From c8e506c383f4e834fc1a568bab67db26b70f04ce Mon Sep 17 00:00:00 2001
From: Austin Pickett <pickett.austin@gmail.com>
Date: Thu, 30 Apr 2026 23:11:28 -0400
Subject: [PATCH] fix(tui): address code review feedback on model picker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Reset keySaving on back() to prevent blocked key entry after Esc
- Show '(needs setup)' for non-API-key auth providers instead of
  generic '(no key)'
- Set is_current correctly for unauthenticated providers that happen
  to be the active session provider
- Guard model.save_key with is_managed() check — return error on
  managed installs where .env is read-only
---
 tui_gateway/server.py                 | 7 +++++--
 ui-tui/src/components/modelPicker.tsx | 5 ++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/tui_gateway/server.py b/tui_gateway/server.py
index 0582b745dc..3e7176f9f0 100644
--- a/tui_gateway/server.py
+++ b/tui_gateway/server.py
@@ -4758,7 +4758,7 @@ def _(rid, params: dict) -> dict:
             authenticated.append({
                 "slug": entry.slug,
                 "name": _PROVIDER_LABELS.get(entry.slug, entry.label),
-                "is_current": False,
+                "is_current": entry.slug == current_provider,
                 "is_user_defined": False,
                 "models": [],
                 "total_models": 0,
@@ -4794,7 +4794,7 @@ def _(rid, params: dict) -> dict:
     """
     try:
         from hermes_cli.auth import PROVIDER_REGISTRY
-        from hermes_cli.config import save_env_value
+        from hermes_cli.config import is_managed, save_env_value
         from hermes_cli.model_switch import list_authenticated_providers
 
         slug = (params.get("slug") or "").strip()
@@ -4802,6 +4802,9 @@ def _(rid, params: dict) -> dict:
         if not slug or not api_key:
             return _err(rid, 4001, "slug and api_key are required")
 
+        if is_managed():
+            return _err(rid, 4006, "managed install — credentials are read-only")
+
         pconfig = PROVIDER_REGISTRY.get(slug)
         if not pconfig:
             return _err(rid, 4002, f"unknown provider: {slug}")
diff --git a/ui-tui/src/components/modelPicker.tsx b/ui-tui/src/components/modelPicker.tsx
index ea999e55e2..2b3fec0384 100644
--- a/ui-tui/src/components/modelPicker.tsx
+++ b/ui-tui/src/components/modelPicker.tsx
@@ -78,6 +78,7 @@ export function ModelPicker({ gw, onCancel, onSelect, sessionId, t }: ModelPicke
       setModelIdx(0)
       setKeyInput('')
       setKeyError('')
+      setKeySaving(false)
 
       return
     }
@@ -383,7 +384,9 @@ export function ModelPicker({ gw, onCancel, onSelect, sessionId, t }: ModelPicke
       (p, i) => {
         const authMark = p.authenticated === false ? '○' : p.is_current ? '*' : '●'
         const modelCount = p.total_models ?? p.models?.length ?? 0
-        const suffix = p.authenticated === false ? '(no key)' : `${modelCount} models`
+        const suffix = p.authenticated === false
+          ? (p.auth_type === 'api_key' ? '(no key)' : '(needs setup)')
+          : `${modelCount} models`
 
         return `${authMark} ${names[i]} · ${suffix}`
       }