From 6c68f1d3c74d68f3642dd9a19ab9a686611cfeb3 Mon Sep 17 00:00:00 2001
From: Siddhesh Sonar <67579112+Siddhesh2377@users.noreply.github.com>
Date: Sun, 13 Sep 2026 22:48:23 +0530
Subject: [PATCH 1/2] ide: name the chat model for AI Assistant, and stop
 refusing the editor at the proxy

---
 src/ide/jetbrains_profile.cpp          | 507 +++++++++++++++++----
 src/ide/jetbrains_profile.h            |  30 +-
 src/ide/openai_proxy.cpp               | 121 ++++-
 src/ide/openai_proxy.h                 |   7 +-
 tests/CMakeLists.txt                   |  13 +
 tests/test_wally_ide_proxy_auth.cpp    | 489 ++++++++++++++++++++
 tests/test_wally_jetbrains_profile.cpp | 591 +++++++++++++++++++++++++
 7 files changed, 1628 insertions(+), 130 deletions(-)
 create mode 100644 tests/test_wally_ide_proxy_auth.cpp
 create mode 100644 tests/test_wally_jetbrains_profile.cpp

diff --git a/src/ide/jetbrains_profile.cpp b/src/ide/jetbrains_profile.cpp
index eb66d8ee..2821518a 100644
--- a/src/ide/jetbrains_profile.cpp
+++ b/src/ide/jetbrains_profile.cpp
@@ -3,6 +3,8 @@
 #include <algorithm>
 #include <cstdlib>
 #include <filesystem>
+#include <cctype>
+#include <cstring>
 #include <fstream>
 #include <string>
 #include <vector>
@@ -30,7 +32,6 @@ constexpr const char* kSettingsFile = "llm.provider.openai.like.xml";
 constexpr const char* kComponent = "OpenAILikeLlmProviderSettings";
 /// The provider selection, behind `@State(name = "LlmCustomModelsSettings")`.
 constexpr const char* kModelsFile = "llm.custom.models.xml";
-constexpr const char* kModelsComponent = "LlmCustomModelsSettings";
 /// The set of providers the IDE will talk to at all.
 constexpr const char* kProvidersFile = "llm.third.party.ai.providers.xml";
 constexpr const char* kProvidersComponent = "LLMThirdPartyAIProvidersSettings";
@@ -41,6 +42,16 @@ constexpr const char* kAcknowledgementKey =
     "llm.third.party.ai.services.acknowledgement.accepted";
 /// Application properties, kept as a JSON blob inside a CDATA section.
 constexpr const char* kPropertiesFile = "other.xml";
+
+/// AI Assistant's own settings, which is where Chat mode reads its model from.
+///
+/// Separate from the provider files on purpose: the provider list decides which
+/// endpoints the IDE may talk to, and this decides which model each feature
+/// uses. A configured provider whose model is not named here leaves Chat mode
+/// with "No compatible model is available", while the picker still lists the
+/// model, because the picker reads the provider and Chat mode reads this.
+constexpr const char* kChatFile = "llm.for.code.xml";
+constexpr const char* kChatComponent = "LLMSettings";
 /// `OPEN_AI_API_PROVIDER_ID`, which is also the credential's key.
 constexpr const char* kProviderID = "OpenAIAPI";
 /// The subsystem the platform prefixes credentials with.
@@ -85,21 +96,7 @@ std::string SettingsXML(const std::string& base_url) {
            "  </component>\n</application>\n";
 }
 
-/// Which model each of the IDE's three roles should use.
-///
-/// One model answers all three because that is what wally is serving. The id is
-/// `<providerId>/<model>`, the separator being `ThirdPartyLLMProfileId.DELIM`.
-std::string ModelsXML(const std::string& model) {
-    const std::string id = std::string(kProviderID) + "/" + model;
-    return std::string("<application>\n  <component name=\"") + kModelsComponent + "\">\n" +
-           "    <option name=\"isEnabled\" value=\"true\" />\n" +
-           "    <option name=\"defaultModelId\" value=\"" + id + "\" />\n" +
-           "    <option name=\"fastModelId\" value=\"" + id + "\" />\n" +
-           "    <option name=\"editorModelId\" value=\"" + id + "\" />\n" +
-           "  </component>\n</application>\n";
-}
 
-/// The one provider the IDE is allowed to talk to.
 ///
 /// The members are nested directly, with no element naming the collection.
 /// A `<set>` wrapper — the shape most IntelliJ collections serialize to — is
@@ -111,6 +108,319 @@ std::string ProvidersXML() {
            "    </option>\n  </component>\n</application>\n";
 }
 
+std::string ReadFile(const fs::path& path);
+
+/// Where a run of markup sits in a document.
+struct Span {
+    std::size_t start = 0;
+    std::size_t end = 0;
+};
+
+/// One start tag, as written.
+struct Tag {
+    Span span;                  ///< `<` through `>`, inclusive of both.
+    std::string name;           ///< The element name.
+    std::string attribute;      ///< The value of the attribute asked for, if present.
+    bool has_attribute = false;
+    bool self_closing = false;
+    bool closing = false;       ///< A `</name>` tag.
+};
+
+/// Past the end of a comment, CDATA section, doctype or processing instruction
+/// beginning at `at`, or npos when `at` does not begin one.
+///
+/// These are skipped rather than searched, which is the whole reason this file
+/// scans rather than pattern-matches. A commented-out `<option name="...">` or
+/// one quoted inside CDATA is text belonging to the reader, and deleting
+/// through it destroys their file while looking like it worked.
+std::size_t SkipNonMarkup(const std::string& document, std::size_t at) {
+    static constexpr struct {
+        const char* open;
+        const char* close;
+    } kRegions[] = {
+        {"<!--", "-->"},
+        {"<![CDATA[", "]]>"},
+        {"<?", "?>"},
+    };
+    for (const auto& region : kRegions) {
+        const std::size_t open = std::strlen(region.open);
+        if (document.compare(at, open, region.open) == 0) {
+            const std::size_t close = document.find(region.close, at + open);
+            if (close == std::string::npos) {
+                return std::string::npos;  // Unterminated: refuse the document.
+            }
+            return close + std::strlen(region.close);
+        }
+    }
+    // `<!DOCTYPE ...>` and friends: any other `<!` declaration ends at its `>`.
+    if (document.compare(at, 2, "<!") == 0) {
+        const std::size_t close = document.find('>', at);
+        return close == std::string::npos ? std::string::npos : close + 1;
+    }
+    return std::string::npos;
+}
+
+bool IsNameCharacter(unsigned char character) {
+    return std::isalnum(character) != 0 || character == '_' || character == '-' ||
+           character == ':' || character == '.';
+}
+
+/// Reads the tag beginning at `document[at]`, which must be `<` and must not
+/// begin a comment or CDATA section. `wanted` names the attribute whose value
+/// is returned, if the tag carries it.
+///
+/// Returns false on anything it cannot read exactly, which the caller turns
+/// into a refusal. Attribute order, surrounding whitespace and either quote
+/// style are all accepted, because all three are legal and the IDE is not the
+/// only thing that writes these files.
+bool ReadTag(const std::string& document, std::size_t at, const std::string& wanted, Tag* tag) {
+    if (at >= document.size() || document[at] != '<') {
+        return false;
+    }
+    *tag = Tag{};
+    tag->span.start = at;
+    std::size_t index = at + 1;
+    if (index < document.size() && document[index] == '/') {
+        tag->closing = true;
+        ++index;
+    }
+    const std::size_t name_start = index;
+    while (index < document.size() && IsNameCharacter(static_cast<unsigned char>(document[index]))) {
+        ++index;
+    }
+    if (index == name_start) {
+        return false;
+    }
+    tag->name = document.substr(name_start, index - name_start);
+
+    while (index < document.size()) {
+        while (index < document.size() &&
+               std::isspace(static_cast<unsigned char>(document[index])) != 0) {
+            ++index;
+        }
+        if (index >= document.size()) {
+            return false;
+        }
+        if (document[index] == '/') {
+            tag->self_closing = true;
+            ++index;
+            if (index >= document.size() || document[index] != '>') {
+                return false;
+            }
+        }
+        if (document[index] == '>') {
+            tag->span.end = index;
+            return true;
+        }
+        const std::size_t attribute_start = index;
+        while (index < document.size() &&
+               IsNameCharacter(static_cast<unsigned char>(document[index]))) {
+            ++index;
+        }
+        if (index == attribute_start) {
+            return false;  // Not a name, not `/`, not `>`: unreadable.
+        }
+        const std::string attribute = document.substr(attribute_start, index - attribute_start);
+        while (index < document.size() &&
+               std::isspace(static_cast<unsigned char>(document[index])) != 0) {
+            ++index;
+        }
+        if (index >= document.size() || document[index] != '=') {
+            return false;  // A valueless attribute is HTML, not XML.
+        }
+        ++index;
+        while (index < document.size() &&
+               std::isspace(static_cast<unsigned char>(document[index])) != 0) {
+            ++index;
+        }
+        if (index >= document.size() || (document[index] != '"' && document[index] != '\'')) {
+            return false;
+        }
+        const char quote = document[index];
+        const std::size_t value_start = ++index;
+        // A quoted value may hold `>` legally, which is why the end of a tag
+        // cannot be found by searching for that character.
+        const std::size_t value_end = document.find(quote, value_start);
+        if (value_end == std::string::npos) {
+            return false;
+        }
+        if (attribute == wanted) {
+            tag->attribute = document.substr(value_start, value_end - value_start);
+            tag->has_attribute = true;
+        }
+        index = value_end + 1;
+    }
+    return false;
+}
+
+/// The body of the first `<element attribute="value">` at the top level, as a
+/// span between its start and end tags.
+///
+/// `found` is false when the document simply has no such element, which is an
+/// ordinary case. A false return means the document could not be read and must
+/// be left alone.
+bool FindElementBody(const std::string& document, const std::string& element,
+                     const std::string& attribute, const std::string& value, bool* found,
+                     Span* body, Span* whole) {
+    *found = false;
+    int depth = 0;
+    std::size_t index = 0;
+    bool inside = false;
+    while (index < document.size()) {
+        const std::size_t open = document.find('<', index);
+        if (open == std::string::npos) {
+            break;
+        }
+        const std::size_t skipped = SkipNonMarkup(document, open);
+        if (skipped != std::string::npos) {
+            index = skipped;
+            continue;
+        }
+        if (document.compare(open, 2, "<!") == 0) {
+            return false;  // An unterminated declaration.
+        }
+        Tag tag;
+        if (!ReadTag(document, open, attribute, &tag)) {
+            return false;
+        }
+        index = tag.span.end + 1;
+        if (!inside) {
+            if (!tag.closing && !tag.self_closing && tag.name == element && tag.has_attribute &&
+                tag.attribute == value) {
+                inside = true;
+                depth = 1;
+                whole->start = tag.span.start;
+                body->start = tag.span.end + 1;
+            }
+            continue;
+        }
+        // Inside the element: count nested elements of the same name so the
+        // matching close is the element's own, not a child's.
+        if (tag.name == element) {
+            if (tag.closing) {
+                --depth;
+                if (depth == 0) {
+                    body->end = tag.span.start;
+                    whole->end = tag.span.end + 1;
+                    *found = true;
+                    return true;
+                }
+            } else if (!tag.self_closing) {
+                ++depth;
+            }
+        }
+    }
+    return !inside;  // An element that never closed is a document we cannot read.
+}
+
+/// Past the end of the element whose start tag is `tag`, or npos when its
+/// closing tag cannot be found.
+///
+/// Elements are skipped whole rather than walked into: the children of another
+/// setting belong to that setting, and an option of our own name nested inside
+/// one is its business, not ours.
+std::size_t SkipElement(const std::string& body, const Tag& tag) {
+    if (tag.self_closing || tag.closing) {
+        return tag.span.end + 1;
+    }
+    int depth = 1;
+    std::size_t scan = tag.span.end + 1;
+    while (depth > 0) {
+        const std::size_t next = body.find('<', scan);
+        if (next == std::string::npos) {
+            return std::string::npos;
+        }
+        const std::size_t noise = SkipNonMarkup(body, next);
+        if (noise != std::string::npos) {
+            scan = noise;
+            continue;
+        }
+        Tag inner;
+        if (!ReadTag(body, next, "name", &inner)) {
+            return std::string::npos;
+        }
+        scan = inner.span.end + 1;
+        if (inner.name != tag.name || inner.self_closing) {
+            continue;
+        }
+        depth += inner.closing ? -1 : 1;
+    }
+    return scan;
+}
+
+/// Removes every direct child `<option name="name" …>` from an element body.
+///
+/// Direct children only: an option of the same name nested inside another
+/// option's map belongs to that option, not to us. Returns false when the body
+/// cannot be read.
+bool RemoveChildOptions(std::string* body, const std::string& name) {
+    std::string result;
+    result.reserve(body->size());
+    std::size_t index = 0;
+    std::size_t copied = 0;
+    while (index < body->size()) {
+        const std::size_t open = body->find('<', index);
+        if (open == std::string::npos) {
+            break;
+        }
+        const std::size_t skipped = SkipNonMarkup(*body, open);
+        if (skipped != std::string::npos) {
+            index = skipped;
+            continue;
+        }
+        if (body->compare(open, 2, "<!") == 0) {
+            return false;
+        }
+        Tag tag;
+        if (!ReadTag(*body, open, "name", &tag)) {
+            return false;
+        }
+        if (tag.closing || tag.name != "option" || !tag.has_attribute || tag.attribute != name) {
+            // Past this element entirely, children included.
+            const std::size_t past = SkipElement(*body, tag);
+            if (past == std::string::npos) {
+                return false;
+            }
+            index = past;
+            continue;
+        }
+        const std::size_t element_end = SkipElement(*body, tag);
+        if (element_end == std::string::npos) {
+            return false;
+        }
+        std::size_t end = element_end;
+        // Take the line the option sat on with it, so removing one does not
+        // leave its indentation or a blank line behind.
+        std::size_t line_start = body->rfind('\n', tag.span.start);
+        line_start = line_start == std::string::npos ? 0 : line_start + 1;
+        if (body->find_first_not_of(" \t", line_start) < tag.span.start) {
+            line_start = tag.span.start;  // Something else shares the line; keep it.
+        }
+        while (end < body->size() && (*body)[end] == '\r') {
+            ++end;
+        }
+        if (end < body->size() && (*body)[end] == '\n') {
+            ++end;
+        }
+        result.append(*body, copied, line_start - copied);
+        copied = end;
+        index = end;
+    }
+    result.append(*body, copied, std::string::npos);
+    *body = result;
+    return true;
+}
+
+bool NameChatModel(const fs::path& path, const std::string& model, std::string* error) {
+    std::string document = ReadFile(path);
+    const std::string updated = WithChatModel(document, model);
+    if (updated.empty()) {
+        *error = "cannot read AI Assistant's settings in " + path.string();
+        return false;
+    }
+    return WriteFile(path, updated, error);
+}
+
 std::string ReadFile(const fs::path& path) {
     std::ifstream in(path);
     return in ? std::string(std::istreambuf_iterator<char>(in), std::istreambuf_iterator<char>())
@@ -179,82 +489,12 @@ CFMutableDictionaryRef CopyQuery() {
     return query;
 }
 
