@@ -1,8 +1,6 @@
 module github.com/Gitlawb/zero
 
-go 1.25.0
-
-toolchain go1.26.4
+go 1.26.4
 
 require (
 	charm.land/bubbles/v2 v2.1.0
 
@@ -460,8 +460,6 @@ func validateProviderRuntimeReady(profile config.ProviderProfile) error {
 	// A stored OAuth login (e.g. `zero auth chatgpt`) is a credential too: a
 	// keyless token-login profile must pass the readiness check instead of being
 	// told to set an API key it will never have.
-	hasCredential := providerProfileHasCredential(profile) ||
-		providerHasOAuthLogin(profile, oauthLoggedInProviders())
 	if profile.CatalogID != "" {
 		descriptor, err := providercatalog.Require(profile.CatalogID)
 		if err != nil {
@@ -470,23 +468,19 @@ func validateProviderRuntimeReady(profile config.ProviderProfile) error {
 		if !providercatalog.RuntimeSupported(descriptor) {
 			return fmt.Errorf("provider %q uses transport %q: %s", descriptor.ID, descriptor.Transport, providercatalog.RuntimeUnsupportedReason(descriptor))
 		}
-		if descriptor.RequiresAuth && !hasCredential {
-			apiKeyEnv := strings.TrimSpace(profile.APIKeyEnv)
-			if apiKeyEnv == "" && len(descriptor.AuthEnvVars) > 0 {
-				apiKeyEnv = descriptor.AuthEnvVars[0]
-			}
-			if apiKeyEnv != "" {
-				return fmt.Errorf("provider %s requires API key; set %s", profile.Name, apiKeyEnv)
-			}
-			return fmt.Errorf("provider %s requires API key", profile.Name)
-		}
+	}
+	if providerHasOAuthLogin(profile, oauthLoggedInProviders()) {
 		return nil
 	}
-	switch profile.ProviderKind {
-	case config.ProviderKindOpenAI, config.ProviderKindAnthropic, config.ProviderKindGoogle:
-		if !hasCredential {
-			return fmt.Errorf("provider %s requires API key", profile.Name)
+	// Delegates to the single source of truth shared with the TUI and the
+	// setup wizard, so `providers check` never disagrees with them about
+	// whether a saved provider (including a no-auth custom endpoint) is
+	// actually missing a credential.
+	if envVar, missing := profile.MissingCredentialEnv(); missing {
+		if envVar != "" {
+			return fmt.Errorf("provider %s requires API key; set %s", profile.Name, envVar)
 		}
+		return fmt.Errorf("provider %s requires API key", profile.Name)
 	}
 	return nil
 }
 
@@ -0,0 +1,68 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/Gitlawb/zero/internal/config"
+)
+
+// Regression for issue #555's follow-up: `zero providers check` must not
+// error that a no-auth custom endpoint requires an API key, matching what
+// /model and /providers already treat as usable.
+func TestValidateProviderRuntimeReadyCustomEndpoint(t *testing.T) {
+	cases := []struct {
+		name    string
+		profile config.ProviderProfile
+		wantErr bool
+	}{
+		{
+			name: "custom openai compatible with no credential configured",
+			profile: config.ProviderProfile{
+				Name:      "local-llama",
+				CatalogID: "custom-openai-compatible",
+				BaseURL:   "http://192.168.1.50:8080/v1",
+				Model:     "custom-model",
+			},
+			wantErr: false,
+		},
+		{
+			name: "custom openai compatible with stale legacy default env",
+			profile: config.ProviderProfile{
+				Name:      "local-llama",
+				CatalogID: "custom-openai-compatible",
+				BaseURL:   "http://192.168.1.50:8080/v1",
+				APIKeyEnv: "OPENAI_API_KEY",
+				Model:     "custom-model",
+			},
+			wantErr: false,
+		},
+		{
+			name: "custom openai compatible with explicit non-default env still requires it",
+			profile: config.ProviderProfile{
+				Name:      "local-llama",
+				CatalogID: "custom-openai-compatible",
+				BaseURL:   "http://192.168.1.50:8080/v1",
+				APIKeyEnv: "LLAMA_CPP_API_KEY",
+				Model:     "custom-model",
+			},
+			wantErr: true,
+		},
+		{
+			name: "catalog provider missing key still errors",
+			profile: config.ProviderProfile{
+				Name:      "groq",
+				CatalogID: "groq",
+				Model:     "llama-3.3-70b-versatile",
+			},
+			wantErr: true,
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := validateProviderRuntimeReady(c.profile)
+			if (err != nil) != c.wantErr {
+				t.Fatalf("validateProviderRuntimeReady() error = %v, wantErr %v", err, c.wantErr)
+			}
+		})
+	}
+}
@@ -503,41 +503,14 @@ func setupTryThisExample(profile config.ProviderProfile) string {
 	return example
 }
 
