From d84546e996d7056369c54f3caf6de6ac95afb264 Mon Sep 17 00:00:00 2001
From: jatmn <the@jat.mn>
Date: Wed, 4 Nov 2026 18:19:23 -0800
Subject: [PATCH] fix(requesty): clear a copied Requesty key on provider switch

A saved Requesty profile mirrors its key into OPENAI_API_KEY. The
copied-key detection in applyProviderFlag listed LLMTR and the other
dedicated gateways but not Requesty, so --provider openai or openrouter
kept the Requesty key as the generic credential for the new endpoint.
An independent shell OPENAI_API_KEY is still preserved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/utils/providerFlag.test.ts | 28 ++++++++++++++++++++++++++++
 src/utils/providerFlag.ts      |  3 +++
 2 files changed, 31 insertions(+)

diff --git a/src/utils/providerFlag.test.ts b/src/utils/providerFlag.test.ts
index 70a630e78..55df61f48 100644
--- a/src/utils/providerFlag.test.ts
+++ b/src/utils/providerFlag.test.ts
@@ -36,6 +36,7 @@ const ENV_KEYS = [
   'OPENAI_AUTH_SCHEME',
   'OPENAI_AUTH_HEADER_VALUE',
   'LLMTR_API_KEY',
+  'REQUESTY_API_KEY',
   'CMD_API_KEY',
   'COMMANDCODE_API_KEY',
   'COMMAND_CODE_API_KEY',
@@ -646,6 +647,33 @@ describe('applyProviderFlag - descriptor-backed openai-compatible routes', () =>
     expect(process.env.OPENAI_API_KEY).toBe('generic-openai-secret')
   })
 
+  test('clears a Requesty key copied into OPENAI_API_KEY when switching routes', () => {
+    process.env.REQUESTY_API_KEY = 'requesty-secret'
+    process.env.OPENAI_API_KEY = 'requesty-secret'
+    process.env.OPENAI_BASE_URL = 'https://router.requesty.ai/v1'
+
+    for (const provider of ['openai', 'openrouter']) {
+      process.env.OPENAI_API_KEY = 'requesty-secret'
+      const result = applyProviderFlag(provider, [])
+
+      expect(result.error).toBeUndefined()
+      expect(process.env.OPENAI_API_KEY).toBeUndefined()
+      expect(process.env.REQUESTY_API_KEY).toBe('requesty-secret')
+    }
+  })
+
+  test('preserves an independent generic OPENAI_API_KEY when switching from Requesty', () => {
+    process.env.REQUESTY_API_KEY = 'requesty-secret'
+    process.env.OPENAI_API_KEY = 'generic-openai-secret'
+    process.env.OPENAI_BASE_URL = 'https://router.requesty.ai/v1'
+
+    const result = applyProviderFlag('openrouter', [])
+
+    expect(result.error).toBeUndefined()
+    expect(process.env.OPENAI_BASE_URL).toBe('https://openrouter.ai/api/v1')
+    expect(process.env.OPENAI_API_KEY).toBe('generic-openai-secret')
+  })
+
   test('Command Code clears stale custom auth only on its canonical endpoint', () => {
     process.env.CMD_API_KEY = 'cmd-key'
     process.env.OPENAI_API_FORMAT = 'responses'
diff --git a/src/utils/providerFlag.ts b/src/utils/providerFlag.ts
index 364617369..e57318361 100644
--- a/src/utils/providerFlag.ts
+++ b/src/utils/providerFlag.ts
@@ -485,6 +485,9 @@ export function applyProviderFlag(
                         : process.env.OPENAI_API_KEY !== undefined &&
                           process.env.OPENAI_API_KEY === process.env.LLMTR_API_KEY
                         ? 'llmtr'
+                        : process.env.OPENAI_API_KEY !== undefined &&
+                          process.env.OPENAI_API_KEY === process.env.REQUESTY_API_KEY
+                        ? 'requesty'
                         : process.env.OPENAI_API_KEY !== undefined &&
                           process.env.OPENAI_API_KEY === process.env.MERGE_GATEWAY_API_KEY
                         ? 'merge-gateway'