-/// An access list naming the two programs allowed to read the item without
-/// asking: this one, which writes it, and the IDE, which reads it.
-///
-/// Without this the item belongs to wally alone, and the IDE's first read pops a
-/// keychain dialog — the one manual step this command exists to remove. The
-/// legacy access APIs are what create such a list, and they are also what the
-/// platform's own `MacOSKeychainStorage` uses, so the item ends up the shape
-/// the IDE already expects.
-CFTypeRef CopyAccess(const std::string& reader) {
-    SecTrustedApplicationRef self = nullptr;
-    SecTrustedApplicationRef other = nullptr;
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-    if (SecTrustedApplicationCreateFromPath(nullptr, &self) != errSecSuccess ||
-        SecTrustedApplicationCreateFromPath(reader.c_str(), &other) != errSecSuccess) {
-        if (self != nullptr) {
-            CFRelease(self);
-        }
-        if (other != nullptr) {
-            CFRelease(other);
-        }
-        return nullptr;
-    }
-    const void* trusted[] = {self, other};
-    CFArrayRef list = CFArrayCreate(nullptr, trusted, 2, &kCFTypeArrayCallBacks);
-    CFStringRef label = CopyString(ServiceName());
-    SecAccessRef access = nullptr;
-    const OSStatus status = SecAccessCreate(label, list, &access);
-#pragma clang diagnostic pop
-    CFRelease(label);
-    CFRelease(list);
-    CFRelease(self);
-    CFRelease(other);
-    return status == errSecSuccess ? access : nullptr;
-}
-
-/// Stores `secret`, replacing whatever was there, readable by `reader` without
-/// a prompt.
-///
-/// Written through the Security framework rather than the `security` tool
-/// because that one takes the secret as an argument, where every other process
-/// on the machine can read it out of the process list.
-bool StoreSecret(const std::string& secret, const std::string& reader, std::string* error) {
-    CFMutableDictionaryRef query = CopyQuery();
-    SecItemDelete(query);
-    CFDataRef data = CFDataCreate(nullptr, reinterpret_cast<const UInt8*>(secret.data()),
-                                  static_cast<CFIndex>(secret.size()));
-    CFDictionarySetValue(query, kSecValueData, data);
-    CFTypeRef access = CopyAccess(reader);
-    if (access != nullptr) {
-        CFDictionarySetValue(query, kSecAttrAccess, access);
-    }
-    const OSStatus status = SecItemAdd(query, nullptr);
-    if (access != nullptr) {
-        CFRelease(access);
-    }
-    CFRelease(data);
-    CFRelease(query);
-    if (status != errSecSuccess) {
-        *error = "cannot store the key in the keychain (OSStatus " + std::to_string(status) + ")";
-        return false;
-    }
-    return true;
-}
-
 void DropSecret() {
     CFMutableDictionaryRef query = CopyQuery();
     SecItemDelete(query);
     CFRelease(query);
 }
 #else
-bool StoreSecret(const std::string&, const std::string&, std::string* error) {
-    *error = "the JetBrains credential store is only wired up on macOS";
-    return false;
-}
-
 void DropSecret() {}
 #endif
 
@@ -280,6 +520,69 @@ bool PluginInstalled(const std::string& config) {
 
 }  // namespace
 
+std::string WithChatModel(const std::string& document, const std::string& model) {
+    const std::string id = std::string(kProviderID) + "/" + model;
+    const std::string options =
+        "    <option name=\"chat_preferred_llm\" value=\"" + id + "\" />\n" +
+        "    <option name=\"chat_preferred_llm_per_mode\">\n" +
+        "      <map>\n" +
+        "        <entry key=\"chat\" value=\"" + id + "\" />\n" +
+        "      </map>\n" +
+        "    </option>\n";
+
+    bool found = false;
+    Span body;
+    Span whole;
+    if (!FindElementBody(document, "component", "name", kChatComponent, &found, &body, &whole)) {
+        return {};
+    }
+
+    if (!found) {
+        // No settings yet, which an IDE nobody has opened AI Assistant in has
+        // not written. The component is ours to add beside whatever else is
+        // already in the file — but only if we can see where the document ends.
+        const std::string block =
+            std::string("  <component name=\"") + kChatComponent + "\">\n" + options +
+            "  </component>\n";
+        if (document.find_first_not_of(" \t\r\n") == std::string::npos) {
+            return "<application>\n" + block + "</application>\n";
+        }
+        bool root = false;
+        Span root_body;
+        Span root_whole;
+        if (!FindElementBody(document, "application", "", "", &root, &root_body, &root_whole)) {
+            return {};
+        }
+        // A document with content but no readable root is one to leave alone.
+        // Replacing it would silently discard whatever it did hold, which is
+        // exactly the settings this is supposed to preserve.
+        const std::size_t end = document.rfind("</application>");
+        if (end == std::string::npos) {
+            return {};
+        }
+        std::string created = document;
+        created.insert(end, block);
+        return created;
+    }
+
+    std::string inner = document.substr(body.start, body.end - body.start);
+    if (!RemoveChildOptions(&inner, "chat_preferred_llm") ||
+        !RemoveChildOptions(&inner, "chat_preferred_llm_per_mode")) {
+        return {};
+    }
+    // Removing the last option can leave the indentation of the line it was on.
+    while (!inner.empty() && (inner.back() == ' ' || inner.back() == '\t')) {
+        inner.pop_back();
+    }
+    if (!inner.empty() && inner.back() != '\n') {
+        inner += "\n";
+    }
+    std::string updated = document;
+    updated.replace(body.start, body.end - body.start, inner + options + "  ");
+    return updated;
+}
+
+
 std::string BundlePath(const Product& product) {
     const std::string home = Home();
     std::vector<std::string> roots{"/Applications/"};
@@ -339,23 +642,30 @@ bool ApplyProvider(const Product& product, const std::string& base_url,
     }
 
