[Gaebabi]

Problem and result

Provider settings were presented as one long form, save feedback hid a disconnected state, and switching providers or finishing an operation cleared key fields. The editor now uses two steps: connection details, then Connect/Restart. Optional model IDs and advanced controls are collapsed.

• Restore the selected provider and encrypted drafts after provider changes, errors and close/reopen. Saved values remain available without retyping.
• Show saved keys masked, with explicit eye, copy, reload and reuse actions. Viewing/copying a key does not authorize sending it to a changed destination; an explicitly cleared key is not silently restored.
• Keep the existing guarded restart flow. Nothing restarts merely because settings were loaded or saved.
• Preserve the native OpenAI provider identity with an explicit private combined model catalogue. Bounded hashed native-request receipts prevent client retries from multiplying upstream inference.

Related: #138. Existing router-pinned connections and account data are preserved; the broader external-provider and actual Codex-picker acceptance remains separate.

Validation

• 255 provider/editor/gateway checks passed, including the actual installed Codex CLI 0.167.0-alpha.3.2 against fictional upstreams.
• 116 production WPF component checks, 350 account/recovery checks and 42 language API checks passed.
• Windows and shared desktop builds, all 9 language catalogues, repository/link checks and the public-tree privacy audit passed.
• No owner installation replacement, live Codex restart, account switch or binary release. Screenshots below are offscreen production components with fictional data, not native Codex-picker evidence.

Screens

Korean component evidence.

[Gaebabi]

Author self-review of e3644b4 (not an independent approval). Reviewed the provider connection/catalog path, bounded turn-request receipts, encrypted editor draft/key semantics, both desktop editors, localization and the full final diff. Saved credentials stay protected and viewing/copying a key does not authorize a changed destination. No account/provider data, owner captures, dependencies or workflow changes are included.

The latest six required contexts pass on the current main base. Local verification passed 255 provider/editor/native CLI contracts, 350 account/recovery checks, 116 WPF component checks and 42 localization API checks; the Windows and shared builds pass. The attached application-component images are fictional offscreen renders. Owner desktop model-picker/provider inference acceptance and the broader issue #138 remain separate. The owner explicitly authorized merge after CI and a local Switch update while preserving live Codex work.