fix: persist llm config across terminal restarts

Author: yjw

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Fixed chat search flows that previously surfaced raw `/reach` output or still nudged users to run `/reach` manually instead of returning a summarized answer directly.
 - Hardened LLM replay prompts so `young daily --llm` stays on the stock-analysis six-module framework and does not drift into persona-style investment templates.
+- Fixed LLM config persistence so `young config llm --api-key-env ...` also stores a local fallback key, which keeps `young chat` working across fresh terminal sessions without forcing users to re-export the secret every time.
 
 ## [0.2.8] - 2026-06-19
 

src/young_stock/config.py

@@ -87,6 +87,11 @@ def save_config(data: dict[str, Any]) -> dict[str, Any]:
 def update_llm_config(**values: Any) -> dict[str, Any]:
     config = load_config(strict=False)
     llm = config.setdefault("llm", {})
+    env_name = str(values.get("api_key_env") or "").strip()
+    if env_name and values.get("api_key") is None:
+        resolved = os.environ.get(env_name)
+        if resolved:
+            values["api_key"] = resolved
     for key, value in values.items():
         if value is not None:
             llm[key] = value

tests/test_cli.py

@@ -659,6 +659,106 @@ def test_cli_config_llm_saves_and_masks_secret(monkeypatch, tmp_path):
     assert "deepseek-chat" in shown.output
 
 
+def test_cli_config_llm_persists_all_core_fields(monkeypatch, tmp_path):
+    from click.testing import CliRunner
+
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+    monkeypatch.setenv("MODEL_KEY", "env-secret")
+    runner = CliRunner()
+
+    result = runner.invoke(
+        cli,
+        [
+            "config",
+            "llm",
+            "--provider",
+            "deepseek",
+            "--model",
+            "deepseek-chat",
+            "--api-key-env",
+            "MODEL_KEY",
+            "--api-base",
+            "https://api.deepseek.com",
+            "--timeout",
+            "45",
+            "--max-tokens",
+            "8192",
+        ],
+    )
+
+    assert result.exit_code == 0
+    config = json.loads((tmp_path / "config.json").read_text(encoding="utf-8"))
+    llm = config["llm"]
+    assert llm["provider"] == "deepseek"
+    assert llm["model"] == "deepseek-chat"
+    assert llm["api_key_env"] == "MODEL_KEY"
+    assert llm["api_key"] == "env-secret"
+    assert llm["api_base"] == "https://api.deepseek.com"
+    assert llm["timeout"] == 45
+    assert llm["max_tokens"] == 8192
+
+
+def test_cli_config_llm_with_api_key_env_persists_fallback(monkeypatch, tmp_path):
+    from click.testing import CliRunner
+
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+    monkeypatch.setenv("MODEL_KEY", "env-secret")
+    runner = CliRunner()
+
+    saved = runner.invoke(
+        cli,
+        [
+            "config",
+            "llm",
+            "--provider",
+            "deepseek",
+            "--model",
+            "deepseek-chat",
+            "--api-key-env",
+            "MODEL_KEY",
+        ],
+    )
+
+    assert saved.exit_code == 0
+    config = json.loads((tmp_path / "config.json").read_text(encoding="utf-8"))
+    assert config["llm"]["api_key_env"] == "MODEL_KEY"
+    assert config["llm"]["api_key"] == "env-secret"
+
+
+def test_cli_config_channel_add_persists_app_delivery_fields(monkeypatch, tmp_path):
+    from click.testing import CliRunner
+
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+    runner = CliRunner()
+
+    result = runner.invoke(
+        cli,
+        [
+            "config",
+            "channel",
+            "add",
+            "feishu",
+            "work",
+            "--app-id",
+            "cli_a1",
+            "--app-secret",
+            "secret-123",
+            "--receive-id",
+            "oc_test_chat",
+            "--receive-id-type",
+            "chat_id",
+        ],
+    )
+
+    assert result.exit_code == 0
+    config = json.loads((tmp_path / "config.json").read_text(encoding="utf-8"))
+    channel = config["channels"]["feishu"]["work"]
+    assert channel["app_id"] == "cli_a1"
+    assert channel["app_secret"] == "secret-123"
+    assert channel["receive_id"] == "oc_test_chat"
+    assert channel["receive_id_type"] == "chat_id"
+
+
 def test_cli_daily_llm_uses_enhanced_path(monkeypatch, tmp_path):
     from click.testing import CliRunner
 

tests/test_config.py

@@ -28,6 +28,21 @@ def test_config_round_trip_uses_young_home(monkeypatch, tmp_path):
     assert stat.S_IMODE((tmp_path / "config.json").stat().st_mode) & 0o077 == 0
 
 
+def test_config_persists_api_key_env_fallback(monkeypatch, tmp_path):
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+    monkeypatch.setenv("MODEL_KEY", "env-secret")
+
+    config = update_llm_config(
+        provider="deepseek",
+        model="deepseek-chat",
+        api_key_env="MODEL_KEY",
+    )
+
+    assert config["llm"]["api_key_env"] == "MODEL_KEY"
+    assert config["llm"]["api_key"] == "env-secret"
+    assert load_config()["llm"]["api_key"] == "env-secret"
+
+
 def test_config_masks_secrets_and_webhook_tokens():
     masked = mask_config(
         {
@@ -97,3 +112,22 @@ def test_feishu_channel_accepts_preissued_tenant_token(monkeypatch, tmp_path):
     )
 
     assert config["channels"]["feishu"]["token-app"]["tenant_access_token"] == "token"
+
+
+def test_feishu_channel_round_trips_app_credentials(monkeypatch, tmp_path):
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+
+    config = add_feishu_channel(
+        "work",
+        {
+            "app_id": "cli_a1",
+            "app_secret": "secret-123",
+            "receive_id": "oc_test_chat",
+            "receive_id_type": "chat_id",
+        },
+    )
+
+    channel = config["channels"]["feishu"]["work"]
+    assert channel["app_id"] == "cli_a1"
+    assert channel["app_secret"] == "secret-123"
+    assert load_config()["channels"]["feishu"]["work"]["receive_id"] == "oc_test_chat"

tests/test_llm.py

@@ -106,6 +106,24 @@ def test_api_key_env_takes_precedence(monkeypatch):
     assert session.calls[0][1]["headers"]["Authorization"] == "Bearer env-secret"
 
 
+def test_api_key_falls_back_to_saved_secret_when_env_missing(monkeypatch):
+    monkeypatch.delenv("MODEL_KEY", raising=False)
+    session = FakeSession([response(200, {"choices": [{"message": {"content": "ok"}}]})])
+    client = LLMClient(
+        {
+            "provider": "openai",
+            "model": "gpt-test",
+            "api_key": "saved-secret",
+            "api_key_env": "MODEL_KEY",
+        },
+        session=session,
+    )
+
+    client.chat([{"role": "user", "content": "hi"}])
+
+    assert session.calls[0][1]["headers"]["Authorization"] == "Bearer saved-secret"
+
+
 def test_openai_compatible_model_discovery():
     session = FakeSession(
         [