     const fs::path options = fs::path(config) / "options";
-    // The model ids are deliberately not written. The IDE picks them up from
-    // the provider once it can reach it, and deletes any file we leave behind.
-    (void)model;
+    // llm.custom.models.xml is deliberately not written. The IDE picks the
+    // completion and editor models up from the provider once it can reach it,
+    // and deletes any file we leave behind. AI Assistant's own settings are a
+    // different matter: it keeps those, and Chat mode reads its model from
+    // there rather than from the provider, so a provider alone leaves Chat with
+    // "No compatible model is available" while the picker still lists it.
     if (!WriteFile(options / kSettingsFile, SettingsXML(base_url), error) ||
         !WriteFile(options / kProvidersFile, ProvidersXML(), error) ||
+        !NameChatModel(options / kChatFile, model, error) ||
         !AcceptAcknowledgement(options / kPropertiesFile, error)) {
         return false;
     }
-    // A local server needs no key, and the IDE is content without one — it
-    // reports the provider configured with an empty key and talks to it anyway.
-    // So nothing is put in the reader's keychain unless there is a real secret
-    // to put there, which is the upstream case.
-    if (api_key.empty()) {
-        DropSecret();
-        return true;
-    }
-    return StoreSecret(api_key, bundle + "/Contents/MacOS/" + product.launcher, error);
+    // No credential is written, and any earlier one is removed.
+    //
+    // Writing the proxy's token here looked right and did nothing: the IDE
+    // reported the provider with an empty key on every launch and sent none, so
+    // chat came back 401 from our own proxy while the connection test passed
+    // (only /v1/chat/completions checked the token). AI Assistant takes a
+    // provider key from its own settings dialog and nowhere else. The proxy no
+    // longer asks for one.
+    (void)api_key;
+    (void)bundle;
+    DropSecret();
+    return true;
 }
 
 bool RestoreProvider(const Product& product, std::string* error) {
@@ -368,6 +678,9 @@ bool RestoreProvider(const Product& product, std::string* error) {
     std::error_code code;
     fs::remove(fs::path(config) / "options" / kSettingsFile, code);
     fs::remove(fs::path(config) / "options" / kModelsFile, code);
+    // The chat model is not removed: llm.for.code.xml is AI Assistant's own
+    // settings file and mostly holds the reader's, not ours. Leaving a model id
+    // that no longer resolves is what the IDE's own picker is for.
     fs::remove(fs::path(config) / "options" / kProvidersFile, code);
     return true;
 }
diff --git a/src/ide/jetbrains_profile.h b/src/ide/jetbrains_profile.h
index d4f30d18..a9cd4d1a 100644
--- a/src/ide/jetbrains_profile.h
+++ b/src/ide/jetbrains_profile.h
@@ -12,17 +12,19 @@
 /// already serves, so nothing has to be translated on the way.
 ///
 /// Three things have to be written before the IDE starts, and it reads all of
-/// them once at launch: a base URL in its own options tree, a key in the
-/// platform credential store, and the provider selection that the Providers &
-/// API keys page shows as a dropdown. The first two alone leave that dropdown
-/// on "None" and the IDE reporting `byok=null`, which is what makes this look
-/// like it worked when it has not.
+/// them once at launch: a base URL in its own options tree, the provider in the
+/// enabled set that the Providers & API keys page shows as a dropdown, and the
+/// model AI Chat should use. The first two alone leave Chat reporting "No
+/// compatible model is available" while the picker still lists the model,
+/// because the picker reads the provider and Chat reads its own setting.
 ///
-/// The selection is stored as model ids rather than as a provider name: each is
-/// `<providerId>/<model>`, and picking a provider is setting those three ids
-/// and the enable flag beside them.
+/// No credential is written. AI Assistant takes a provider key from its own
+/// settings dialog and nowhere else, so a key placed in the platform credential
+/// store from outside is never read — the IDE reports the provider with an
+/// empty key and sends none. The local proxy therefore asks for none.
 ///
-/// None of this needs a JetBrains AI subscription. BYOK is the supported path.
+/// None of this needs a JetBrains AI subscription. BYOK is the supported path,
+/// and AI Chat honours it when the model is named in AI Assistant's settings.
 namespace wally::ide {
 
 /// The port the local server is asked for when serving a JetBrains IDE.
@@ -34,6 +36,16 @@ namespace wally::ide {
 /// costs this run a rewrite.
 constexpr int kProviderPort = 11636;
 
+/// `document` with AI Chat's model set to `model`, everything else preserved.
+///
+/// Pure, and exposed for that reason: this edits a file the reader owns, where
+/// a mistake silently eats settings the IDE will not put back. The file I/O
+/// around it is trivial; this is the part that has to be right.
+///
+/// `document` may be empty or may have no AI Assistant component, both of which
+/// an IDE that has never opened the tool window will produce.
+std::string WithChatModel(const std::string& document, const std::string& model);
+
 /// A JetBrains IDE, named the way the reader types it.
 struct Product {
     /// The subcommand: `clion`.
diff --git a/src/ide/openai_proxy.cpp b/src/ide/openai_proxy.cpp
index 6d5874bc..0517e4eb 100644
--- a/src/ide/openai_proxy.cpp
+++ b/src/ide/openai_proxy.cpp
@@ -8,6 +8,7 @@
 #include <thread>
 
 #include <cctype>
+#include <cstdlib>
 #include <fstream>
 
 #if !defined(_WIN32)
@@ -251,13 +252,69 @@ std::string Normalise(const std::string& frame, bool verbose) {
 /// A stale selection saved in the editor's own settings outlives any change to
 /// the list we advertise, so the name in the request cannot be trusted even
 /// when only one is on offer.
-std::string Retarget(const Runtime& runtime, const std::string& body) {
+/// The request with its model replaced by the one wally was told to serve.
+///
+/// Returns false when the body is not a JSON object, and the caller refuses the
+/// request. Forwarding it unchanged was the old behaviour and it defeated the
+/// point: the model named by the caller is exactly what must not reach the
+/// endpoint, so a body we cannot rewrite is one we cannot safely send.
+/// Repairs tool calls the endpoint will not accept back.
+///
+/// A streamed tool call arrives as fragments, and this endpoint's first one
+/// carries `arguments: ""` before the real value follows. A client that keeps
+/// that first fragment instead of joining them replays the call with empty
+/// arguments on the next turn, and the endpoint refuses its own model's output
+/// with "Assistant tool call function.arguments must be a JSON object" — which
+/// names neither the message nor the call, and reads as a failure of whatever
+/// the person just asked for.
+///
+/// Empty arguments mean a call with no arguments, so that is what is sent.
+void RepairToolCalls(Json* request) {
+    const auto messages = request->find("messages");
+    if (messages == request->end() || !messages->is_array()) {
+        return;
+    }
+    for (Json& message : *messages) {
+        if (!message.is_object()) {
+            continue;
+        }
+        const auto calls = message.find("tool_calls");
+        if (calls == message.end() || !calls->is_array()) {
+            continue;
+        }
+        for (Json& call : *calls) {
+            if (!call.is_object()) {
+                continue;
+            }
+            const auto function = call.find("function");
+            if (function == call.end() || !function->is_object()) {
+                continue;
+            }
+            const auto arguments = function->find("arguments");
+            if (arguments == function->end()) {
+                continue;
+            }
+            if (arguments->is_string() &&
+                arguments->get<std::string>().find_first_not_of(" \t\r\n") == std::string::npos) {
+                *arguments = "{}";
+            } else if (arguments->is_object()) {
+                // The wire format carries arguments as a string holding JSON,
+                // and an object here is refused outright.
+                *arguments = arguments->dump();
+            }
+        }
+    }
+}
+
+bool Retarget(const Runtime& runtime, const std::string& body, std::string* retargeted) {
     Json request = Json::parse(body, nullptr, false);
     if (request.is_discarded() || !request.is_object()) {
-        return body;
+        return false;
     }
     request["model"] = runtime.model;
-    return request.dump();
+    RepairToolCalls(&request);
+    *retargeted = request.dump();
+    return true;
 }
 
 void Fail(httplib::Response& response, int status, const std::string& message) {
@@ -441,22 +498,30 @@ bool StartProxy(const harness::Endpoint& endpoint, const std::string& model, int
 
     raw->server.Post("/v1/chat/completions",
                      [raw](const httplib::Request& request, httplib::Response& response) {
-                         // This endpoint spends the signed-in user's credit, so
-                         // it serves only the editor wally configured. Bearer
-                         // token, from the provider key stored in the IDE.
-                         std::string presented;
-                         const std::string authorization = request.get_header_value("Authorization");
-                         constexpr const char* kBearer = "Bearer ";
-                         if (authorization.rfind(kBearer, 0) == 0) {
-                             presented = authorization.substr(std::string(kBearer).size());
-                         }
-                         if (!wally::net::ConstantTimeEquals(presented, raw->local_token)) {
-                             Fail(response, 401,
-                                  "this local endpoint only serves the editor wally configured");
-                             return;
-                         }
+                         // No credential is required, and that is a deliberate
+                         // trade rather than an oversight.
+                         //
+                         // This used to demand a per-session bearer token, and
+                         // the IDE never sent one: AI Assistant's third-party
+                         // provider has no way to be handed a key from outside
+                         // its own settings dialog, so every chat request
+                         // arrived bare and was refused with a 401 that read as
+                         // a licensing problem. A guard that refuses the only
+                         // caller it exists to serve is not a guard.
+                         //
+                         // What remains is the bind: 127.0.0.1, so nothing off
+                         // this machine can reach it, and the port lives only
+                         // as long as the editor does. Another process on this
+                         // machine could spend the signed-in user's credit
+                         // through it while it is running, which is the cost.
                          try {
-                             const std::string body = Retarget(*raw, request.body);
+                             std::string body;
+                             if (!Retarget(*raw, request.body, &body)) {
+                                 Fail(response, 400,
+                                      "the request body is not a JSON object; wally could not "
+                                      "name the model it serves");
+                                 return;
+                             }
                              // The editor decides whether to stream; we only
                              // have to keep the answer in the shape it asked for.
                              if (body.find("\"stream\":true") != std::string::npos ||
@@ -464,9 +529,23 @@ bool StartProxy(const harness::Endpoint& endpoint, const std::string& model, int
                                  Stream(*raw, body, response);
                                  return;
                              }
-                             httplib::Client client = Upstream(*raw);
-                             const httplib::Result reply = client.Post(
-                                 raw->prefix + "/chat/completions", body, "application/json");
+                             // Once more after a renewed token, the same as the
+                             // streaming path. A session that expired while the
+                             // editor was open otherwise hands the reader a bare
+                             // 401, which reads as a licensing problem rather
+                             // than as "sign in again" (wally #86).
+                             httplib::Result reply;
+                             for (int attempt = 0; attempt < 2; ++attempt) {
+                                 httplib::Client client = Upstream(*raw);
+                                 reply = client.Post(raw->prefix + "/chat/completions", body,
+                                                     "application/json");
+                                 const bool expired = reply && reply->status == 401 &&
+                                                      LooksLikeAuthFailure(reply->body);
+                                 if (attempt == 0 && expired && RenewToken(*raw)) {
+                                     continue;
+                                 }
+                                 break;
+                             }
                              if (!reply) {
                                  Fail(response, 502, "the model endpoint did not answer");
                                  return;
diff --git a/src/ide/openai_proxy.h b/src/ide/openai_proxy.h
index cc4a35f7..2f3b561b 100644
--- a/src/ide/openai_proxy.h
+++ b/src/ide/openai_proxy.h
@@ -23,9 +23,10 @@ struct Proxy {
     bool running = false;
     /// What to point the editor at. An OpenAI-compatible root ending in `/v1`.
     std::string base_url;
-    /// The API key the editor must send back. A per-session secret, so a stray
-    /// local process cannot reach the loopback port and spend on the signed-in
-    /// user's credit. Give it to the editor as the provider key.
+    /// Kept for callers that still wire a provider key through, and for the
+    /// Anthropic translator's own use. The JetBrains proxy no longer checks it:
+    /// AI Assistant cannot be handed a key from outside its settings dialog, so
+    /// requiring one refused every request it was built to serve.
     std::string auth_token;
 };
 
