fix: harden persisted auth and terminal editing

Author: yjw

CHANGELOG.md

@@ -9,13 +9,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 - `young chat` now auto-uses the existing `reach` bridge for explicit finance/news lookup requests, but only feeds compact evidence excerpts to the model instead of exposing raw search captures in the terminal.
-- `young chat` input now uses a fixed `young ` prompt prefix so line editing no longer eats the visible prompt label.
+- `young chat` input now uses `prompt_toolkit` with a fixed, non-editable `young ` prompt prefix for reliable backspace and cursor movement on macOS terminals.
 - Help text now makes the command boundary clearer: `young daily --llm` is the strict stock-analysis M1-M6 Markdown replay, `young replay` is only a deprecated alias, and `young report` is PDF export only.
 
 ### Fixed
 - Fixed chat search flows that previously surfaced raw `/reach` output or still nudged users to run `/reach` manually instead of returning a summarized answer directly.
 - Hardened LLM replay prompts so `young daily --llm` stays on the stock-analysis six-module framework and does not drift into persona-style investment templates.
 - Fixed LLM config persistence so `young config llm --api-key-env ...` also stores a local fallback key, which keeps `young chat` working across fresh terminal sessions without forcing users to re-export the secret every time.
+- Fixed stale shell environment variables overriding the saved API key after terminal restarts; saved credentials now take precedence and accidental outer quotes or whitespace are normalized.
 
 ## [0.2.8] - 2026-06-19
 

pyproject.toml

@@ -29,6 +29,7 @@ dependencies = [
     "requests>=2.31",
     "rich>=13.0",
     "click>=8.1",
+    "prompt-toolkit>=3.0,<4",
     "weasyprint>=62",
 ]
 

src/young_stock/chat.py

@@ -17,10 +17,10 @@
 from rich.console import Console
 from rich.markdown import Markdown
 
-try:  # ponytail: best-effort line editing on local terminals; falls back harmlessly if unavailable.
-    import readline  # noqa: F401
-except Exception:  # pragma: no cover - platform dependent
-    readline = None
+try:  # pragma: no cover - optional dependency may be absent in some envs.
+    from prompt_toolkit import prompt as _prompt_toolkit_prompt
+except Exception:  # pragma: no cover - dependency missing or broken
+    _prompt_toolkit_prompt = None
 
 try:  # pragma: no cover - import path differs across Python builds
     from zoneinfo import ZoneInfo
@@ -297,6 +297,17 @@ def _current_time_system_note() -> str:
     )
 
 
+def _read_chat_input(prompt_text: str = "young ") -> str:
+    if callable(_prompt_toolkit_prompt):
+        try:
+            return _prompt_toolkit_prompt(prompt_text)
+        except (EOFError, KeyboardInterrupt):
+            raise
+        except Exception:
+            pass
+    return builtins.input(prompt_text)
+
+
 def _is_time_query(text: str) -> bool:
     stripped = text.strip()
     if not stripped or stripped.startswith("/"):
@@ -788,7 +799,7 @@ def run_chat() -> None:
     )
     while True:
         try:
-            text = builtins.input("young ").strip()
+            text = _read_chat_input().strip()
         except (EOFError, KeyboardInterrupt):
             console.print("\n再见。")
             return

src/young_stock/config.py

@@ -24,6 +24,13 @@ def config_path() -> Path:
     return young_home() / "config.json"
 
 
+def normalize_api_key(value: Any) -> str:
+    text = str(value or "").strip()
+    if len(text) >= 2 and text[0] == text[-1] and text[0] in {'"', "'"}:
+        text = text[1:-1].strip()
+    return text
+
+
 def _with_defaults(data: dict[str, Any] | None) -> dict[str, Any]:
     result = copy.deepcopy(DEFAULT_CONFIG)
     if not isinstance(data, dict):
@@ -91,10 +98,19 @@ def update_llm_config(**values: Any) -> dict[str, Any]:
     if env_name and values.get("api_key") is None:
         resolved = os.environ.get(env_name)
         if resolved:
-            values["api_key"] = resolved
+            values["api_key"] = normalize_api_key(resolved)
     for key, value in values.items():
         if value is not None:
-            llm[key] = value
+            if key == "api_key":
+                normalized = normalize_api_key(value)
+                if normalized:
+                    llm[key] = normalized
+            elif key == "api_key_env":
+                env_value = str(value).strip()
+                if env_value:
+                    llm[key] = env_value
+            else:
+                llm[key] = value
     return save_config(config)
 
