config: add per-tier auth_mode

src/config/schema.test.ts

@@ -140,6 +140,37 @@ describe('configSchema — per-tier fallback', () => {
   });
 });
 
+describe('configSchema — models auth_mode', () => {
+  const minimalConfig = {
+    telegram: { bot_token: 'test', allowed_chat_ids: [1] },
+    models: { default: { provider: 'anthropic', model: 'claude-3' } },
+  };
+
+  it('accepts auth_mode values per tier', () => {
+    const result = configSchema.parse({
+      ...minimalConfig,
+      models: {
+        default: { provider: 'openai', model: 'gpt-4o', auth_mode: 'api_key' },
+        fast: { provider: 'openai', model: 'gpt-4o-mini', auth_mode: 'oauth' },
+      },
+    });
+
+    expect(result.models.default.auth_mode).toBe('api_key');
+    expect(result.models.fast?.auth_mode).toBe('oauth');
+  });
+
+  it('rejects invalid auth_mode values', () => {
+    expect(() => {
+      configSchema.parse({
+        ...minimalConfig,
+        models: {
+          default: { provider: 'openai', model: 'gpt-4o', auth_mode: 'bogus' },
+        },
+      });
+    }).toThrow(/auth_mode/i);
+  });
+});
+
 describe('configSchema — skills watcher', () => {
   const minimalConfig = {
     telegram: { bot_token: 'test', allowed_chat_ids: [1] },

src/config/schema.ts

@@ -49,6 +49,8 @@ const modelConfigBaseSchema = z.object({
   endpoint: z.string().optional(),
   api_key: z.string().optional(),
   auth_token: z.string().optional(),
+  /** Credential selection strategy for this tier (provider-specific). */
+  auth_mode: z.enum(['auto', 'api_key', 'oauth']).optional(),
   /** Use OAuth credential flow (provider-specific). */
   use_oauth: z.boolean().optional(),
   for: z.array(z.string()).optional(),