+// setupMissingCredentialEnv reports the environment variable a saved profile
+// is expected to read an API key from, and whether that expectation is
+// unmet. It delegates to config.ProviderProfile.MissingCredentialEnv, the
+// single source of truth shared with the TUI's provider status/wizard
+// surfaces and the CLI's `providers check` readiness gate, so all three never
+// disagree about whether a saved provider is missing a credential.
 func setupMissingCredentialEnv(profile config.ProviderProfile) (string, bool) {
-	if providerProfileHasCredential(profile) {
-		return "", false
-	}
-	if catalogID := strings.TrimSpace(profile.CatalogID); catalogID != "" {
-		descriptor, err := providercatalog.Require(catalogID)
-		if err != nil || !descriptor.RequiresAuth {
-			return "", false
-		}
-		return firstNonEmptyCLI(profile.APIKeyEnv, setupProviderEnvVar(descriptor)), true
-	}
-
-	switch normalizedSetupProviderKind(profile) {
-	case config.ProviderKindOpenAI, config.ProviderKindOpenAICompatible:
-		return firstNonEmptyCLI(profile.APIKeyEnv, "OPENAI_API_KEY"), true
-	case config.ProviderKindAnthropic, config.ProviderKindAnthropicCompat:
-		return firstNonEmptyCLI(profile.APIKeyEnv, "ANTHROPIC_API_KEY"), true
-	case config.ProviderKindGoogle:
-		return firstNonEmptyCLI(profile.APIKeyEnv, "GEMINI_API_KEY"), true
-	default:
-		if strings.TrimSpace(profile.APIKeyEnv) != "" {
-			return strings.TrimSpace(profile.APIKeyEnv), true
-		}
-		return "", false
-	}
-}
-
-func normalizedSetupProviderKind(profile config.ProviderProfile) config.ProviderKind {
-	if kind := strings.TrimSpace(string(profile.ProviderKind)); kind != "" {
-		return config.ProviderKind(strings.ToLower(kind))
-	}
-	if provider := strings.TrimSpace(profile.Provider); provider != "" {
-		return config.ProviderKind(strings.ToLower(provider))
-	}
-	return ""
+	return profile.MissingCredentialEnv()
 }
 
 func setupCheckCommand(name string) string {
 
@@ -64,6 +64,54 @@ func TestSetupMissingCredentialEnv(t *testing.T) {
 			},
 			want: false,
 		},
+		{
+			// Regression for issue #555: a custom OpenAI-compatible profile saved
+			// with no credential (e.g. a local llama.cpp server with no auth) must
+			// not be reported as missing one, or it gets filtered out of /model on
+			// the next run even though it was configured exactly as intended.
+			name: "custom openai compatible with no credential configured",
+			profile: config.ProviderProfile{
+				Name:      "local-llama",
+				CatalogID: "custom-openai-compatible",
+				BaseURL:   "http://192.168.1.50:8080/v1",
+			},
+			want: false,
+		},
+		{
+			name: "custom openai compatible with explicit api key env",
+			profile: config.ProviderProfile{
+				Name:      "local-llama",
+				CatalogID: "custom-openai-compatible",
+				BaseURL:   "http://192.168.1.50:8080/v1",
+				APIKeyEnv: "LLAMA_CPP_API_KEY",
+			},
+			wantEnv: "LLAMA_CPP_API_KEY",
+			want:    true,
+		},
+		{
+			// Self-heal regression: profiles saved by the pre-fix wizard were
+			// stamped with the catalog's own guessed default (OPENAI_API_KEY)
+			// even when the endpoint needed no auth. That stale value must be
+			// treated the same as unset so already-broken saved profiles start
+			// working again without a config.json rewrite.
+			name: "custom openai compatible with stale legacy default env",
+			profile: config.ProviderProfile{
+				Name:      "local-llama",
+				CatalogID: "custom-openai-compatible",
+				BaseURL:   "http://192.168.1.50:8080/v1",
+				APIKeyEnv: "OPENAI_API_KEY",
+			},
+			want: false,
+		},
+		{
+			name: "custom anthropic compatible with no credential configured",
+			profile: config.ProviderProfile{
+				Name:      "local-proxy",
+				CatalogID: "custom-anthropic-compatible",
+				BaseURL:   "http://localhost:9000/anthropic",
+			},
+			want: false,
+		},
 	}
 
 	for _, tt := range tests {
 
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/Gitlawb/zero/internal/credstore"
+	"github.com/Gitlawb/zero/internal/providercatalog"
 )
 
