Keep the synthetic resolved row out of the OAuth hand-named set

buildProviderCatalog synthesizes a resolved row when settings is null or empty; when resolved is itself codex/<slug> that row carries the live apiKey with no profile marker and ejected the real marked entry. Derive handNamed from raw settings.providers only.

Author: TheGreatAxios

src/config/index.ts

@@ -1221,15 +1221,19 @@ export function mergeOAuthCatalog(
   const settingsRows = buildProviderCatalog(settings, resolved);
   // A hand-named codex/<slug> or xai/<slug> API-key row is the operator's
   // explicit config, not an OAuth placeholder: keep it and skip the colliding
-  // live profile projection instead of overwriting it (CL-6728).
+  // live profile projection instead of overwriting it (CL-6728). Read the raw
+  // settings rows only: buildProviderCatalog synthesizes a [resolved] row when
+  // settings is null/empty, and when resolved is itself codex/<slug> that row
+  // carries the live apiKey with no profile marker — treating it as hand-named
+  // would eject the real marked entry for a stale token snapshot.
   const handNamed = new Set(
-    settingsRows
+    Object.entries(settings?.providers ?? {})
       .filter(
-        (e) =>
-          (isCodexProviderName(e.name) || isXaiProviderName(e.name)) &&
-          isHandNamedProviderEntry(e),
+        ([name, provider]) =>
+          (isCodexProviderName(name) || isXaiProviderName(name)) &&
+          isHandNamedProviderEntry(provider),
       )
-      .map((e) => e.name),
+      .map(([name]) => name),
   );
   return [
     ...settingsRows.filter(