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index e9a28111..5992e7b2 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -21,6 +21,19 @@ target_link_libraries(test_wally_contract PRIVATE wally_core nlohmann_json::nloh
 wally_stage_windows_runtime_dlls(test_wally_contract)
 add_test(NAME wally_contract_tests COMMAND test_wally_contract --run-all)
 
+add_executable(test_wally_jetbrains_profile test_wally_jetbrains_profile.cpp)
+target_include_directories(test_wally_jetbrains_profile PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+target_link_libraries(test_wally_jetbrains_profile PRIVATE wally_core nlohmann_json::nlohmann_json)
+wally_stage_windows_runtime_dlls(test_wally_jetbrains_profile)
+add_test(NAME wally_jetbrains_profile_tests COMMAND test_wally_jetbrains_profile --run-all)
+
+add_executable(test_wally_ide_proxy_auth test_wally_ide_proxy_auth.cpp)
+target_include_directories(test_wally_ide_proxy_auth PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+target_link_libraries(test_wally_ide_proxy_auth PRIVATE wally_core httplib::httplib
+    nlohmann_json::nlohmann_json)
+wally_stage_windows_runtime_dlls(test_wally_ide_proxy_auth)
+add_test(NAME wally_ide_proxy_auth_tests COMMAND test_wally_ide_proxy_auth --run-all)
+
 add_executable(test_wally_opencode test_wally_opencode.cpp)
 target_include_directories(test_wally_opencode PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
 target_link_libraries(test_wally_opencode PRIVATE wally_core nlohmann_json::nlohmann_json)
diff --git a/tests/test_wally_ide_proxy_auth.cpp b/tests/test_wally_ide_proxy_auth.cpp
new file mode 100644
index 00000000..af29bebe
--- /dev/null
+++ b/tests/test_wally_ide_proxy_auth.cpp
@@ -0,0 +1,489 @@
+// The JetBrains proxy serves requests that carry no credential.
+//
+// It used to demand a per-session bearer token, and AI Assistant never sent
+// one: a provider key can only be entered in the IDE's own settings dialog, so
+// every chat request arrived bare and came back 401 — which the IDE reported to
+// the reader as a licensing problem. `/v1/models` never checked the token, so
+// the connection test passed and only chat failed, which is what made this hard
+// to see. These pin the behaviour so the refusal cannot come back.
+
+#include "test_common.h"
+
+#include <string>
+#include <thread>
+
+#include <httplib.h>
+#include <nlohmann/json.hpp>
+
+#include "harness/harness.h"
+#include "ide/openai_proxy.h"
+
+namespace {
+
+using Json = nlohmann::json;
+
+/// A mock OpenAI endpoint on its own port, answering both shapes the proxy
+/// forwards: one completion, and an event stream.
+class Upstream {
+   public:
+    Upstream() {
+        server_.Post("/v1/chat/completions",
+                     [](const httplib::Request& request, httplib::Response& response) {
+                         const bool streaming =
+                             request.body.find("\"stream\":true") != std::string::npos;
+                         if (!streaming) {
+                             response.set_content(
+                                 Json{{"id", "chatcmpl-test"},
+                                      {"object", "chat.completion"},
+                                      {"choices", Json::array({Json{
+                                           {"index", 0},
+                                           {"message", {{"role", "assistant"}, {"content", "pong"}}},
+                                           {"finish_reason", "stop"}}})}}
+                                     .dump(),
+                                 "application/json");
+                             return;
+                         }
+                         const Json chunk{
+                             {"id", "chatcmpl-test"},
+                             {"object", "chat.completion.chunk"},
+                             {"choices", Json::array({Json{{"index", 0},
+                                                           {"delta", {{"content", "pong"}}}}})}};
+                         response.set_content("data: " + chunk.dump() + "\n\ndata: [DONE]\n\n",
+                                              "text/event-stream");
+                     });
+        port_ = server_.bind_to_any_port("127.0.0.1");
+        thread_ = std::thread([this] { server_.listen_after_bind(); });
+        server_.wait_until_ready();
+    }
+    ~Upstream() {
+        server_.stop();
+        if (thread_.joinable()) {
+            thread_.join();
+        }
+    }
+
+    std::string base_url() const { return "http://127.0.0.1:" + std::to_string(port_) + "/v1"; }
+
+   private:
+    httplib::Server server_;
+    std::thread thread_;
+    int port_ = 0;
+};
+
+/// A free port. StartProxy needs a real number: it writes the address into the
+/// editor's settings, so 0 is not an option. The probe listens and stops,
+/// because httplib closes its listening socket only while running.
+int FreePort() {
+    httplib::Server probe;
+    const int port = probe.bind_to_any_port("127.0.0.1");
+    std::thread listener([&probe] { probe.listen_after_bind(); });
+    probe.wait_until_ready();
+    probe.stop();
+    listener.join();
+    return port;
+}
+
+class RunningProxy {
+   public:
+    explicit RunningProxy(const std::string& upstream_base_url) {
+        wally::harness::Endpoint endpoint;
+        endpoint.base_url = upstream_base_url;
+        endpoint.api_key = "test-upstream-key";
+        started_ = wally::ide::StartProxy(endpoint, "glm-5.3-flash", FreePort(), &proxy_, false);
+    }
+    ~RunningProxy() { wally::ide::StopProxy(&proxy_); }
+
+    bool started() const { return started_; }
+    const std::string& base_url() const { return proxy_.base_url; }
+
+   private:
+    wally::ide::Proxy proxy_;
+    bool started_ = false;
+};
+
+httplib::Result Ask(const RunningProxy& proxy, bool streaming, const httplib::Headers& headers) {
+    httplib::Client client(proxy.base_url());
+    client.set_read_timeout(10, 0);
+    const Json body{{"model", "anything"},
+                    {"stream", streaming},
+                    {"messages", Json::array({Json{{"role", "user"}, {"content", "hi"}}})}};
+    return client.Post("/v1/chat/completions", headers, body.dump(), "application/json");
+}
+
+TestResult test_serves_a_completion_with_no_credential() {
+    TestResult result;
+    result.test_name = "serves_a_completion_with_no_credential";
+    Upstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+    const httplib::Result reply = Ask(proxy, false, {});
+    if (!reply) {
+        result.details = "the proxy did not answer";
+        return result;
+    }
+    result.expected = "200";
+    result.actual = std::to_string(reply->status) + " " + reply->body.substr(0, 120);
+    if (reply->status == 401) {
+        result.details = "the proxy refused the editor it exists to serve";
+        return result;
+    }
+    if (reply->status != 200 || reply->body.find("pong") == std::string::npos) {
+        result.details = "an unauthenticated completion was not served";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// Streaming is the path the editor actually uses, and it takes a different
+// route through the handler.
+TestResult test_streams_with_no_credential() {
+    TestResult result;
+    result.test_name = "streams_with_no_credential";
+    Upstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+    const httplib::Result reply = Ask(proxy, true, {});
+    if (!reply) {
+        result.details = "the proxy did not answer";
+        return result;
+    }
+    result.expected = "200 carrying events";
+    result.actual = std::to_string(reply->status) + " " + reply->body.substr(0, 120);
+    if (reply->status != 200) {
+        result.details = "an unauthenticated stream was not served";
+        return result;
+    }
+    if (reply->body.find("data:") == std::string::npos ||
+        reply->body.find("pong") == std::string::npos) {
+        result.details = "the stream carried no events";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// An editor that does send something — a key typed into its settings by hand,
+// or a stale one from an earlier build — must not be refused either. Nothing
+// here validates the value, so any of them is served.
+TestResult test_serves_a_request_carrying_any_credential() {
+    TestResult result;
+    result.test_name = "serves_a_request_carrying_any_credential";
+    Upstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+    const httplib::Headers stale{{"Authorization", "Bearer a-key-from-an-older-run"}};
+    const httplib::Result reply = Ask(proxy, false, stale);
+    if (!reply) {
+        result.details = "the proxy did not answer";
+        return result;
+    }
+    result.expected = "200";
+    result.actual = std::to_string(reply->status);
+    if (reply->status != 200) {
+        result.details = "a request carrying an unrecognised key was refused";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// The model list is what the IDE's connection test calls. It answered before
+// this change and must keep answering, or the provider reads as unreachable.
+TestResult test_lists_models_with_no_credential() {
+    TestResult result;
+    result.test_name = "lists_models_with_no_credential";
+    Upstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+    httplib::Client client(proxy.base_url());
+    client.set_read_timeout(10, 0);
+    const httplib::Result reply = client.Get("/v1/models");
+    if (!reply) {
+        result.details = "the proxy did not answer";
+        return result;
+    }
+    result.expected = "200 naming the served model";
+    result.actual = std::to_string(reply->status) + " " + reply->body.substr(0, 120);
+    if (reply->status != 200 || reply->body.find("glm-5.3-flash") == std::string::npos) {
+        result.details = "the model list did not name the served model";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// The model the caller names is exactly what must not reach the endpoint: wally
+// was told which model to serve. A body that cannot be rewritten cannot be
+// safely forwarded, so it is refused rather than passed through carrying the
+// caller's own model name.
+TestResult test_refuses_a_body_it_cannot_retarget() {
+    TestResult result;
+    result.test_name = "refuses_a_body_it_cannot_retarget";
+    Upstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+    httplib::Client client(proxy.base_url());
+    client.set_read_timeout(10, 0);
+    const httplib::Result reply = client.Post(
+        "/v1/chat/completions", "{\"model\":\"gpt-4\",\"messages\":[", "application/json");
+    if (!reply) {
+        result.details = "the proxy did not answer";
+        return result;
+    }
+    result.expected = "400";
+    result.actual = std::to_string(reply->status) + " " + reply->body.substr(0, 120);
+    if (reply->status == 200) {
+        result.details = "a body carrying the caller's own model was forwarded unchanged";
+        return result;
+    }
+    if (reply->status != 400) {
+        result.details = "a malformed body was not refused as a bad request";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// An upstream that answers 401 with an expiry message gets one more attempt on
+// a renewed session. Without a refresh token there is nothing to renew, so the
+// refusal is passed on — but it must be passed on as itself, not swallowed.
+TestResult test_an_expired_session_is_not_reported_as_something_else() {
+    TestResult result;
+    result.test_name = "an_expired_session_is_not_reported_as_something_else";
+    httplib::Server upstream;
+    int attempts = 0;
+    upstream.Post("/v1/chat/completions",
+                  [&attempts](const httplib::Request&, httplib::Response& response) {
+                      ++attempts;
+                      response.status = 401;
+                      response.set_content(
+                          Json{{"error", {{"message", "access token expired"}}}}.dump(),
+                          "application/json");
+                  });
+    const int port = upstream.bind_to_any_port("127.0.0.1");
+    std::thread listener([&upstream] { upstream.listen_after_bind(); });
+    upstream.wait_until_ready();
+
+    {
+        RunningProxy proxy("http://127.0.0.1:" + std::to_string(port) + "/v1");
+        if (!proxy.started()) {
+            upstream.stop();
+            listener.join();
+            result.details = "proxy did not start";
+            return result;
+        }
+        const httplib::Result reply = Ask(proxy, false, {});
+        upstream.stop();
+        listener.join();
+        if (!reply) {
+            result.details = "the proxy did not answer";
+            return result;
+        }
+        result.expected = "401 carrying the upstream's own reason";
+        result.actual = std::to_string(reply->status) + " " + reply->body.substr(0, 120);
+        if (reply->status != 401) {
+            result.details = "the upstream's refusal was rewritten";
+            return result;
+        }
+        if (reply->body.find("expired") == std::string::npos) {
+            result.details = "the reason the session failed was lost";
+            return result;
+        }
+        // One attempt when there is no session to renew; never a silent loop.
+        if (attempts < 1 || attempts > 2) {
+            result.details = "the upstream was called " + std::to_string(attempts) + " times";
+            return result;
+        }
+    }
+    result.passed = true;
+    return result;
+}
+
+/// An upstream that refuses empty tool-call arguments the way the hosted one
+/// does, and records what it was sent.
+class ToolCallUpstream {
+   public:
+    ToolCallUpstream() {
+        server_.Post("/v1/chat/completions",
+                     [this](const httplib::Request& request, httplib::Response& response) {
+                         last_body_ = request.body;
+                         const Json parsed = Json::parse(request.body, nullptr, false);
+                         bool empty_arguments = false;
+                         if (parsed.is_object() && parsed.contains("messages")) {
+                             for (const Json& message : parsed["messages"]) {
+                                 if (!message.is_object() || !message.contains("tool_calls")) {
+                                     continue;
+                                 }
+                                 for (const Json& call : message["tool_calls"]) {
+                                     const Json& arguments = call["function"]["arguments"];
