fix(provider): do not treat a keyless meta row as an api key

Author: TheGreatAxios

src/tui/onboarding.ts

@@ -12,6 +12,7 @@ import {
   telemetryFirstRunPending,
 } from "../telemetry/first-run.js";
 import { getTelemetry } from "../telemetry/singleton.js";
+import { catalogRowsForMetaOAuthGuard } from "./provider/oauth.js";
 import { runProviderSetup } from "./provider/setup.js";
 import { runWelcome } from "./welcome.js";
 
@@ -46,7 +47,7 @@ export async function runOnboarding(
 
   const submitted = await runProviderSetup({
     showTelemetryNotice,
-    existingProviderNames: Object.keys(existing?.providers ?? {}),
+    existingProviderNames: catalogRowsForMetaOAuthGuard(existing?.providers),
     onSubmit: buildProviderSubmitHandler(
       settingsPath,
       existing,

src/tui/provider-setup.test.ts

@@ -43,6 +43,7 @@ import {
   LOGIN_TIMEOUT_MESSAGE,
   suggestOAuthProfileSlug,
   suggestMetaOAuthProfileSlug,
+  catalogRowsForMetaOAuthGuard,
   metaOAuthSlugBlockedByApiKey,
   validateOAuthProfileSlug,
 } from "./provider/oauth.js";
@@ -344,6 +345,22 @@ describe("provider setup pure helpers", () => {
     expect(suggestMetaOAuthProfileSlug([], [])).toBe("default");
     expect(metaOAuthSlugBlockedByApiKey("work", ["meta/work"])).toBe(true);
     expect(metaOAuthSlugBlockedByApiKey("work", ["meta-api/work"])).toBe(true);
+    expect(metaOAuthSlugBlockedByApiKey("work", [{ name: "meta/work" }])).toBe(
+      false,
+    );
+    expect(
+      catalogRowsForMetaOAuthGuard({
+        "meta/work": {},
+      }),
+    ).toEqual([{ name: "meta/work" }]);
+    expect(
+      metaOAuthSlugBlockedByApiKey(
+        "work",
+        catalogRowsForMetaOAuthGuard({
+          "meta/work": { apiKey: "LLM|pasted" },
+        }),
+      ),
+    ).toBe(true);
     const authProfiles: readonly string[] = [];
     const existingProviderNames = ["meta-api/default"];
     const suggested = suggestMetaOAuthProfileSlug(

src/tui/provider/connect.ts

@@ -8,6 +8,7 @@ import type { Settings } from "../../config/settings.js";
 import { getTelemetry } from "../../telemetry/singleton.js";
 import { runProviderSetup } from "./setup.js";
 import type { ProviderSetupConfig } from "./types.js";
+import { catalogRowsForMetaOAuthGuard } from "./oauth.js";
 import {
   buildProviderSubmitHandler,
   type PersistProviderSettings,
@@ -59,7 +60,9 @@ export async function connectProviderInline(
     ...(input.initialOAuthProfile !== undefined
       ? { initialOAuthProfile: input.initialOAuthProfile }
       : {}),
-    existingProviderNames: Object.keys(input.existing?.providers ?? {}),
+    existingProviderNames: catalogRowsForMetaOAuthGuard(
+      input.existing?.providers,
+    ),
     ...(input.createRenderer !== undefined
       ? { createRenderer: input.createRenderer }
       : {}),

src/tui/provider/oauth.ts

@@ -19,6 +19,7 @@ import {
 } from "../../auth/meta/verification-uri.js";
 import type {
   AccountNameFlow,
+  ExistingProviderRef,
   LoginFlow,
   OAuthKind,
   OAuthLoginStart,
@@ -82,19 +83,40 @@ export function suggestOAuthProfileSlug(existing: readonly string[]): string {
   return `default-${String(n)}`;
 }
 