 // ProviderKeyStoreAt opens the encrypted credential store whose file backend lives
@@ -168,6 +169,86 @@ func (profile ProviderProfile) HasConfiguredCredential() bool {
 		strings.TrimSpace(profile.AuthHeaderValue) != ""
 }
 
+// MissingCredentialEnv reports the environment variable this profile is
+// expected to read an API key from, and whether that expectation is
+// currently unmet. It is the single source of truth for "does this saved
+// provider need a credential it doesn't have" — the CLI (`providers check`,
+// `usableSavedProviders`) and TUI (`/providers` status, provider wizard
+// summary) surfaces all delegate here so they never disagree about a
+// profile's status.
+//
+// For the catalog's two "bring your own endpoint" descriptors
+// (custom-openai-compatible, custom-anthropic-compatible), RequiresAuth is
+// just a wizard template default, not a fact about the user's actual
+// endpoint: a custom target may need no auth at all. So for those two only,
+// a credential is expected exclusively when this profile carries its own
+// explicit APIKeyEnv that differs from the catalog's guessed default — a
+// value matching that default is indistinguishable from the wizard's old
+// auto-stamp bug (issue #555) and is treated the same as unset, which also
+// self-heals profiles saved before that bug was fixed.
+func (profile ProviderProfile) MissingCredentialEnv() (string, bool) {
+	if profile.HasConfiguredCredential() {
+		return "", false
+	}
+	if catalogID := strings.TrimSpace(profile.CatalogID); catalogID != "" {
+		descriptor, err := providercatalog.Require(catalogID)
+		if err != nil {
+			return "", false
+		}
+		defaultEnvVar := firstNonEmptyTrimmed(descriptor.AuthEnvVars...)
+		if descriptor.Custom {
+			envVar := strings.TrimSpace(profile.APIKeyEnv)
+			if envVar == "" || envVar == defaultEnvVar {
+				return "", false
+			}
+			return envVar, true
+		}
+		if !descriptor.RequiresAuth {
+			return "", false
+		}
+		if envVar := strings.TrimSpace(profile.APIKeyEnv); envVar != "" {
+			return envVar, true
+		}
+		return defaultEnvVar, true
+	}
+
+	switch profile.normalizedProviderKind() {
+	case ProviderKindOpenAI, ProviderKindOpenAICompatible:
+		return firstNonEmptyTrimmed(profile.APIKeyEnv, "OPENAI_API_KEY"), true
+	case ProviderKindAnthropic, ProviderKindAnthropicCompat:
+		return firstNonEmptyTrimmed(profile.APIKeyEnv, "ANTHROPIC_API_KEY"), true
+	case ProviderKindGoogle:
+		return firstNonEmptyTrimmed(profile.APIKeyEnv, "GEMINI_API_KEY"), true
+	default:
+		if envVar := strings.TrimSpace(profile.APIKeyEnv); envVar != "" {
+			return envVar, true
+		}
+		return "", false
+	}
+}
+
+// normalizedProviderKind resolves this profile's kind, falling back to the
+// legacy Provider string field (lowercased) when ProviderKind is unset —
+// matching how the resolver (resolver.go) treats the two fields as synonyms.
+func (profile ProviderProfile) normalizedProviderKind() ProviderKind {
+	if kind := strings.TrimSpace(string(profile.ProviderKind)); kind != "" {
+		return ProviderKind(strings.ToLower(kind))
+	}
+	if provider := strings.TrimSpace(profile.Provider); provider != "" {
+		return ProviderKind(strings.ToLower(provider))
+	}
+	return ""
+}
+
+func firstNonEmptyTrimmed(values ...string) string {
+	for _, value := range values {
+		if trimmed := strings.TrimSpace(value); trimmed != "" {
+			return trimmed
+		}
+	}
+	return ""
+}
+
 // OAuthLoginCandidates returns the login names to try, in order, when resolving
 // this profile's OAuth token — used by the runtime bearer resolver, the Codex
 // account-header resolver, and the onboarding presence check so all three agree.