+                                     if (!arguments.is_string() ||
+                                         arguments.get<std::string>().empty()) {
+                                         empty_arguments = true;
+                                     }
+                                 }
+                             }
+                         }
+                         if (empty_arguments) {
+                             response.status = 400;
+                             response.set_content(
+                                 Json{{"error",
+                                       {{"message",
+                                         "Assistant tool call function.arguments must be a "
+                                         "JSON object."}}}}
+                                     .dump(),
+                                 "application/json");
+                             return;
+                         }
+                         response.set_content(
+                             Json{{"id", "chatcmpl-test"},
+                                  {"object", "chat.completion"},
+                                  {"choices", Json::array({Json{
+                                       {"index", 0},
+                                       {"message", {{"role", "assistant"}, {"content", "pong"}}},
+                                       {"finish_reason", "stop"}}})}}
+                                 .dump(),
+                             "application/json");
+                     });
+        port_ = server_.bind_to_any_port("127.0.0.1");
+        thread_ = std::thread([this] { server_.listen_after_bind(); });
+        server_.wait_until_ready();
+    }
+    ~ToolCallUpstream() {
+        server_.stop();
+        if (thread_.joinable()) {
+            thread_.join();
+        }
+    }
+
+    std::string base_url() const { return "http://127.0.0.1:" + std::to_string(port_) + "/v1"; }
+    const std::string& last_body() const { return last_body_; }
+
+   private:
+    httplib::Server server_;
+    std::thread thread_;
+    std::string last_body_;
+    int port_ = 0;
+};
+
+// A streamed tool call's first fragment carries `arguments: ""`. A client that
+// keeps that fragment rather than joining them replays it on the next turn, and
+// the endpoint refuses its own model's output — the reader sees whatever they
+// asked for fail, with an error naming neither the call nor the message.
+TestResult test_repairs_empty_tool_call_arguments() {
+    TestResult result;
+    result.test_name = "repairs_empty_tool_call_arguments";
+    ToolCallUpstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+
+    const Json body{
+        {"model", "anything"},
+        {"stream", false},
+        {"messages",
+         Json::array(
+             {Json{{"role", "user"}, {"content", "make a ui"}},
+              Json{{"role", "assistant"},
+                   {"tool_calls",
+                    Json::array({Json{{"id", "call_1"},
+                                      {"type", "function"},
+                                      {"function", {{"name", "list_files"}, {"arguments", ""}}}}})}},
+              Json{{"role", "tool"}, {"tool_call_id", "call_1"}, {"content", "ok"}}})}};
+    httplib::Client client(proxy.base_url());
+    client.set_read_timeout(10, 0);
+    const httplib::Result reply =
+        client.Post("/v1/chat/completions", body.dump(), "application/json");
+    if (!reply) {
+        result.details = "the proxy did not answer";
+        return result;
+    }
+    result.expected = "200, with empty arguments repaired to {}";
+    result.actual = std::to_string(reply->status) + " sent=" + upstream.last_body().substr(0, 200);
+    if (reply->status != 200) {
+        result.details = "the endpoint refused a tool call the proxy should have repaired";
+        return result;
+    }
+    if (upstream.last_body().find("\"arguments\":\"{}\"") == std::string::npos) {
+        result.details = "the empty arguments were not repaired on the way through";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// Arguments that are already a JSON string are the ordinary case and must pass
+// through exactly as written.
+TestResult test_leaves_real_tool_call_arguments_alone() {
+    TestResult result;
+    result.test_name = "leaves_real_tool_call_arguments_alone";
+    ToolCallUpstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+    const Json body{
+        {"model", "anything"},
+        {"stream", false},
+        {"messages",
+         Json::array({Json{{"role", "assistant"},
+                           {"tool_calls",
+                            Json::array({Json{
+                                {"id", "call_1"},
+                                {"type", "function"},
+                                {"function",
+                                 {{"name", "write_file"},
+                                  {"arguments", "{\"path\":\"src/main.rs\"}"}}}}})}}})}};
+    httplib::Client client(proxy.base_url());
+    client.set_read_timeout(10, 0);
+    const httplib::Result reply =
+        client.Post("/v1/chat/completions", body.dump(), "application/json");
+    if (!reply) {
+        result.details = "the proxy did not answer";
+        return result;
+    }
+    result.expected = "the arguments forwarded unchanged";
+    result.actual = upstream.last_body().substr(0, 200);
+    if (upstream.last_body().find("src/main.rs") == std::string::npos) {
+        result.details = "real tool call arguments were altered";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+}  // namespace
+
+int main(int argc, char** argv) {
+    TestSuite suite("wally_ide_proxy_auth");
+    suite.add("serves_a_completion_with_no_credential", test_serves_a_completion_with_no_credential);
+    suite.add("streams_with_no_credential", test_streams_with_no_credential);
+    suite.add("serves_a_request_carrying_any_credential",
+              test_serves_a_request_carrying_any_credential);
+    suite.add("lists_models_with_no_credential", test_lists_models_with_no_credential);
+    suite.add("refuses_a_body_it_cannot_retarget", test_refuses_a_body_it_cannot_retarget);
+    suite.add("repairs_empty_tool_call_arguments", test_repairs_empty_tool_call_arguments);
+    suite.add("leaves_real_tool_call_arguments_alone",
+              test_leaves_real_tool_call_arguments_alone);
+    suite.add("an_expired_session_is_not_reported_as_something_else",
+              test_an_expired_session_is_not_reported_as_something_else);
+    return suite.run(argc, argv);
+}
diff --git a/tests/test_wally_jetbrains_profile.cpp b/tests/test_wally_jetbrains_profile.cpp
new file mode 100644
index 00000000..360b561a
--- /dev/null
+++ b/tests/test_wally_jetbrains_profile.cpp
@@ -0,0 +1,591 @@
+// AI Assistant's settings file is the reader's, not ours: it holds their chat
+// mode, their prompt preferences, and settings a future IDE will add that this
+// build has never heard of. We rewrite two options inside it and must leave
+// every other byte alone, on files we did not write and cannot predict.
+//
+// These are the cases that would eat somebody's configuration.
+
+#include "test_common.h"
+
+#include <string>
+
+#include "ide/jetbrains_profile.h"
+
+namespace {
+
+using wally::ide::WithChatModel;
+
+constexpr const char* kModel = "glm-5.3-flash";
+constexpr const char* kId = "OpenAIAPI/glm-5.3-flash";
+
+bool Contains(const std::string& haystack, const std::string& needle) {
+    return haystack.find(needle) != std::string::npos;
+}
+
+int Occurrences(const std::string& haystack, const std::string& needle) {
+    int count = 0;
+    for (size_t at = haystack.find(needle); at != std::string::npos;
+         at = haystack.find(needle, at + needle.size())) {
+        ++count;
+    }
+    return count;
+}
+
+/// A real file, as RustRover wrote it: our two options plus settings of theirs,
+/// and a block option whose children end in "/>" — the shape that fooled an
+/// earlier version of the parser into cutting the block in half.
+std::string RealWorldDocument() {
+    return R"(<application>
+  <component name="LLMSettings">
+    <option name="chat_forced_llm_per_mode">
+      <map>
+        <entry key="chat" value="6" />
+      </map>
+    </option>
+    <option name="chat_mode" value="CHAT" />
+    <option name="chat_preferred_llm" value="auto_9f9c7f49" />
+    <option name="chat_preferred_llm_per_mode">
+      <map>
+        <entry key="chat" value="auto_9f9c7f49" />
+      </map>
+    </option>
+    <option name="custom_chat_instruction_was_shown" value="true" />
+  </component>
+</application>
+)";
+}
+
+TestResult test_rewrites_the_model_and_keeps_everything_else() {
+    TestResult result;
+    result.test_name = "rewrites_the_model_and_keeps_everything_else";
+    const std::string out = WithChatModel(RealWorldDocument(), kModel);
+    result.actual = out;
+
+    if (!Contains(out, std::string("<option name=\"chat_preferred_llm\" value=\"") + kId + "\" />")) {
+        result.details = "the preferred model was not set";
+        return result;
+    }
+    if (Contains(out, "auto_9f9c7f49")) {
+        result.details = "the previous model id survived";
+        return result;
+    }
+    // Theirs, all of it.
+    if (!Contains(out, "<option name=\"chat_mode\" value=\"CHAT\" />") ||
+        !Contains(out, "<option name=\"custom_chat_instruction_was_shown\" value=\"true\" />") ||
+        !Contains(out, "<entry key=\"chat\" value=\"6\" />")) {
+        result.details = "a setting belonging to the reader was lost";
+        return result;
+    }
+    // The forced-mode block must survive whole, not be cut at its child's "/>".
+    if (Occurrences(out, "</map>") != 2 || Occurrences(out, "</option>") != 2) {
+        result.details = "a block option was left unbalanced";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// Running the same command twice is ordinary: relaunching an editor reconfigures
+// it. The second run must produce exactly the first run's file.
+TestResult test_is_idempotent() {
+    TestResult result;
+    result.test_name = "is_idempotent";
+    const std::string once = WithChatModel(RealWorldDocument(), kModel);
+    const std::string twice = WithChatModel(once, kModel);
+    result.expected = "the second run changes nothing";
+    if (once != twice) {
+        result.details = "a second run rewrote the file";
+        result.actual = twice;
+        return result;
+    }
+    if (Occurrences(once, "name=\"chat_preferred_llm\"") != 1 ||
+        Occurrences(once, "name=\"chat_preferred_llm_per_mode\"") != 1) {
+        result.details = "the option was written more than once";
+        result.actual = once;
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// Switching model is the other ordinary case, and the old id must not linger.
+TestResult test_switching_model_replaces_the_previous_one() {
+    TestResult result;
+    result.test_name = "switching_model_replaces_the_previous_one";
+    const std::string first = WithChatModel(RealWorldDocument(), "qwen3.8-27b");
+    const std::string second = WithChatModel(first, kModel);
+    result.actual = second;
+    if (Contains(second, "qwen3.8-27b")) {
+        result.details = "the previous model id was left behind";
+        return result;
+    }
+    if (Occurrences(second, "name=\"chat_preferred_llm\"") != 1) {
+        result.details = "switching model duplicated the option";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// An IDE where nobody has opened AI Assistant has no such file at all.
+TestResult test_creates_the_component_when_the_file_is_empty() {
+    TestResult result;
+    result.test_name = "creates_the_component_when_the_file_is_empty";
+    const std::string out = WithChatModel("", kModel);
+    result.actual = out;
+    if (!Contains(out, "<application>") || !Contains(out, "</application>") ||
+        !Contains(out, "<component name=\"LLMSettings\">") || !Contains(out, kId)) {
+        result.details = "an empty file did not produce a usable document";
+        return result;
+    }
+    // And the result must survive its own second run.
+    if (WithChatModel(out, kModel) != out) {
+        result.details = "the created document is not stable under a second run";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// The file exists with other components in it, which is the common case: the
+// IDE keeps unrelated settings in the same tree.
+TestResult test_adds_the_component_beside_existing_ones() {
+    TestResult result;
+    result.test_name = "adds_the_component_beside_existing_ones";
+    const std::string document = R"(<application>
+  <component name="SomethingElse">
+    <option name="chat_preferred_llm" value="not-ours" />
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (!Contains(out, "<component name=\"SomethingElse\">")) {
+        result.details = "another component was dropped";
+        return result;
+    }
+    // An option of the same name in a foreign component is not ours to touch.
+    if (!Contains(out, "<option name=\"chat_preferred_llm\" value=\"not-ours\" />")) {
+        result.details = "an identically named option in another component was rewritten";
+        return result;
+    }
+    if (!Contains(out, kId)) {
+        result.details = "our own component was not added";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// A component that never closes is a file we do not understand. Guessing at
+// where it ended would rewrite settings we cannot see.
+TestResult test_refuses_a_document_it_cannot_parse() {
+    TestResult result;
+    result.test_name = "refuses_a_document_it_cannot_parse";
+    const std::string truncated = "<application>\n  <component name=\"LLMSettings\">\n";
+    const std::string out = WithChatModel(truncated, kModel);
+    result.expected = "empty, meaning refused";
+    result.actual = out;
+    if (!out.empty()) {
+        result.details = "a malformed document was rewritten anyway";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// An option whose name merely starts with ours must survive: a prefix match
+// would delete a setting that has nothing to do with this.
+TestResult test_leaves_options_with_a_longer_name_alone() {
+    TestResult result;
+    result.test_name = "leaves_options_with_a_longer_name_alone";
+    const std::string document = R"(<application>
+  <component name="LLMSettings">
+    <option name="chat_preferred_llm_fallback" value="keep-me" />
+    <option name="chat_preferred_llm" value="replace-me" />
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (!Contains(out, "<option name=\"chat_preferred_llm_fallback\" value=\"keep-me\" />")) {