src/config/oauth-catalog.test.ts

@@ -7,6 +7,10 @@ import {
   codexProfilesToCatalogEntries,
   codexProvidersAsSettings,
 } from "./codex-providers.js";
+import {
+  xaiProfilesToCatalogEntries,
+  xaiProvidersAsSettings,
+} from "./xai-providers.js";
 import {
   dropOrphanedOAuthEntries,
   mergeOAuthCatalog,
@@ -241,4 +245,158 @@ describe("CL-6728: OAuth projections do not overwrite hand-named provider entrie
     expect(persisted.providers["codex/mine"]?.apiKey).toBe("hand-named-key");
     expect(JSON.stringify(persisted)).not.toContain("live-token");
   });
+
+  test("mergeOAuthCatalog keeps the marked live entry when settings is null and resolved is codex/<slug>", () => {
+    const resolvedCodexMine: ResolvedProvider = {
+      providerName: "codex/mine",
+      baseURL: CODEX_BASE_URL,
+      apiKey: "live-token",
+      model: "gpt-5.1-codex-max",
+    };
+    const merged = mergeOAuthCatalog(null, resolvedCodexMine, [liveMine], []);
+    const rows = merged.filter((p) => p.name === "codex/mine");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.codexProfile).toBe("mine");
+    expect(rows[0]?.apiKey).toBe("live-token");
+  });
+
+  test("mergeOAuthCatalog keeps the marked live entry when settings is empty and resolved is codex/<slug>", () => {
+    const resolvedCodexMine: ResolvedProvider = {
+      providerName: "codex/mine",
+      baseURL: CODEX_BASE_URL,
+      apiKey: "live-token",
+      model: "gpt-5.1-codex-max",
+    };
+    const merged = mergeOAuthCatalog(
+      settingsWith({}),
+      resolvedCodexMine,
+      [liveMine],
+      [],
+    );
+    const rows = merged.filter((p) => p.name === "codex/mine");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.codexProfile).toBe("mine");
+    expect(rows[0]?.apiKey).toBe("live-token");
+  });
+
+  test("persist round-trip from the empty-settings merge contains no live token", () => {
+    const resolvedCodexMine: ResolvedProvider = {
+      providerName: "codex/mine",
+      baseURL: CODEX_BASE_URL,
+      apiKey: "live-token",
+      model: "gpt-5.1-codex-max",
+    };
+    const merged = mergeOAuthCatalog(null, resolvedCodexMine, [liveMine], []);
+    const persisted = providerCatalogToSettings(merged, undefined);
+    expect(JSON.stringify(persisted)).not.toContain("live-token");
+  });
+
+  test("mergeOAuthCatalog keeps a hand-named xai/<slug> entry when its profile is live", () => {
+    const handNamedXai = (): ProviderSettings => ({
+      baseURL: "https://hand-named-xai.example.com/v1",
+      apiKey: "hand-named-xai-key",
+      models: ["hand-xai-model"],
+    });
+    const merged = mergeOAuthCatalog(
+      settingsWith({ "xai/work": handNamedXai() }),
+      resolved,
+      [],
+      [xaiWork],
+    );
+    const rows = merged.filter((p) => p.name === "xai/work");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.apiKey).toBe("hand-named-xai-key");
+    expect(rows[0]?.xaiProfile).toBeUndefined();
+  });
+
+  test("overlayOAuthProjections keeps a hand-named xai/<slug> API-key entry", () => {
+    const overlaid = overlayOAuthProjections(
+      settingsWith({
+        "xai/work": {
+          baseURL: "https://hand-named-xai.example.com/v1",
+          apiKey: "hand-named-xai-key",
+          models: ["hand-xai-model"],
+        },
+      }),
+      xaiProvidersAsSettings([xaiWork]),
+    );
+    expect(overlaid?.providers["xai/work"]?.apiKey).toBe("hand-named-xai-key");
+  });
+
+  test("mergeOAuthCatalog keeps a keyless codex/<slug> entry when its profile is live", () => {
+    const merged = mergeOAuthCatalog(
+      settingsWith({
+        "codex/mine": {
+          baseURL: "https://hand-named.example.com/v1",
+          keyless: true,
+          models: ["hand-model"],
+        },
+      }),
+      resolved,
+      [liveMine],
+      [],
+    );
+    const rows = merged.filter((p) => p.name === "codex/mine");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.keyless).toBe(true);
+    expect(rows[0]?.codexProfile).toBeUndefined();
+  });
+
+  test("runtimeSettingsWithCatalog keeps a keyless codex/<slug> entry", () => {
+    const runtime = runtimeSettingsWithCatalog(
+      settingsWith({
+        "codex/mine": {
+          baseURL: "https://hand-named.example.com/v1",
+          keyless: true,
+          models: ["hand-model"],
+        },
+      }),
+      liveCatalog(),
+    );
+    expect(runtime.providers["codex/mine"]?.keyless).toBe(true);
+    expect(runtime.providers["codex/mine"]?.apiKey).toBeUndefined();
+  });
+
+  test("overlayOAuthProjections treats a whitespace apiKey as hand-named", () => {
+    const overlaid = overlayOAuthProjections(
+      settingsWith({
+        "codex/mine": {
+          baseURL: "https://hand-named.example.com/v1",
+          apiKey: "   ",
+          models: ["hand-model"],
+        },
+      }),
+      liveProjected(),
+    );
+    expect(overlaid?.providers["codex/mine"]?.apiKey).toBe("   ");
+  });
+
+  test("overlayOAuthProjections treats an empty-string apiKey as a placeholder", () => {
+    const overlaid = overlayOAuthProjections(
+      settingsWith({
+        "codex/mine": {
+          baseURL: "https://hand-named.example.com/v1",
+          apiKey: "",
+          models: ["hand-model"],
+        },
+      }),
+      liveProjected(),
+    );
+    expect(overlaid?.providers["codex/mine"]?.apiKey).toBe("live-token");
+  });
+
+  test("runtimeSettingsWithCatalog resolves a keyless xai/<slug> entry from the catalog", () => {
+    const runtime = runtimeSettingsWithCatalog(
+      settingsWith({
+        "xai/work": {
+          baseURL: "https://hand-named-xai.example.com/v1",
+          keyless: true,
+          models: ["hand-xai-model"],
+        },
+      }),
+      xaiProfilesToCatalogEntries([xaiWork]),
+    );
+    expect(runtime.providers["xai/work"]?.keyless).toBe(true);
+    expect(runtime.providers["xai/work"]?.apiKey).toBeUndefined();
+  });
 });