+function providerNameList(rows: readonly ExistingProviderRef[]): string[] {
+  return rows.map((row) => (typeof row === "string" ? row : row.name));
+}
+
 // `meta/<slug>` and `meta-api/<slug>` are one namespace: signing in under a
 // slug that already names an API-key row is rejected.
 export function suggestMetaOAuthProfileSlug(
   authProfiles: readonly string[],
-  existingProviderNames: readonly string[],
+  existingProviderNames: readonly ExistingProviderRef[],
 ): string {
+  const names = providerNameList(existingProviderNames);
   return suggestOAuthProfileSlug([
     ...authProfiles,
-    ...instanceSlugsForKind("meta", existingProviderNames),
-    ...instanceSlugsForKind("meta-api", existingProviderNames),
+    ...instanceSlugsForKind("meta", names),
+    ...instanceSlugsForKind("meta-api", names),
   ]);
 }
 
+/** Settings rows for the slug guard. A keyless `meta/<slug>` is not an API key. */
+export function catalogRowsForMetaOAuthGuard(
+  providers: Readonly<Record<string, { readonly apiKey?: string }>> | undefined,
+): ExistingProviderRef[] {
+  const rows: ExistingProviderRef[] = [];
+  for (const [name, provider] of Object.entries(providers ?? {})) {
+    const apiKey = provider.apiKey;
+    if (typeof apiKey === "string" && apiKey.length > 0) {
+      rows.push({ name, apiKey });
+    } else {
+      rows.push({ name });
+    }
+  }
+  return rows;
+}
+
 /** True when `slug` names an API-key row, not an OAuth profile. */
 export function metaOAuthSlugBlockedByApiKey(
   slug: string,
@@ -422,7 +444,10 @@ export function createAccountNameFlow(
     }
     applySuggestion(
       suggestOAuthProfileSlug(
-        instanceSlugsForKind(state.choice.id, state.existingProviderNames),
+        instanceSlugsForKind(
+          state.choice.id,
+          providerNameList(state.existingProviderNames),
+        ),
       ),
     );
   };
@@ -442,7 +467,7 @@ export function createAccountNameFlow(
       state.values.name = resolveApiKeyInstanceName(
         state.choice.id,
         slug,
-        state.existingProviderNames,
+        providerNameList(state.existingProviderNames),
       );
     }
     state.stepIndex += 1;
@@ -502,7 +527,10 @@ export function createAccountNameFlow(
       return;
     }
     handleNames(
-      instanceSlugsForKind(state.choice.id, state.existingProviderNames),
+      instanceSlugsForKind(
+        state.choice.id,
+        providerNameList(state.existingProviderNames),
+      ),
     );
   };
 

src/tui/provider/types.ts

@@ -30,6 +30,15 @@ import type { SetupStep } from "./steps.js";
 
 export type OAuthKind = FirstClassOAuthProvider;
 
+/** Catalog row the Meta OAuth slug guard can tell from an API key. */
+export type ExistingProviderRef =
+  | string
+  | {
+      readonly name: string;
+      readonly apiKey?: string;
+      readonly metaProfile?: string;
+    };
+
 /**
  * A selectable provider. Preset rows carry everything the settings write needs
  * except the key; the custom row carries nothing and opens the manual form.
@@ -158,7 +167,7 @@ export interface ProviderSetupConfig {
   /** Prefill the OAuth account-name step with the profile slug being re-keyed. */
   readonly initialOAuthProfile?: string;
   /** Existing catalog keys, for suggested slugs and collision confirms on the API-key path. */
-  readonly existingProviderNames?: readonly string[];
+  readonly existingProviderNames?: readonly ExistingProviderRef[];
 }
 
 /** Mutable state shared by the setup surface and its extracted flows. */
@@ -168,7 +177,7 @@ export interface SetupState {
   readonly externalRenderer: boolean;
   readonly clipboard: ClipboardPort;
   readonly choices: readonly ProviderChoice[];
-  readonly existingProviderNames: readonly string[];
+  readonly existingProviderNames: readonly ExistingProviderRef[];
   readonly values: ProviderFormValues;
   readonly margin: number;
   choice: ProviderChoice | null;