+        result.details = "an option with a longer name was removed";
+        return result;
+    }
+    if (Contains(out, "replace-me")) {
+        result.details = "the option we own was not replaced";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// The component appearing twice is not something the IDE writes, but a file
+// edited by hand can carry it. Only the first is ours to touch, and nothing may
+// be lost from the second.
+TestResult test_handles_a_repeated_component() {
+    TestResult result;
+    result.test_name = "handles_a_repeated_component";
+    const std::string document = R"(<application>
+  <component name="LLMSettings">
+    <option name="chat_preferred_llm" value="first" />
+  </component>
+  <component name="LLMSettings">
+    <option name="chat_mode" value="EDIT" />
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (!Contains(out, "<option name=\"chat_mode\" value=\"EDIT\" />")) {
+        result.details = "the second component was damaged";
+        return result;
+    }
+    if (Contains(out, "\"first\"")) {
+        result.details = "the first component's model was not replaced";
+        return result;
+    }
+    if (Occurrences(out, "<component name=\"LLMSettings\">") != 2 ||
+        Occurrences(out, "</component>") != 2) {
+        result.details = "the document's component structure changed";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// Windows line endings, and a file with no trailing newline. Both are files the
+// reader may hand us, and neither is a reason to mangle the document.
+TestResult test_survives_crlf_and_a_missing_trailing_newline() {
+    TestResult result;
+    result.test_name = "survives_crlf_and_a_missing_trailing_newline";
+    const std::string crlf =
+        "<application>\r\n  <component name=\"LLMSettings\">\r\n"
+        "    <option name=\"chat_mode\" value=\"CHAT\" />\r\n  </component>\r\n</application>";
+    const std::string out = WithChatModel(crlf, kModel);
+    result.actual = out;
+    if (!Contains(out, kId)) {
+        result.details = "a CRLF document was not updated";
+        return result;
+    }
+    if (!Contains(out, "chat_mode")) {
+        result.details = "a CRLF document lost a setting";
+        return result;
+    }
+    if (Occurrences(out, "</component>") != 1 || Occurrences(out, "</application>") != 1) {
+        result.details = "a CRLF document came out structurally wrong";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// Every model id reaching this has been through ModelIdIsSafe, which refuses
+// quotes and angle brackets. This pins that the id is placed verbatim, so a
+// future caller that skips that check is a visible break rather than a silent
+// one.
+TestResult test_writes_the_model_id_verbatim() {
+    TestResult result;
+    result.test_name = "writes_the_model_id_verbatim";
+    const std::string out = WithChatModel(RealWorldDocument(), "qwen3.8-27b-1bit-npu");
+    result.actual = out;
+    if (Occurrences(out, "OpenAIAPI/qwen3.8-27b-1bit-npu") != 2) {
+        result.details = "the id was not written to both the preference and the per-mode map";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// A document cut short mid-write — a crash, a full disk, an editor mid-save —
+// still holds the reader's settings. Replacing it with a fresh file loses them
+// silently while reporting success, which is worse than any error.
+TestResult test_refuses_a_document_with_no_closing_root() {
+    TestResult result;
+    result.test_name = "refuses_a_document_with_no_closing_root";
+    const std::string truncated = R"(<application>
+  <component name="SomethingElse">
+    <option name="precious" value="do-not-lose-me" />
+  </component>
+)";
+    const std::string out = WithChatModel(truncated, kModel);
+    result.expected = "empty, meaning refused";
+    result.actual = out;
+    if (out.empty()) {
+        result.passed = true;
+        return result;
+    }
+    result.details = Contains(out, "do-not-lose-me")
+                         ? "the document was rewritten rather than refused"
+                         : "a setting belonging to the reader was destroyed";
+    return result;
+}
+
+// Markup quoted inside CDATA is text, not markup. Deleting through it destroys
+// the reader's content and can leave the file unparseable.
+TestResult test_ignores_options_quoted_inside_cdata() {
+    TestResult result;
+    result.test_name = "ignores_options_quoted_inside_cdata";
+    const std::string document =
+        "<application>\n  <component name=\"LLMSettings\">\n"
+        "    <option name=\"note\"><![CDATA[<option name=\"chat_preferred_llm\" value=\"x\"/>]]>"
+        "</option>\n    <option name=\"chat_preferred_llm\" value=\"real\" />\n"
+        "  </component>\n</application>\n";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (out.empty()) {
+        result.details = "a legal document was refused";
+        return result;
+    }
+    if (!Contains(out, "<![CDATA[") || !Contains(out, "]]>")) {
+        result.details = "the CDATA section was damaged";
+        return result;
+    }
+    if (Contains(out, "value=\"real\"")) {
+        result.details = "the real option was not replaced";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// The same, for a comment. A commented-out setting is the reader's note to
+// themselves and has to survive untouched.
+TestResult test_ignores_options_inside_comments() {
+    TestResult result;
+    result.test_name = "ignores_options_inside_comments";
+    const std::string document = R"(<application>
+  <component name="LLMSettings">
+    <!-- reference: <option name="chat_preferred_llm" value="decoy" /> -->
+    <option name="chat_mode" value="CHAT" />
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (out.empty()) {
+        result.details = "a legal document was refused";
+        return result;
+    }
+    if (!Contains(out, "<!-- reference: <option name=\"chat_preferred_llm\" value=\"decoy\" /> -->")) {
+        result.details = "the comment was damaged";
+        return result;
+    }
+    if (!Contains(out, kId) || !Contains(out, "chat_mode")) {
+        result.details = "the real component was not updated";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// A commented-out copy of the component itself must not be mistaken for the
+// real one, or the model is written into a comment and nothing takes effect.
+TestResult test_is_not_fooled_by_a_commented_out_component() {
+    TestResult result;
+    result.test_name = "is_not_fooled_by_a_commented_out_component";
+    const std::string document = R"(<application>
+  <!-- was: <component name="LLMSettings"> old stuff </component> -->
+  <component name="LLMSettings">
+    <option name="chat_mode" value="CHAT" />
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (out.empty()) {
+        result.details = "a legal document was refused";
+        return result;
+    }
+    const size_t comment_end = out.find("-->");
+    const size_t written = out.find(kId);
+    if (written == std::string::npos) {
+        result.details = "the model was never written";
+        return result;
+    }
+    if (comment_end == std::string::npos || written < comment_end) {
+        result.details = "the model was written inside the comment";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// Attribute order, single quotes and loose whitespace are all legal XML, and
+// an option written that way is still the option we own.
+TestResult test_matches_options_however_they_are_written() {
+    TestResult result;
+    result.test_name = "matches_options_however_they_are_written";
+    const std::string document =
+        "<application>\n  <component name='LLMSettings'>\n"
+        "    <option value=\"swapped\" name=\"chat_preferred_llm\" />\n"
+        "    <option   name = 'chat_preferred_llm_per_mode' >\n      <map/>\n    </option>\n"
+        "  </component>\n</application>\n";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (out.empty()) {
+        result.details = "a legal document was refused";
+        return result;
+    }
+    if (Contains(out, "swapped")) {
+        result.details = "an option written with its attributes swapped was not replaced";
+        return result;
+    }
+    if (Occurrences(out, "name=\"chat_preferred_llm\"") != 1 ||
+        Occurrences(out, "<component") != 1) {
+        result.details = "a duplicate option or a second component was created";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// A `>` inside an attribute value is legal and must not be read as the end of
+// the tag.
+TestResult test_handles_a_greater_than_inside_an_attribute() {
+    TestResult result;
+    result.test_name = "handles_a_greater_than_inside_an_attribute";
+    const std::string document = R"(<application>
+  <component name="LLMSettings">
+    <option name="prompt" value="if a > b then" />
+    <option name="chat_preferred_llm" value="stale" />
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (out.empty()) {
+        result.details = "a legal document was refused";
+        return result;
+    }
+    if (Contains(out, "stale")) {
+        result.details = "the option after a '>' in an attribute was not replaced";
+        return result;
+    }
+    if (!Contains(out, "if a > b then")) {
+        result.details = "the attribute holding '>' was damaged";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// An option of the same name nested inside another option's children belongs to
+// that option, not to us.
+TestResult test_leaves_a_nested_option_of_the_same_name_alone() {
+    TestResult result;
+    result.test_name = "leaves_a_nested_option_of_the_same_name_alone";
+    const std::string document = R"(<application>
+  <component name="LLMSettings">
+    <option name="history">
+      <option name="chat_preferred_llm" value="an-old-entry" />
+    </option>
+    <option name="chat_preferred_llm" value="the-real-one" />
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (out.empty()) {
+        result.details = "a legal document was refused";
+        return result;
+    }
+    if (!Contains(out, "an-old-entry")) {
+        result.details = "a nested option belonging to another setting was removed";
+        return result;
+    }
+    if (Contains(out, "the-real-one")) {
+        result.details = "the direct child was not replaced";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// A nested component must not steal the closing tag: the new options belong to
+// LLMSettings, as siblings of the nested element rather than children of it.
+TestResult test_places_options_in_the_right_component_when_nested() {
+    TestResult result;
+    result.test_name = "places_options_in_the_right_component_when_nested";
+    const std::string document = R"(<application>
+  <component name="LLMSettings">
+    <component name="Inner">
+      <option name="inner_setting" value="keep" />
+    </component>
+  </component>
+</application>
+)";
+    const std::string out = WithChatModel(document, kModel);
+    result.actual = out;
+    if (out.empty()) {
+        result.details = "a legal document was refused";
+        return result;
+    }
+    if (!Contains(out, "inner_setting")) {
+        result.details = "the nested component was damaged";
+        return result;
+    }
+    const size_t inner_close = out.find("</component>");
+    const size_t written = out.find(kId);
+    if (written == std::string::npos || written < inner_close) {
+        result.details = "the model was written inside the nested component";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+// An unterminated comment is a document we cannot read the shape of.
+TestResult test_refuses_an_unterminated_comment() {
+    TestResult result;
+    result.test_name = "refuses_an_unterminated_comment";
+    const std::string document =
+        "<application>\n  <component name=\"LLMSettings\">\n    <!-- never closed\n";
+    const std::string out = WithChatModel(document, kModel);
+    result.expected = "empty, meaning refused";
+    result.actual = out;
+    if (!out.empty()) {
+        result.details = "a document with an unterminated comment was rewritten";
+        return result;
+    }
+    result.passed = true;
+    return result;
+}
+
+}  // namespace
+
+int main(int argc, char** argv) {
+    TestSuite suite("wally_jetbrains_profile");
+    suite.add("rewrites_the_model_and_keeps_everything_else",
+              test_rewrites_the_model_and_keeps_everything_else);
+    suite.add("is_idempotent", test_is_idempotent);
+    suite.add("switching_model_replaces_the_previous_one",
+              test_switching_model_replaces_the_previous_one);
+    suite.add("creates_the_component_when_the_file_is_empty",
+              test_creates_the_component_when_the_file_is_empty);
+    suite.add("adds_the_component_beside_existing_ones",
+              test_adds_the_component_beside_existing_ones);
+    suite.add("refuses_a_document_it_cannot_parse", test_refuses_a_document_it_cannot_parse);
+    suite.add("leaves_options_with_a_longer_name_alone",
+              test_leaves_options_with_a_longer_name_alone);
+    suite.add("handles_a_repeated_component", test_handles_a_repeated_component);
+    suite.add("survives_crlf_and_a_missing_trailing_newline",
+              test_survives_crlf_and_a_missing_trailing_newline);
+    suite.add("writes_the_model_id_verbatim", test_writes_the_model_id_verbatim);
+    suite.add("refuses_a_document_with_no_closing_root",
+              test_refuses_a_document_with_no_closing_root);
+    suite.add("ignores_options_quoted_inside_cdata", test_ignores_options_quoted_inside_cdata);
+    suite.add("ignores_options_inside_comments", test_ignores_options_inside_comments);
+    suite.add("is_not_fooled_by_a_commented_out_component",
+              test_is_not_fooled_by_a_commented_out_component);
+    suite.add("matches_options_however_they_are_written",
+              test_matches_options_however_they_are_written);
+    suite.add("handles_a_greater_than_inside_an_attribute",
+              test_handles_a_greater_than_inside_an_attribute);
+    suite.add("leaves_a_nested_option_of_the_same_name_alone",
+              test_leaves_a_nested_option_of_the_same_name_alone);
+    suite.add("places_options_in_the_right_component_when_nested",
+              test_places_options_in_the_right_component_when_nested);
+    suite.add("refuses_an_unterminated_comment", test_refuses_an_unterminated_comment);
+    return suite.run(argc, argv);
+}

