ly-wang19 28028cce55 fix(web): clear stale `api`-alias credential on provider switch in main-model assignment ... c253b0738 added clear_model_endpoint_credentials() to scrub an old endpoint's inline secret (api_key, the legacy `api` alias, api_mode) when the web UI switches the main model to a different provider. But _apply_main_model_assignment gates the key-scrub path on model_cfg["api_key"] being truthy, so when the stale secret lives only under the legacy `api` alias (no api_key), a provider switch never clears it — the secret survives in config.yaml. model.api is a live credential read path (_resolve_openrouter_runtime reads `for k in ("api_key", "api")`), so the old endpoint's key contaminates a later custom resolution — the exact harm clear_model_endpoint_credentials documents. The sibling persistence sites (the gateway model-picker paths and the aux-slot path) call the helper unconditionally on a non-custom switch and already scrub `api`; only this caller had the api_key-only gate. Widen the guard to fire on either field. The same-provider re-pick and explicit-new-key paths are unchanged. Adds the api-alias case to the assignment test (it fails without the fix).		2026-07-20 09:21:08 -07:00
..
dashboard_auth	fix(mcp): complete OAuth through hosted dashboards	2026-07-17 04:50:47 -07:00
proxy	…
subcommands	fix(config): warn-after-write for unrecognized keys instead of refusing	2026-07-20 05:38:59 -07:00
__init__.py	…
_parser.py	…
_subprocess_compat.py	…
active_sessions.py	…
auth.py	fix(auth): detect configured providers absent from registry (#66017)	2026-07-16 22:56:45 -04:00
auth_commands.py	fix(auth): make xAI OAuth pools multi-account resilient	2026-07-17 11:37:25 +05:30
azure_detect.py	…
backup.py	fix(discord): harden reconnect message recovery	2026-07-18 14:01:33 -07:00
banner.py	…
blueprint_cmd.py	…
browser_connect.py	fix: /browser connect times out when another app squats the CDP port	2026-07-18 02:49:28 -07:00
build_info.py	…
bundles.py	…
callbacks.py	…
checkpoints.py	…
claw.py	…
cli_agent_setup_mixin.py	fix(cli): sanitize terminal escapes when replaying stored history (/resume recap, /status recap)	2026-07-17 04:53:38 -07:00
cli_billing_mixin.py	feat(tui+cli): change your Nous plan from the terminal (/subscription, /topup, terminal-billing UX) (#51639)	2026-07-18 14:30:24 +05:30
cli_commands_mixin.py	fix: session-scoped /fast + full /new reset to config defaults (#67979)	2026-07-20 03:27:22 -07:00
cli_output.py	…
clipboard.py	…
codex_models.py	…
codex_runtime_plugin_migration.py	…
codex_runtime_switch.py	…
colors.py	…
commands.py	fix: session-scoped /fast + full /new reset to config defaults (#67979)	2026-07-20 03:27:22 -07:00
completion.py	…
config.py	fix(desktop, ink): don't wipe messages before final message (#65919)	2026-07-20 11:42:29 -04:00
console_engine.py	refactor(console): remove hosted-context command blocking from Hermes Console (#66144)	2026-07-17 04:33:34 -07:00
container_boot.py	fix(container): keep named multiplex gateway slots down (#65368)	2026-07-16 14:30:05 +10:00
context_switch_guard.py	…
copilot_auth.py	…
credential_lifecycle.py	fix(credentials): unified provider key delete/update across .env, auth.json, config.yaml (#67213)	2026-07-19 03:02:21 -07:00
cron.py	fix(cron): harden execution attempt ledger	2026-07-17 04:58:35 -07:00
curator.py	…
curses_ui.py	…
dashboard_register.py	…
debug.py	…
default_soul.py	…
dep_ensure.py	…
diagnostics_upload.py	…
dingtalk_auth.py	…
doctor.py	feat(providers): add ``enabled: false`` flag to hide a provider	2026-07-20 03:06:02 -07:00
dump.py	fix(cron): accept UTF-8 BOM when reading jobs.json	2026-07-18 02:31:20 -07:00
env_loader.py	fix(cli): warn once per path for UTF-32 .env refuse-to-mangle	2026-07-18 19:01:10 -04:00
fallback_cmd.py	…
fallback_config.py	fix(auth): honor per-entry key_env when resolving fallback providers	2026-07-16 07:19:36 -07:00
gateway.py	fix(gateway): recover Discord websocket and event-loop stalls	2026-07-18 20:01:55 +05:30
gateway_enroll.py	…
gateway_windows.py	…
goals.py	fix(goals): auto-pause goal loop on consecutive transport failures	2026-07-20 05:38:25 -07:00
gui_uninstall.py	…
hooks.py	…
input_sanitize.py	fix(input): strip bracketed-paste leaks before prompt persistence (#62557)	2026-07-15 07:39:42 -07:00