 

src/young_stock/llm.py

@@ -9,6 +9,8 @@
 
 import requests
 
+from .config import normalize_api_key
+
 PROVIDER_BASES = {
     "openai": "https://api.openai.com/v1",
     "ark": "https://ark.cn-beijing.volces.com/api/v3",
@@ -84,10 +86,13 @@ def list_models(self) -> list[str]:
         return sorted(dict.fromkeys(models))
 
     def _api_key(self) -> str:
-        env_name = str(self.config.get("api_key_env") or "")
+        saved = normalize_api_key(self.config.get("api_key"))
+        if saved:
+            return saved
+        env_name = str(self.config.get("api_key_env") or "").strip()
         if env_name and os.environ.get(env_name):
-            return str(os.environ[env_name])
-        return str(self.config.get("api_key") or "")
+            return normalize_api_key(os.environ[env_name])
+        return ""
 
     def _post(self, url: str, **kwargs: Any) -> Any:
         timeout = float(self.config.get("timeout") or 60)

tests/test_chat.py

@@ -337,6 +337,7 @@ def test_run_chat_banner_shows_style_options(monkeypatch, tmp_path, capsys):
     def raise_eof(*args, **kwargs):
         raise EOFError
 
+    monkeypatch.setattr(chat_module, "_prompt_toolkit_prompt", None)
     monkeypatch.setattr("builtins.input", raise_eof)
 
     run_chat()
@@ -349,14 +350,30 @@ def raise_eof(*args, **kwargs):
     assert "对话风格、自称口吻和分析框架" in captured
 
 
-def test_run_chat_uses_fixed_plain_prompt(monkeypatch, tmp_path):
+def test_run_chat_uses_prompt_toolkit_with_fixed_prompt(monkeypatch, tmp_path):
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+    prompts = []
+
+    def fake_prompt(prompt):
+        prompts.append(prompt)
+        raise EOFError
+
+    monkeypatch.setattr(chat_module, "_prompt_toolkit_prompt", fake_prompt)
+
+    run_chat()
+
+    assert prompts == ["young "]
+
+
+def test_run_chat_falls_back_to_builtins_input_when_prompt_toolkit_unavailable(monkeypatch, tmp_path):
     monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
     prompts = []
 
     def fake_input(prompt):
         prompts.append(prompt)
         raise EOFError
 
+    monkeypatch.setattr(chat_module, "_prompt_toolkit_prompt", None)
     monkeypatch.setattr("builtins.input", fake_input)
 
     run_chat()

tests/test_cli.py

@@ -725,6 +725,53 @@ def test_cli_config_llm_with_api_key_env_persists_fallback(monkeypatch, tmp_path
     assert config["llm"]["api_key"] == "env-secret"
 
 
+def test_cli_config_llm_uses_saved_key_after_env_changes(monkeypatch, tmp_path):
+    from click.testing import CliRunner
+
+    from young_stock.llm import LLMClient
+
+    class FakeSession:
+        def __init__(self, responses):
+            self.responses = list(responses)
+            self.calls = []
+
+        def post(self, url, **kwargs):
+            self.calls.append((url, kwargs))
+            return self.responses.pop(0)
+
+    def response(status, payload):
+        return SimpleNamespace(status_code=status, json=lambda: payload, text=str(payload), headers={})
+
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+    monkeypatch.setenv("MODEL_KEY", "  'saved-secret'  ")
+    runner = CliRunner()
+
+    saved = runner.invoke(
+        cli,
+        [
+            "config",
+            "llm",
+            "--provider",
+            "deepseek",
+            "--model",
+            "deepseek-chat",
+            "--api-key-env",
+            "MODEL_KEY",
+        ],
+    )
+    assert saved.exit_code == 0
+
+    monkeypatch.setenv("MODEL_KEY", "wrong-secret")
+    client = LLMClient(
+        json.loads((tmp_path / "config.json").read_text(encoding="utf-8"))["llm"],
+        session=FakeSession([response(200, {"choices": [{"message": {"content": "ok"}}]})]),
+    )
+
+    client.chat([{"role": "user", "content": "hi"}])
+
+    assert client.session.calls[0][1]["headers"]["Authorization"] == "Bearer saved-secret"
+
+
 def test_cli_config_channel_add_persists_app_delivery_fields(monkeypatch, tmp_path):
     from click.testing import CliRunner
 

