fix(provider): follow a relocated meta api key in project settings

Author: TheGreatAxios

src/config/index.ts

@@ -59,7 +59,10 @@ import {
   metaProfilesToCatalogEntries,
   metaProvidersAsSettings,
 } from "./meta-providers.js";
-import { separateCollidingMetaApiKeys } from "./meta-api-key.js";
+import {
+  providerAfterMetaApiKeySeparation,
+  separateCollidingMetaApiKeys,
+} from "./meta-api-key.js";
 import { customReasoningSettings } from "./providers.js";
 import { CODEX_BASE_URL } from "../auth/codex/constants.js";
 import { XAI_BASE_URL } from "../auth/xai/constants.js";
@@ -114,6 +117,7 @@ import {
   normalizeOpenAICompatibleBaseURL,
   resolveProvider,
   saveGlobalSettings,
+  saveLocalSettings,
   hasMcpTransport,
   isExaMCPPreset,
   type MCPServerSettingsEntry,
@@ -1307,7 +1311,26 @@ export async function loadConfig(
   if (localResultSettled.status === "rejected") throw localResultSettled.reason;
   if (profileResult.status === "rejected") throw profileResult.reason;
   const localResult = localResultSettled.value;
-  const local = localResult.settings;
+  const storedLocal = localResult.settings;
+  const separatedLocalProvider = providerAfterMetaApiKeySeparation(
+    storedLocal?.provider,
+    separatedMeta.renames,
+  );
+  const local =
+    storedLocal !== null &&
+    separatedLocalProvider !== undefined &&
+    separatedLocalProvider !== storedLocal.provider
+      ? { ...storedLocal, provider: separatedLocalProvider }
+      : storedLocal;
+  if (local !== storedLocal && local !== null && localSettingsFile !== null) {
+    try {
+      await saveLocalSettings(localSettingsFile, local);
+    } catch {
+      process.stderr.write(
+        `settings: failed to persist Meta API-key separation for ${localSettingsFile}; continuing with in-memory settings.\n`,
+      );
+    }
+  }
   const settingsDiagnostics = localResult.diagnostics;
   const profile = profileResult.value;
 

src/config/meta-api-key.test.ts

@@ -1,7 +1,11 @@
 import { describe, expect, test } from "bun:test";
 
 import { META_BASE_URL } from "../auth/meta/constants.js";
-import { assignMetaOAuthProviderRow } from "./meta-api-key.js";
+import {
+  assignMetaOAuthProviderRow,
+  providerAfterMetaApiKeySeparation,
+  separateCollidingMetaApiKeys,
+} from "./meta-api-key.js";
 import type { ProviderSettings, Settings } from "./settings.js";
 
 function settingsWith(providers: Record<string, ProviderSettings>): Settings {
@@ -32,6 +36,37 @@ describe("assignMetaOAuthProviderRow", () => {
     expect(next.defaultProvider).toBe("meta/work");
   });
 
+  test("reports the rename a project-local provider must follow", () => {
+    const separated = separateCollidingMetaApiKeys(
+      {
+        ...settingsWith({
+          "meta/work": {
+            baseURL: META_BASE_URL,
+            apiKey: "LLM|work-key",
+            models: ["muse-spark-1.3"],
+          },
+        }),
+        defaultProvider: "meta/work",
+      },
+      ["work"],
+    );
+    expect(separated.changed).toBe(true);
+    expect(separated.renames).toEqual([
+      { from: "meta/work", to: "meta-api/work" },
+    ]);
+    expect(separated.settings?.defaultProvider).toBe("meta-api/work");
+    expect(separated.settings?.providers["meta/work"]?.apiKey).toBeUndefined();
+    expect(separated.settings?.providers["meta-api/work"]?.apiKey).toBe(
+      "LLM|work-key",
+    );
+    expect(
+      providerAfterMetaApiKeySeparation("meta/work", separated.renames),
+    ).toBe("meta-api/work");
+    expect(providerAfterMetaApiKeySeparation("openai", separated.renames)).toBe(
+      "openai",
+    );
+  });
+
   test("a free OAuth slug still writes a credential-less row", () => {
     const next = assignMetaOAuthProviderRow(
       settingsWith({}),

src/config/meta-api-key.ts

@@ -54,6 +54,11 @@ function remapProviderRefs(
   );
 }
 
+export interface MetaApiKeyRename {
+  readonly from: string;
+  readonly to: string;
+}
+
 /**
  * Move a hand-saved Meta API key off `meta/<slug>` when that slug is an OAuth
  * profile. The key keeps its secret under `meta-api/<slug>`; `meta/<slug>`
@@ -62,9 +67,13 @@ function remapProviderRefs(
 export function separateCollidingMetaApiKeys(
   settings: Settings | null,
   oauthSlugs: readonly string[],
-): { settings: Settings | null; changed: boolean } {
+): {
+  settings: Settings | null;
+  changed: boolean;
+  renames: readonly MetaApiKeyRename[];
+} {
   if (settings === null || oauthSlugs.length === 0) {
-    return { settings, changed: false };
+    return { settings, changed: false, renames: [] };
   }
   const slugs = new Set(oauthSlugs);
   let providers: Record<string, ProviderSettings> = {
@@ -74,6 +83,7 @@ export function separateCollidingMetaApiKeys(
   let recentModels = settings.recentModels;
   let favoriteModels = settings.favoriteModels;
   let changed = false;
+  const renames: MetaApiKeyRename[] = [];
   for (const [name, provider] of Object.entries(settings.providers)) {
     if (!isMetaProviderName(name) || !hasApiKey(provider)) continue;
     const slug = metaProfileFromProviderName(name);
@@ -89,9 +99,10 @@ export function separateCollidingMetaApiKeys(
     if (defaultProvider === name) defaultProvider = relocated;
     recentModels = remapProviderRefs(recentModels, name, relocated);
     favoriteModels = remapProviderRefs(favoriteModels, name, relocated);
+    renames.push({ from: name, to: relocated });
     changed = true;
   }
-  if (!changed) return { settings, changed: false };
+  if (!changed) return { settings, changed: false, renames: [] };
   return {
     settings: {
       ...settings,
@@ -101,9 +112,20 @@ export function separateCollidingMetaApiKeys(
       ...(favoriteModels !== undefined ? { favoriteModels } : {}),
     },
     changed: true,
+    renames,
   };
 }
 
+/** Project-local `provider` follows a key that moved to `meta-api/<slug>`. */
+export function providerAfterMetaApiKeySeparation(
+  provider: string | undefined,
+  renames: readonly MetaApiKeyRename[],
+): string | undefined {
+  if (provider === undefined) return undefined;
+  const rename = renames.find((entry) => entry.from === provider);
+  return rename === undefined ? provider : rename.to;
+}
+
 /**
  * OAuth save for `oauthName`. An existing API key at that name is moved aside;
  * the placeholder written for OAuth never carries the key.