fix(onboarding): support keyless and guided provider setup

[Hmbown]

Summary

• let first-run onboarding continue with an empty credential only for the runtime's complete self-hosted set: SGLang, vLLM, and Ollama
• preserve explicit local-server authentication: auth_mode = "api_key" still rejects empty input
• activate and persist the selected local provider through the ordinary validated provider-switch path without writing an empty secret
• expose SGLang and vLLM beside Ollama in the onboarding provider picker
• centralize credential acquisition mode, provider-owned credential/docs links, and non-key guidance in shared provider metadata
• reuse that metadata in onboarding, /provider, /links, setup receipts, missing-key errors, and doctor JSON
• point Moonshot/Kimi directly at the live-verified API Keys console without presenting first-class Kimi OAuth as available

Root causes

The onboarding validator was provider-agnostic and rejected empty input before the selected route could be activated. The screen already told Ollama users that local runtimes usually need no pasted key, but the Enter handler could never reach the provider switch. The picker also omitted the other two providers that the runtime authoritatively classifies as self-hosted.

Credential acquisition had a separate drift problem: the runtime/onboarding URL table and /links maintained different links and fallbacks. A missing URL could therefore be treated as a generic local route, and Kimi onboarding stopped at the platform root instead of the durable API Keys console.

User impact

Fresh installs can select SGLang, vLLM, or Ollama, leave the key field empty, and continue into the normal trust/tips flow. The provider choice is persisted for restart. Local endpoints that explicitly require bearer authentication still require a non-empty key.

Hosted-provider setup now uses one exhaustive credential map. Stable provider-owned links remain plain text for the user to open deliberately; Codewhale does not auto-open a browser. Local/no-key, OAuth-only, mixed API-key/OAuth, and custom-config routes carry distinct typed guidance instead of fabricated console URLs.

For Kimi, the official quickstart says to sign in, open API Keys, create/copy a key, and keep it secret. Codewhale now points directly to Kimi API Keys, then accepts the pasted key through the normal onboarding path. First-class Kimi OAuth remains unavailable and upstream-blocked in #4417.

Credit

Reported by @Hmbown in #3927. The original signed commit remains intact and carries the machine-readable Reported-by trailer.

Verification

Exact tested head: 0f6041c945d94ee62d48d18c75bc3c190b12f928

• cargo fmt --all -- --check
• git diff --check
• cargo test -p codewhale-config --locked — 389 passed
• cargo test -p codewhale-tui --bin codewhale-tui --locked onboarding — 37 passed
• focused Kimi onboarding, provider-picker, /links, setup, and doctor tests
• shared credential metadata tests pin the live-verified Sakana and OpenModel replacements
• cargo clippy -p codewhale-tui --bin codewhale-tui --locked -- -D warnings
• cargo clippy -p codewhale-config -p codewhale-tui --all-targets --locked -- -D warnings

Residual scope

• This does not add arbitrary named custom endpoints to first-run onboarding; those remain available through /provider and configuration.
• It does not probe whether a local server is already listening before onboarding advances. Runtime health remains session-observed rather than inferred from configuration.
• Issue ux(onboarding): add an explicit provider-independent offline path #3927 remains open for any broader skip/offline product decision.
• Issue v0.9.3: add first-class Kimi OAuth device login and token lifecycle #4417 remains open and upstream-blocked pending an honest vendor-registered Codewhale OAuth identity; this PR does not claim or emulate Kimi OAuth.

Refs #3927
Refs #4417

[Hmbown]

Extended this existing PR in place at exact head cabdc2e2201a5546326b671e69a847f103535b42.

Provider-wide follow-through:

• replaced the drifting runtime and /links credential tables with one exhaustive, typed provider metadata helper;
• reused it across onboarding, provider/setup help, missing-key errors, /links, and doctor output;
• retained provider-owned links already documented in the repository, while local, OAuth-only, and custom routes intentionally carry no fabricated key URL;
• kept credential links as plain text—no unexpected browser launch.

Kimi was live-verified against the official API Keys console and quickstart. The onboarding screen now takes Moonshot/Kimi users straight to that console and the existing paste-key path. It does not advertise device login or first-class OAuth.

Exact-head gates:

• config suite: 389 passed;
• onboarding suite: 37 passed;
• focused Kimi picker/onboarding, /links, setup, and doctor tests passed;
• fmt and diff checks passed;
• bin and config/TUI all-target Clippy passed with -D warnings.

#4417 is still open and externally blocked on Moonshot's registered client/platform contract. No OAuth impersonation or auto-open behavior was added.

[Hmbown]

Follow-up live URL audit fixed two inherited 404s on the same branch.

New exact head: 0f6041c945d94ee62d48d18c75bc3c190b12f928

• Sakana credential console: https://console.sakana.ai/api-keys
• Sakana official get-started page: https://console.sakana.ai/get-started
• OpenModel credential console: https://console.openmodel.ai/
• OpenModel authentication guide: https://docs.openmodel.ai/en/docs/getting-started/authentication

The shared metadata and /links tests now pin all four replacements. Focused verification is green: provider metadata tests (8), test_codewhale_links, fmt, diff check, and codewhale-config Clippy with -D warnings. This push supersedes the prior CI run; no runtime API base URL changed.

[Hmbown]

Rebased cleanly onto exact main 0c6109cfb56f058bee75e76f885a04ac644f284b (including #4498's hook EOF fix) and force-pushed with an exact lease.

New exact head: 1401446d68db65210c22319a5c5daa04847a56fd

Local exact-head verification passed:

• cargo fmt --all -- --check
• git diff --check origin/main...HEAD
• codewhale-config (390), onboarding (37), Kimi (31), provider-picker, link, and doctor focused tests
• cargo clippy -p codewhale-config -p codewhale-tui --all-targets --locked -- -D warnings

The Kimi route remains API-key-only and links only to the official console/docs. Fresh exact-head CI and CodeQL are running now; I will serialize this behind #4500 and rebase once more if main advances before merge.

[Hmbown]

Rebased onto #4500 merge e9c4dbbcad2f77c3bcd71faa44b77eb514dacf0b; new exact head is ca026e307c8e743245edb1a34ffc0682961de602.

Post-rebase local gates passed: formatting/diff checks; all 390 codewhale-config tests; 37 onboarding tests; 86 provider-picker tests; provider-link tests; 51 doctor tests; 31 Kimi route/auth tests; and Codewhale TUI all-target Clippy with warnings denied. A fresh exact-head GitHub CI/CodeQL run is now required before merge.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.