tests/test_config.py

@@ -30,7 +30,7 @@ def test_config_round_trip_uses_young_home(monkeypatch, tmp_path):
 
 def test_config_persists_api_key_env_fallback(monkeypatch, tmp_path):
     monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
-    monkeypatch.setenv("MODEL_KEY", "env-secret")
+    monkeypatch.setenv("MODEL_KEY", '  "env-secret"  ')
 
     config = update_llm_config(
         provider="deepseek",
@@ -43,6 +43,20 @@ def test_config_persists_api_key_env_fallback(monkeypatch, tmp_path):
     assert load_config()["llm"]["api_key"] == "env-secret"
 
 
+def test_config_normalizes_direct_api_key_before_persisting(monkeypatch, tmp_path):
+    monkeypatch.setenv("YOUNG_STOCK_HOME", str(tmp_path))
+
+    config = update_llm_config(
+        provider="deepseek",
+        model="deepseek-chat",
+        api_key='  "secret-value"  ',
+        api_base="https://api.deepseek.com",
+    )
+
+    assert config["llm"]["api_key"] == "secret-value"
+    assert load_config()["llm"]["api_key"] == "secret-value"
+
+
 def test_config_masks_secrets_and_webhook_tokens():
     masked = mask_config(
         {

tests/test_llm.py

@@ -88,22 +88,22 @@ def test_anthropic_provider_maps_response():
     assert result.content == "谨慎看多"
 
 
-def test_api_key_env_takes_precedence(monkeypatch):
+def test_saved_api_key_takes_precedence_over_env(monkeypatch):
     monkeypatch.setenv("MODEL_KEY", "env-secret")
     session = FakeSession([response(200, {"choices": [{"message": {"content": "ok"}}]})])
     client = LLMClient(
         {
             "provider": "openai",
             "model": "gpt-test",
-            "api_key": "inline-secret",
+            "api_key": '  "saved-secret"  ',
             "api_key_env": "MODEL_KEY",
         },
         session=session,
     )
 
     client.chat([{"role": "user", "content": "hi"}])
 
-    assert session.calls[0][1]["headers"]["Authorization"] == "Bearer env-secret"
+    assert session.calls[0][1]["headers"]["Authorization"] == "Bearer saved-secret"
 
 
 def test_api_key_falls_back_to_saved_secret_when_env_missing(monkeypatch):
@@ -124,6 +124,23 @@ def test_api_key_falls_back_to_saved_secret_when_env_missing(monkeypatch):
     assert session.calls[0][1]["headers"]["Authorization"] == "Bearer saved-secret"
 
 
+def test_api_key_env_falls_back_when_saved_secret_missing(monkeypatch):
+    monkeypatch.setenv("MODEL_KEY", "  'env-secret'  ")
+    session = FakeSession([response(200, {"choices": [{"message": {"content": "ok"}}]})])
+    client = LLMClient(
+        {
+            "provider": "openai",
+            "model": "gpt-test",
+            "api_key_env": "MODEL_KEY",
+        },
+        session=session,
+    )
+
+    client.chat([{"role": "user", "content": "hi"}])
+
+    assert session.calls[0][1]["headers"]["Authorization"] == "Bearer env-secret"
+
+
 def test_openai_compatible_model_discovery():
     session = FakeSession(
         [