inventory.py	feat(model-switch): excluded_providers config to hide providers from /model picker	2026-07-20 03:06:02 -07:00
journey.py	…
kanban.py	fix: migrate CLI kanban gate + remaining mocks to 5-value judge contract	2026-07-20 05:38:25 -07:00
kanban_db.py	refactor(kanban): unify attachment size cap on KANBAN_ATTACHMENT_MAX_BYTES	2026-07-16 07:33:14 -07:00
kanban_decompose.py	fix(auxiliary): route direct-create aux callers through call_llm (#65029)	2026-07-15 07:39:17 -07:00
kanban_diagnostics.py	…
kanban_specify.py	fix(auxiliary): route direct-create aux callers through call_llm (#65029)	2026-07-15 07:39:17 -07:00
kanban_swarm.py	…
logs.py	…
main.py	feat(model-switch): excluded_providers config to hide providers from /model picker	2026-07-20 03:06:02 -07:00
managed_scope.py	…
managed_uv.py	…
mcp_catalog.py	…
mcp_config.py	fix(mcp): close hosted OAuth lifecycle gaps	2026-07-17 04:50:47 -07:00
mcp_picker.py	…
mcp_security.py	…
mcp_startup.py	…
memory_oauth.py	…
memory_setup.py	…
middleware.py	…
migrate.py	…
moa_cmd.py	…
moa_config.py	fix(moa): surface stale presets without retries	2026-07-17 13:49:12 -07:00
model_catalog.py	…
model_cost_guard.py	…
model_normalize.py	…
model_setup_flows.py	feat(pricing): refresh Fireworks snapshot to 2026-07, cover full serverless catalog + cached picker pricing	2026-07-16 04:24:14 -07:00
model_switch.py	feat(providers): post-filter picker by ``enabled: false`` for built-ins	2026-07-20 03:06:02 -07:00
models.py	fix(models): complete kimi-k3 rollout across Kimi-direct catalog surfaces	2026-07-20 08:47:55 -07:00
nous_account.py	…
nous_auth_keepalive.py	…
nous_billing.py	Terminal-billing client hardening: shared wire types, wire-layer tests, dead RPC removal (#61067)	2026-07-18 07:05:58 -07:00
nous_subscription.py	…
onepassword_secrets_cli.py	…
oneshot.py	refactor(cli): apply /simplify-code findings to oneshot teardown	2026-07-20 12:59:28 +05:30
pairing.py	…
partial_compress.py	…
pets.py	…
platforms.py	…
plugins.py	…
plugins_cmd.py	fix(dashboard): unblock basic auth plugin when setting password interactively (#54489) (#63786)	2026-07-16 19:49:39 -04:00
portal_cli.py	…
profile_describer.py	fix(auxiliary): route direct-create aux callers through call_llm (#65029)	2026-07-15 07:39:17 -07:00
profile_distribution.py	…
profiles.py	…
projects_cmd.py	…
projects_db.py	…
prompt_size.py	…
provider_catalog.py	…
providers.py	fix(model-switch): override stale api_mode with host-mandated mode on OpenAI-direct switch	2026-07-17 15:47:08 -07:00
psutil_android.py	…
pt_input_extras.py	…
pty_bridge.py	…
pty_session.py	…
relaunch.py	…
runtime_provider.py	feat(providers): extend ``enabled: false`` gate to built-in resolution	2026-07-20 03:06:02 -07:00
secret_prompt.py	…
secrets_cli.py	…
security_advisories.py	…
security_audit.py	…
security_audit_startup.py	…
send_cmd.py	…
service_manager.py	…
session_export.py	…
session_export_html.py	…
session_export_md.py	…
session_filters.py	…
session_listing.py	…
session_recap.py	fix(cli): sanitize terminal escapes when replaying stored history (/resume recap, /status recap)	2026-07-17 04:53:38 -07:00
setup.py	fix(models): complete kimi-k3 rollout across Kimi-direct catalog surfaces	2026-07-20 08:47:55 -07:00
setup_whatsapp_cloud.py	…
skills_config.py	…
skills_hub.py	fix: widen UTF-8 BOM tolerance to all sibling frontmatter parsers	2026-07-17 04:52:02 -07:00
skin_engine.py	…
slack_cli.py	…
sqlite_util.py	…
status.py	fix(cron): accept UTF-8 BOM when reading jobs.json	2026-07-18 02:31:20 -07:00
stdio.py	…
suggestions_cmd.py	…
telegram_managed_bot.py	…
timeouts.py	…
tips.py	feat(browser): store full snapshots on truncation; make eval denylist opt-in (#65923)	2026-07-16 23:41:26 -07:00
tools_config.py	feat(desktop): five Capabilities-tab UX fixes from live testing — hints, vision link, web split, key deep-links (#67482)	2026-07-19 05:45:01 -07:00
toolset_validation.py	…
uninstall.py	…
urllib_security.py	…
voice.py	…
web_git.py	…
web_server.py	fix(web): clear stale `api`-alias credential on provider switch in main-model assignment	2026-07-20 09:21:08 -07:00
webhook.py	fix(webhook): make dual-stack bind exclusive	2026-07-16 12:36:51 +05:30
win_pty_bridge.py	…
write_approval_commands.py	…
xai_retirement.py	…