Q169: saved cloud and custom endpoints refill their form and keep the saved key

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/e2e/desktop.spec.ts

@@ -212,6 +212,22 @@ test("onboards, hires, and creates work in the Electron shell", async () => {
     await changeModel(() => "gpt-5.4");
     await expect(page.getByText("gpt-5.4 · API key").first()).toBeVisible();
 
+    // A saved custom endpoint reopens with its address filled in, and a blank key keeps the saved one.
+    await page.locator("div", { hasText: /^Custom OpenAI-compatible$/ }).locator("xpath=../..").getByRole("button", { name: "Connect" }).click();
+    await page.locator(".modal input[name=cloudBaseUrl]").fill("http://localhost:11434/v1");
+    await page.locator(".modal input[name=secret]").fill("local-key");
+    await page.locator(".modal [name=model]").fill("llama3");
+    await page.locator(".modal").getByRole("button", { name: "Save" }).click();
+    const customRow = page.locator(".reveal-row", { hasText: "Custom OpenAI-compatible" });
+    await customRow.getByRole("button", { name: "Manage" }).click();
+    await expect(page.locator(".modal input[name=cloudBaseUrl]")).toHaveValue("http://localhost:11434/v1");
+    await expect(page.locator(".modal input[name=secret]")).toHaveAttribute("placeholder", "Saved. Leave blank to keep it.");
+    await page.locator(".modal [name=model]").fill("llama3.1");
+    await page.locator(".modal").getByRole("button", { name: "Save" }).click();
+    await expect(customRow.getByText("llama3.1 · Cloud")).toBeVisible();
+    await customRow.getByRole("button", { name: "Disconnect" }).click();
+    await expect(customRow).toHaveCount(0);
+
     // Skills are built-in now: no Skills tab exists, yet the bundled
     // catalogue imported itself during onboarding.
     await expect(page.getByRole("button", { name: "Skills" })).toHaveCount(0);

tests/unit/provider-endpoint.test.ts

@@ -0,0 +1,37 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { DatabaseConnection } from "../../src/main/database/connection";
+import { OrganizationService } from "../../src/main/services/organization-service";
+import { ProviderService } from "../../src/main/services/provider-service";
+import { providerAdapters } from "../../src/main/services/provider-adapters";
+import { AuthBrokerService } from "../../src/main/services/auth-broker-service";
+import { loadCredential, type ProviderRow } from "../../src/main/services/provider-internal";
+
+const vault = { encryptSecret: (secret: string) => Buffer.from(secret, "utf8"), decryptSecret: (ciphertext: Buffer) => ciphertext.toString("utf8") };
+
+describe("a saved cloud endpoint", () => {
+  test("refills its form without the key, and a blank key keeps the saved one", () => {
+    const connection = new DatabaseConnection(join(tmpdir(), `ac-endpoint-${randomUUID()}.db`));
+    const db = connection.db;
+    const providers = new ProviderService(db, providerAdapters, vault);
+    let orgId = "";
+    connection.transaction(() => {
+      orgId = new OrganizationService(db).createOrganization({ organizationName: "Acme", employeeName: "Dana", mission: "m", goal: "g" });
+    });
+    const azure = (db.prepare("select id from providers where org_id = ? and provider_key = 'azure-openai'").get(orgId) as { id: string }).id;
+    const storedSecret = () => JSON.parse(loadCredential(new AuthBrokerService(db, vault), orgId, db.prepare("select * from providers where id = ?").get(azure) as unknown as ProviderRow).secret) as Record<string, unknown>;
+
+    expect(providers.endpoint(orgId, azure)).toBeNull();
+    const keep = (deployment: string) => JSON.stringify({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment, secret: "", keepSavedSecret: true });
+    expect(() => providers.saveCredential({ orgId, providerId: azure, secret: keep("d1"), model: "d1" })).toThrow("There is no saved key to keep; enter the key.");
+
+    providers.saveCredential({ orgId, providerId: azure, secret: JSON.stringify({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment: "d1", secret: "az-key" }), model: "d1" });
+    expect(providers.endpoint(orgId, azure)).toEqual({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment: "d1" });
+
+    providers.saveCredential({ orgId, providerId: azure, secret: keep("d2"), model: "d2" });
+    expect(providers.endpoint(orgId, azure)?.deployment).toBe("d2");
+    expect(storedSecret()).toEqual({ baseUrl: "https://acme.openai.azure.com", region: "", projectId: "", deployment: "d2", secret: "az-key" });
+  });
+});