From b59bcecfeb8af2ae9b1aca61719f8c1208363d0b Mon Sep 17 00:00:00 2001
From: Siddhesh Sonar <67579112+Siddhesh2377@users.noreply.github.com>
Date: Sun, 13 Sep 2026 23:29:43 +0530
Subject: [PATCH 2/2] ide: put the session secret in the proxy path, and lock
 the session key

---
 src/ide/openai_proxy.cpp            |  56 ++++++++++---
 src/ide/openai_proxy.h              |  12 ++-
 tests/test_wally_ide_proxy_auth.cpp | 123 ++++++++++++++++++++++++----
 3 files changed, 161 insertions(+), 30 deletions(-)

diff --git a/src/ide/openai_proxy.cpp b/src/ide/openai_proxy.cpp
index 0517e4eb..51781cc1 100644
--- a/src/ide/openai_proxy.cpp
+++ b/src/ide/openai_proxy.cpp
@@ -4,6 +4,7 @@
 #include <nlohmann/json.hpp>
 
 #include <memory>
+#include <mutex>
 #include <string>
 #include <thread>
 
@@ -50,7 +51,21 @@ struct Runtime {
     std::string model;
     // The secret the editor must present. Loopback binding keeps the network
     // out; this keeps another local process out.
+    /// An unguessable first path segment, and the only thing standing between
+    /// this endpoint and any other process on the machine.
+    ///
+    /// A header cannot be used: AI Assistant takes a provider key from its own
+    /// settings dialog and nowhere else, so it sends none. It does take a base
+    /// URL, and it appends to it, so the secret rides in the path instead —
+    /// which the editor transmits without having to know it is a secret.
     std::string local_token;
+    /// `api_key` is replaced by RenewToken from whichever request thread found
+    /// the session expired, while other threads are reading it to build an
+    /// upstream client.
+    std::mutex api_key_mutex;
+    /// Held across a renewal so two threads meeting a 401 together refresh once
+    /// rather than racing each other through the console.
+    std::mutex renewal_mutex;
     bool verbose = false;
 };
 
@@ -82,7 +97,17 @@ bool LooksLikeAuthFailure(const std::string& body) {
 /// The one held at startup is a snapshot, and an editor session outlives it.
 /// Without this the whole run dies on `access token expired` partway through,
 /// with nothing but a 401 to explain itself.
+/// The session key, read under its lock.
+std::string CurrentKey(Runtime& runtime) {
+    std::lock_guard<std::mutex> lock(runtime.api_key_mutex);
+    return runtime.api_key;
+}
+
 bool RenewToken(Runtime& runtime) {
+    // One renewal at a time: two threads meeting a 401 together would otherwise
+    // both spend a refresh token, and the second would spend one the first has
+    // already rotated away.
+    std::lock_guard<std::mutex> renewing(runtime.renewal_mutex);
     account::Credentials credentials = account::Load();
     if (credentials.refresh_token.empty()) {
         return false;
@@ -99,16 +124,20 @@ bool RenewToken(Runtime& runtime) {
     }
     std::string ignored;
     account::Save(credentials, &ignored);
-    runtime.api_key = grant.access_token;
+    {
+        std::lock_guard<std::mutex> lock(runtime.api_key_mutex);
+        runtime.api_key = grant.access_token;
+    }
     Trace(runtime.verbose, "REFRESHED");
     return true;
 }
 
-httplib::Client Upstream(const Runtime& runtime) {
+httplib::Client Upstream(Runtime& runtime) {
     httplib::Client client(runtime.origin);
     client.set_read_timeout(600, 0);
-    if (!runtime.api_key.empty()) {
-        client.set_bearer_token_auth(runtime.api_key);
+    const std::string key = CurrentKey(runtime);
+    if (!key.empty()) {
+        client.set_bearer_token_auth(key);
     }
     return client;
 }
@@ -334,7 +363,7 @@ void Stream(Runtime& runtime, const std::string& body, httplib::Response& respon
     auto request = std::make_shared<std::string>(body);
     auto origin = std::make_shared<std::string>(runtime.origin);
     auto path = std::make_shared<std::string>(runtime.prefix + "/chat/completions");
-    auto api_key = std::make_shared<std::string>(runtime.api_key);
+    auto api_key = std::make_shared<std::string>(CurrentKey(runtime));
 
     auto verbose = std::make_shared<bool>(runtime.verbose);
     Runtime* owner = &runtime;
@@ -350,7 +379,7 @@ void Stream(Runtime& runtime, const std::string& body, httplib::Response& respon
           for (int attempt = 0; attempt < 2; ++attempt) {
             httplib::Client client(*origin);
             client.set_read_timeout(600, 0);
-            const std::string token = attempt == 0 ? *api_key : owner->api_key;
+            const std::string token = attempt == 0 ? *api_key : CurrentKey(*owner);
             if (!token.empty()) {
                 client.set_bearer_token_auth(token);
             }
@@ -479,7 +508,11 @@ bool StartProxy(const harness::Endpoint& endpoint, const std::string& model, int
     Runtime* raw = runtime.get();
     // Every handler catches. An exception thrown into cpp-httplib takes the
     // process down with it, and a dead wally takes the model with it too.
-    raw->server.Get("/v1/models", [raw](const httplib::Request&, httplib::Response& response) {
+    // Every route sits under the session's secret segment, so the address the
+    // editor was given is the credential. A process that does not have it gets
+    // a 404 from a port it cannot otherwise use.
+    const std::string base = "/" + raw->local_token + "/v1";
+    raw->server.Get(base + "/models", [raw](const httplib::Request&, httplib::Response& response) {
         try {
             // Not forwarded. The one model wally was asked to serve is the one
             // offered, so there is nothing in the picker that cannot answer.
@@ -496,7 +529,7 @@ bool StartProxy(const harness::Endpoint& endpoint, const std::string& model, int
         }
     });
 
