTLogin == nil {
+		deps.chatGPTLogin = defaults.chatGPTLogin
+	}
 	if deps.newSessionStore == nil {
 		deps.newSessionStore = defaults.newSessionStore
 	}
@@ -739,8 +745,8 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 	// the encrypted credential store (interactive runs only; headless exec keeps
 	// its existing behavior). Non-fatal — a missing keyring or write error leaves
 	// the inline key in place and this run still uses the already-resolved key.
-	if store, storeErr := config.ProviderKeyStoreAt(filepath.Dir(userConfigPath)); storeErr == nil {
-		_, _ = config.MigratePlaintextProviderKeys(userConfigPath, store)
+	if _, migrationErr := config.MigratePlaintextProviderKeysTransactional(userConfigPath); migrationErr != nil {
+		_, _ = fmt.Fprintf(stderr, "[zero] warning: could not migrate every plaintext provider API key: %s\n", redaction.ErrorMessage(migrationErr, redaction.Options{}))
 	}
 	doctorUserConfigPath := ""
 	projectConfigPath := ""

internal/cli/app_test.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"reflect"
 	"runtime"
 	"strings"
 	"testing"
@@ -17,6 +18,8 @@ import (
 	"github.com/Gitlawb/zero/internal/agent"
 	"github.com/Gitlawb/zero/internal/config"
 	"github.com/Gitlawb/zero/internal/mcp"
+	"github.com/Gitlawb/zero/internal/oauth"
+	"github.com/Gitlawb/zero/internal/provideroauth"
 	"github.com/Gitlawb/zero/internal/redaction"
 	"github.com/Gitlawb/zero/internal/tools"
 	"github.com/Gitlawb/zero/internal/tui"
@@ -33,6 +36,29 @@ func (failingWriter) Write([]byte) (int, error) {
 	return 0, errWriteFailed
 }
 
+func TestChatGPTLoginDependencyDefaultsAndPreservesInjection(t *testing.T) {
+	wantDefault := reflect.ValueOf(provideroauth.ChatGPTLogin).Pointer()
+	if got := defaultAppDeps().chatGPTLogin; got == nil || reflect.ValueOf(got).Pointer() != wantDefault {
+		t.Fatal("defaultAppDeps().chatGPTLogin is not provideroauth.ChatGPTLogin")
+	}
+	if got := fillAppDeps(appDeps{}).chatGPTLogin; got == nil || reflect.ValueOf(got).Pointer() != wantDefault {
+		t.Fatal("fillAppDeps(appDeps{}).chatGPTLogin is not provideroauth.ChatGPTLogin")
+	}
+
+	called := false
+	injected := func(context.Context, provideroauth.ChatGPTOptions) (oauth.Token, error) {
+		called = true
+		return oauth.Token{}, nil
+	}
+	deps := fillAppDeps(appDeps{chatGPTLogin: injected})
+	if _, err := deps.chatGPTLogin(context.Background(), provideroauth.ChatGPTOptions{}); err != nil {
+		t.Fatalf("injected chatGPTLogin returned error: %v", err)
+	}
+	if !called {
+		t.Fatal("fillAppDeps replaced the injected chatGPTLogin")
+	}
+}
+
 func TestRunPrintsVersion(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -404,6 +430,27 @@ func TestRunNoArgsFailsWhenResolveErrorIsNotProviderRelated(t *testing.T) {
 	}
 }
 
+func TestRunNoArgsOffersRepairCommandForPersistedNameFailure(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	cwd := t.TempDir()
+	configPath := filepath.Join(t.TempDir(), "zero", "config.json")
+	writeProviderOnboardingConfig(t, configPath, config.FileConfig{Providers: []config.ProviderProfile{{Name: ""}, {Name: "work"}, {Name: "WORK"}}})
+	exitCode := runWithDeps(nil, &stdout, &stderr, appDeps{
+		getwd:          func() (string, error) { return cwd, nil },
+		userConfigPath: func() (string, error) { return configPath, nil },
+		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
+			return config.Resolve(config.ResolveOptions{UserConfigPath: configPath, Env: map[string]string{}})
+		},
+		runTUI: func(context.Context, tui.Options) int {
+			t.Fatal("TUI must not launch with ambiguous persisted identities")
+			return 0
+		},
+	})
+	if exitCode == exitSuccess || !strings.Contains(stderr.String(), "zero providers repair-config") {
+		t.Fatalf("exit=%d stderr=%q, want actionable repair path", exitCode, stderr.String())
+	}
+}
+
 func TestRunNoArgsLaunchesTUIWithMCPState(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer