surface: don't gate the web UI on a provider key when the harness carries its own auth - #267
Open
nimitbhargava wants to merge 2 commits into
Open
Conversation
…ries its own auth The onboarding gate reads the stored model-credential availability directly, so a deployment with no anthropic/openai/openrouter key reports modelProviderConfigured: false and the portal redirects every web navigation to /admin/onboarding. That check is harness-blind. modelProviderAvailabilityFor already encodes the opposite for the claude harness, returning ALL_PROVIDERS_AVAILABLE because the Claude Code CLI authenticates itself and never bills through a provider key. A claude-harness deployment is therefore fully functional but permanently gated behind an onboarding step whose only action is pasting a key it will never use. Name that property once, derived from modelProviderAvailabilityFor so there is a single source of truth, and OR it into the gate. The gate can only widen: every harness that bills through a provider key evaluates exactly as before, and the key-configured path is untouched. Verified against a local dev instance on HARNESS=claude with no provider key: the portal now serves the web UI instead of redirecting, the composer reports the Claude Code harness, and the turn proceeds to the CLI's own auth.
The claude harness passes CLAUDE_CODE_OAUTH_TOKEN through to the CLI, so a deployment can run on a Claude subscription and never hold a metered provider key. That variable appears nowhere in .env.example, the docs, the README or the deployment schema, so the only advertised way to feed a model is one of the three paid provider keys. Name it where the other credentials live, next to the harness it belongs to.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #268
Heads up: CONTRIBUTING.md asks for text rather than code, so treat this as the report and take or discard the patch as you prefer. Happy to move it to an issue or an
adrs/note instead.What happens
On
HARNESS=claudewith noANTHROPIC_API_KEY/OPENAI_API_KEY/OPENROUTER_API_KEYconfigured, every web navigation 302s to/admin/onboardingand the web UI is unreachable. The only action offered there is pasting a provider key that the Claude Code harness never uses.Why
getSurfaceConfiginsrc/api/routes/surface.tscomputes the flag straight off stored credential availability:plugins/portal/src/index.tsthen redirects onmodelProviderConfigured === false.That check is harness-blind, and
modelProviderAvailabilityForinsrc/model/pi-models.tsalready encodes the opposite for this harness — it returnsALL_PROVIDERS_AVAILABLEforclaudebecause the CLI authenticates itself and never bills through a provider key.claude-harness.tsnever readsproviderKeysat all.The change
Names that property once, derived from
modelProviderAvailabilityForso there's a single source of truth, and ORs it into the gate.The gate can only widen.
pi,opencodeandcodexall evaluate exactly as before, and the key-configured path is untouched.onlyProviderpicks up the new constant to drop a duplicated literal.Verification
npm run typecheck,oxlint, andprettierclean. 24 tests pass acrosspi-models,base-model-serviceability,webui-model-allowlist, andplugins/portal/test/onboarding-redirect(all 5 onboarding-redirect cases still pass, including "once a provider is configured, admin HTML navigation proxies to web-ui again").Against a local dev instance on
HARNESS=claudewith no provider key: before,/302s to/admin/onboarding; after,/serves the web UI, the composer shows the Claude Code harness with Opus 5, and the turn proceeds to the CLI's own auth (Not logged in - Please run /login), which is the expected next step rather than the gate.I can attach before/after screenshots of the portal if useful.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.