-    raw->server.Post("/v1/chat/completions",
+    raw->server.Post(base + "/chat/completions",
                      [raw](const httplib::Request& request, httplib::Response& response) {
                          // No credential is required, and that is a deliberate
                          // trade rather than an oversight.
@@ -580,8 +613,11 @@ bool StartProxy(const harness::Endpoint& endpoint, const std::string& model, int
     g_runtime = std::move(runtime);
 
     proxy->running = true;
-    proxy->base_url = "http://127.0.0.1:" + std::to_string(bound) + "/v1";
-    proxy->auth_token = raw->local_token;
+    proxy->base_url =
+        "http://127.0.0.1:" + std::to_string(bound) + "/" + raw->local_token + "/v1";
+    // Nothing to put in a header: the secret is in the address above, which is
+    // the only form the editor can carry.
+    proxy->auth_token.clear();
     return true;
 }
 
diff --git a/src/ide/openai_proxy.h b/src/ide/openai_proxy.h
index 2f3b561b..72173af6 100644
--- a/src/ide/openai_proxy.h
+++ b/src/ide/openai_proxy.h
@@ -23,10 +23,14 @@ struct Proxy {
     bool running = false;
     /// What to point the editor at. An OpenAI-compatible root ending in `/v1`.
     std::string base_url;
-    /// Kept for callers that still wire a provider key through, and for the
-    /// Anthropic translator's own use. The JetBrains proxy no longer checks it:
-    /// AI Assistant cannot be handed a key from outside its settings dialog, so
-    /// requiring one refused every request it was built to serve.
+    /// Always empty for this proxy, and kept only so callers that wire a
+    /// provider key through still compile.
+    ///
+    /// The session secret is the unguessable segment inside `base_url` instead.
+    /// AI Assistant takes a provider key from its own settings dialog and
+    /// nowhere else, so a header-based secret refused every request the proxy
+    /// exists to serve; it does take a base URL, and it appends to whatever it
+    /// is given.
     std::string auth_token;
 };
 
diff --git a/tests/test_wally_ide_proxy_auth.cpp b/tests/test_wally_ide_proxy_auth.cpp
index af29bebe..f2d5ee1c 100644
--- a/tests/test_wally_ide_proxy_auth.cpp
+++ b/tests/test_wally_ide_proxy_auth.cpp
@@ -96,18 +96,41 @@ class RunningProxy {
     bool started() const { return started_; }
     const std::string& base_url() const { return proxy_.base_url; }
 
+    /// The scheme and authority, which is all httplib::Client takes.
+    std::string origin() const {
+        const std::size_t scheme = proxy_.base_url.find("://");
+        const std::size_t slash = proxy_.base_url.find('/', scheme + 3);
+        return slash == std::string::npos ? proxy_.base_url : proxy_.base_url.substr(0, slash);
+    }
+
+    /// Everything after the authority, which the editor appends its route to.
+    /// It carries the session's secret segment, so it is the credential.
+    std::string prefix() const {
+        const std::size_t scheme = proxy_.base_url.find("://");
+        const std::size_t slash = proxy_.base_url.find('/', scheme + 3);
+        return slash == std::string::npos ? std::string() : proxy_.base_url.substr(slash);
+    }
+
    private:
     wally::ide::Proxy proxy_;
     bool started_ = false;
 };
 
 httplib::Result Ask(const RunningProxy& proxy, bool streaming, const httplib::Headers& headers) {
-    httplib::Client client(proxy.base_url());
+    httplib::Client client(proxy.origin());
     client.set_read_timeout(10, 0);
     const Json body{{"model", "anything"},
                     {"stream", streaming},
                     {"messages", Json::array({Json{{"role", "user"}, {"content", "hi"}}})}};
-    return client.Post("/v1/chat/completions", headers, body.dump(), "application/json");
+    return client.Post(proxy.prefix() + "/chat/completions", headers, body.dump(),
+                       "application/json");
+}
+
+/// One request with a body of the caller's choosing, on the real route.
+httplib::Result Send(const RunningProxy& proxy, const std::string& body) {
+    httplib::Client client(proxy.origin());
+    client.set_read_timeout(10, 0);
+    return client.Post(proxy.prefix() + "/chat/completions", body, "application/json");
 }
 
 TestResult test_serves_a_completion_with_no_credential() {
@@ -208,9 +231,9 @@ TestResult test_lists_models_with_no_credential() {
         result.details = "proxy did not start";
         return result;
     }
-    httplib::Client client(proxy.base_url());
+    httplib::Client client(proxy.origin());
     client.set_read_timeout(10, 0);
-    const httplib::Result reply = client.Get("/v1/models");
+    const httplib::Result reply = client.Get(proxy.prefix() + "/models");
     if (!reply) {
         result.details = "the proxy did not answer";
         return result;
@@ -238,10 +261,7 @@ TestResult test_refuses_a_body_it_cannot_retarget() {
         result.details = "proxy did not start";
         return result;
     }
-    httplib::Client client(proxy.base_url());
-    client.set_read_timeout(10, 0);
-    const httplib::Result reply = client.Post(
-        "/v1/chat/completions", "{\"model\":\"gpt-4\",\"messages\":[", "application/json");
+    const httplib::Result reply = Send(proxy, "{\"model\":\"gpt-4\",\"messages\":[");
     if (!reply) {
         result.details = "the proxy did not answer";
         return result;
@@ -407,10 +427,7 @@ TestResult test_repairs_empty_tool_call_arguments() {
                                       {"type", "function"},
                                       {"function", {{"name", "list_files"}, {"arguments", ""}}}}})}},
               Json{{"role", "tool"}, {"tool_call_id", "call_1"}, {"content", "ok"}}})}};
-    httplib::Client client(proxy.base_url());
-    client.set_read_timeout(10, 0);
-    const httplib::Result reply =
-        client.Post("/v1/chat/completions", body.dump(), "application/json");
+    const httplib::Result reply = Send(proxy, body.dump());
     if (!reply) {
         result.details = "the proxy did not answer";
         return result;
@@ -452,10 +469,7 @@ TestResult test_leaves_real_tool_call_arguments_alone() {
                                 {"function",
                                  {{"name", "write_file"},
                                   {"arguments", "{\"path\":\"src/main.rs\"}"}}}}})}}})}};
-    httplib::Client client(proxy.base_url());
-    client.set_read_timeout(10, 0);
-    const httplib::Result reply =
-        client.Post("/v1/chat/completions", body.dump(), "application/json");
+    const httplib::Result reply = Send(proxy, body.dump());
     if (!reply) {
         result.details = "the proxy did not answer";
         return result;
@@ -470,6 +484,82 @@ TestResult test_leaves_real_tool_call_arguments_alone() {
     return result;
 }
 
+// The guard that replaced the bearer token. A header could not be used — the
+// editor sends none — but the base URL is wally's to choose and the editor
+// appends to whatever it is given, so the secret rides in the path. Another
+// process on this machine that does not have the address cannot spend the
+// signed-in user's credit through the port.
+//
+// One proxy serves every assertion here: each RunningProxy start and stop costs
+// a listener and a thread, and this suite already stands up enough of them.
+TestResult test_the_session_path_is_the_credential() {
+    TestResult result;
+    result.test_name = "the_session_path_is_the_credential";
+    Upstream upstream;
+    RunningProxy proxy(upstream.base_url());
+    if (!proxy.started()) {
+        result.details = "proxy did not start";
+        return result;
+    }
+    const std::string prefix = proxy.prefix();
+    result.actual = prefix;
+
+    // The secret is what carries the entropy, and a short or fixed one is
+    // guessable by anything that can reach the port.
+    if (prefix.size() < 1 + 24 + std::string("/v1").size()) {
+        result.expected = "a long, unpredictable segment ahead of /v1";
+        result.details = "the session address is too short to be unguessable";
+        return result;
+    }
+    if (prefix.rfind("/v1") != prefix.size() - 3) {
+        result.details = "the session address does not end in the /v1 the editor appends to";
+        return result;
+    }
+    const std::string secret = prefix.substr(1, prefix.size() - 4);
+    if (secret.find_first_not_of(
+            "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_") !=
+        std::string::npos) {
+        result.details = "the session address carries characters a URL path cannot: " + secret;
+        return result;
+    }
+
+    const Json body{{"model", "anything"},
+                    {"messages", Json::array({Json{{"role", "user"}, {"content", "hi"}}})}};
+    httplib::Client client(proxy.origin());
+    client.set_read_timeout(10, 0);
+
+    // The address the port would have had without a secret segment.
+    const httplib::Result bare =
+        client.Post("/v1/chat/completions", body.dump(), "application/json");
+    if (!bare) {
+        result.details = "the proxy did not answer a request without the session path";
+        return result;
+    }
+    if (bare->status == 200) {
+        result.expected = "not served";
+        result.actual = std::to_string(bare->status);
+        result.details = "a caller without the session address was served";
+        return result;
+    }
+
+    // A guessed segment is no better than none.
+    const httplib::Result guessed =
+        client.Post("/not-the-secret/v1/chat/completions", body.dump(), "application/json");
+    if (!guessed) {
+        result.details = "the proxy did not answer a request with a wrong session path";
+        return result;
+    }
+    if (guessed->status == 200) {
+        result.expected = "not served";
+        result.actual = std::to_string(guessed->status);
+        result.details = "a caller guessing the session address was served";
+        return result;
+    }
+
+    result.passed = true;
+    return result;
+}
+
 }  // namespace
 
 int main(int argc, char** argv) {
@@ -480,6 +570,7 @@ int main(int argc, char** argv) {
               test_serves_a_request_carrying_any_credential);
     suite.add("lists_models_with_no_credential", test_lists_models_with_no_credential);
     suite.add("refuses_a_body_it_cannot_retarget", test_refuses_a_body_it_cannot_retarget);
+    suite.add("the_session_path_is_the_credential", test_the_session_path_is_the_credential);
     suite.add("repairs_empty_tool_call_arguments", test_repairs_empty_tool_call_arguments);
     suite.add("leaves_real_tool_call_arguments_alone",
               test_leaves_real_tool_call_arguments_alone);