Sign in with ChatGPT + per-lane runtime truth + build provenance

.prettierignore

@@ -17,9 +17,16 @@
 **/.pytest_cache/**
 **/.venv/**
 **/.DS_Store
+**/AGENTS.md
+**/CLAUDE.md
+**/*codex*.md
 **/claude_memory_*.md
 **/Codescribe_memory_*.md
+**/logs/**
 **/node_modules/**
+**/build/**
+**/.build/**
+**/DerivedData/**
 **/target/**
 **/target-noembed/**
 **/dist/**
@@ -38,3 +45,4 @@
 **/*.mp3
 **/*.m4a
 **/*.zip
+**/*.xcassets/**

Makefile

@@ -79,7 +79,7 @@ release-codescribe-embedded: release-codescribe
 # Full verified pipeline: cargo (ffi dylib) → uniffi-bindgen → xcodegen → xcodebuild.
 # `app-bindings` stops after xcodegen (no Xcode needed) for fast Rust-side iteration.
 app:
-	@echo "Building CodeScribe.app (SwiftUI, PROFILE=$(PROFILE))..."
+	@echo "Building Codescribe.app (SwiftUI, PROFILE=$(PROFILE))..."
 	@./scripts/build-app.sh $(PROFILE)
 
 app-bindings:

app/agent/anthropic_provider.rs

@@ -42,14 +42,10 @@ use codescribe_core::agent::{
 };
 use codescribe_core::llm::provider::{ProviderKind, capability_policy};
 
-const DEFAULT_ANTHROPIC_ENDPOINT: &str = "https://api.anthropic.com/v1/messages";
 const ANTHROPIC_VERSION: &str = "2023-06-01";
 /// Anthropic requires `max_tokens` on every request; used only when the caller
 /// (assistive lane) leaves `options.max_tokens` unset.
 const DEFAULT_MAX_TOKENS: u32 = 8192;
-/// Safe Claude default so the agent path never falls into an empty model when
-/// the assistive-lane model env is unset (Settings normally supplies one).
-const DEFAULT_ANTHROPIC_MODEL: &str = "claude-opus-4-8";
 
 const DEFAULT_INITIAL_RESPONSE_TIMEOUT_MS: u64 = 90_000;
 const DEFAULT_INTER_CHUNK_TIMEOUT_MS: u64 = 90_000;
@@ -69,20 +65,20 @@ pub struct AnthropicProvider {
 }
 
 impl AnthropicProvider {
-    pub fn from_env() -> Result<Self> {
-        let api_key = get_env_non_empty("LLM_ANTHROPIC_API_KEY", "Anthropic API key (assistive)")?;
-        let endpoint = std::env::var("LLM_ANTHROPIC_ENDPOINT")
-            .ok()
-            .map(|value| value.trim().to_string())
-            .filter(|value| !value.is_empty())
-            .unwrap_or_else(|| DEFAULT_ANTHROPIC_ENDPOINT.to_string());
+    /// Build from the resolved assistive lane (fresh settings → env →
+    /// Keychain). Anthropic always authenticates, so a missing key is a
+    /// readable error naming the exact account — the availability gate
+    /// reports the same reason before a send is ever attempted.
+    pub fn from_lane(
+        lane: codescribe_core::llm::lane_truth::AssistiveLaneSnapshot,
+    ) -> Result<Self> {
+        let api_key = lane
+            .api_key
+            .context("Anthropic API key (assistive) is required. Set LLM_ANTHROPIC_API_KEY.")?;
+        let endpoint = lane.endpoint;
         // Model comes from the shared assistive-lane setting; Settings supplies a
         // Claude model when the assistive provider is Anthropic.
-        let default_model = std::env::var("LLM_ASSISTIVE_MODEL")
-            .ok()
-            .map(|value| value.trim().to_string())
-            .filter(|value| !value.is_empty())
-            .unwrap_or_else(|| DEFAULT_ANTHROPIC_MODEL.to_string());
+        let default_model = lane.model;
 
         let initial_response_timeout = Duration::from_millis(parse_env_u64(
             "CODESCRIBE_AI_ATTEMPT_TIMEOUT_MS",
@@ -805,15 +801,6 @@ fn validate_anthropic_endpoint(endpoint: &str) -> Result<reqwest::Url> {
     Ok(url)
 }
 
-fn get_env_non_empty(key: &str, label: &str) -> Result<String> {
-    let value = std::env::var(key).with_context(|| format!("{label} is required. Set {key}."))?;
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        anyhow::bail!("{label} is required. Set {key}.");
-    }
-    Ok(trimmed.to_string())
-}
-
 fn parse_env_u64(key: &str, default: u64) -> u64 {
     std::env::var(key)
         .ok()

app/agent/mod.rs

@@ -1,6 +1,8 @@
 use anyhow::Result;
 use codescribe_core::agent::AgentProvider;
-use codescribe_core::llm::provider::{LlmMode, ProviderKind, resolve_provider};
+use codescribe_core::config::Config;
+use codescribe_core::llm::lane_truth;
+use codescribe_core::llm::provider::ProviderKind;
 
 pub mod anthropic_provider;
 pub mod openai_provider;
@@ -10,18 +12,24 @@ pub mod tools;
 pub use anthropic_provider::AnthropicProvider;
 pub use openai_provider::OpenAiProvider;
 
-pub fn create_openai_provider_from_env() -> Result<OpenAiProvider> {
-    OpenAiProvider::from_env()
-}
-
-/// Build the agent (assistive-lane) provider from the configured provider
-/// identity (`LLM_ASSISTIVE_PROVIDER`, resolved by
-/// [`resolve_provider`]). A missing key for the SELECTED provider surfaces its
-/// own clear error (`from_env`) rather than silently falling back to the other
-/// provider — misconfiguration must never route to an unintended vendor.
+/// Build the agent (assistive-lane) provider from the lane-truth snapshot
+/// (fresh settings → env → Keychain), so a Settings save is honored on the
+/// very next send — no restart, no stale bootstrap env. A lane that cannot be
+/// reached fails with the same actionable reason
+/// [`assistive_unavailable_reason`] reports, never a generic key demand, and
+/// never a silent fallback to an unintended vendor.
 pub fn create_default_provider() -> Result<Box<dyn AgentProvider>> {
-    match resolve_provider(LlmMode::Assistive) {
-        ProviderKind::OpenAiResponses => Ok(Box::new(OpenAiProvider::from_env()?)),
-        ProviderKind::AnthropicMessages => Ok(Box::new(AnthropicProvider::from_env()?)),
+    let config = Config::load();
+    let lane = lane_truth::assistive_availability(&config).map_err(anyhow::Error::msg)?;
+    match lane.provider {
+        ProviderKind::OpenAiResponses => Ok(Box::new(OpenAiProvider::from_lane(lane)?)),
+        ProviderKind::AnthropicMessages => Ok(Box::new(AnthropicProvider::from_lane(lane)?)),
     }
 }
+
+/// User-facing reason the assistive lane cannot reach a model right now
+/// (`None` when a send can proceed). Kept beside [`create_default_provider`]
+/// so the availability gate and provider construction can never drift.
+pub fn assistive_unavailable_reason() -> Option<String> {
+    lane_truth::assistive_availability(&Config::load()).err()
+}

app/agent/openai_provider.rs

@@ -15,8 +15,11 @@ use codescribe_core::agent::{
     AgentEvent, AgentProvider, ContentBlock, ImageAsset, Message, Role, StreamOptions,
     ToolDefinition,
 };
+use codescribe_core::llm::account_auth;
+use codescribe_core::llm::lane_truth::AssistiveLaneSnapshot;
+use codescribe_core::llm::provider::ProviderKind;
 use codescribe_core::llm::responses_streaming_manager::{
-    ResponsesStreamingManager, StreamCallbacks,
+    AuthHeaderMode, ResponsesStreamingManager, StreamCallbacks,
 };
 
 const DEFAULT_INITIAL_RESPONSE_TIMEOUT_MS: u64 = 90_000;
@@ -52,13 +55,27 @@ pub struct OpenAiProvider {
     previous_response_id: Arc<Mutex<Option<String>>>,
     initial_response_timeout: Duration,
     inter_chunk_timeout: Duration,
+    /// Lane resolved to "Sign in with ChatGPT" account auth (no API key, official
+    /// endpoint, stored tokens). Each request fetches a FRESH access token via
+    /// `account_auth` so the auto-refresh path keeps long sessions alive.
+    use_account_auth: bool,
 }
 
 impl OpenAiProvider {
-    pub fn from_env() -> Result<Self> {
-        let endpoint = get_env_non_empty("LLM_ASSISTIVE_ENDPOINT", "LLM endpoint (assistive)")?;
-        let default_model = get_env_non_empty("LLM_ASSISTIVE_MODEL", "LLM model (assistive)")?;
-        let api_key = get_env_non_empty("LLM_ASSISTIVE_API_KEY", "OpenAI API key (assistive)")?;
+    /// Build from the resolved assistive lane (fresh settings → env →
+    /// Keychain) instead of the frozen bootstrap process env. `api_key: None`
+    /// becomes an empty key, which the streaming manager translates into a
+    /// clean unauthenticated request — key-optional local endpoints are a
+    /// first-class configuration, not an error.
+    pub fn from_lane(lane: AssistiveLaneSnapshot) -> Result<Self> {
+        let AssistiveLaneSnapshot {
+            endpoint,
+            model: default_model,
+            api_key,
+            account_auth: use_account_auth,
+            provider: _,
+        } = lane;
+        let api_key = api_key.unwrap_or_default();
 
         let use_previous_response_id =
             parse_env_bool("CODESCRIBE_AGENT_USE_PREVIOUS_RESPONSE_ID", true);
@@ -93,6 +110,7 @@ impl OpenAiProvider {
             previous_response_id: Arc::new(Mutex::new(None)),
             initial_response_timeout,
             inter_chunk_timeout,
+            use_account_auth,
         })
     }
 }
@@ -152,17 +170,39 @@ impl AgentProvider for OpenAiProvider {
             stream: true,
         };
 
+        // Account-auth lanes fetch a fresh access token per request (60s-skew
+        // auto-refresh) — never a token frozen at provider construction. The
+        // manager formats the `Bearer` header itself, so this is the raw token.
+        let account_token = if self.use_account_auth {
+            Some(
+                account_auth::access_token(ProviderKind::OpenAiResponses)
+                    .await
+                    .map_err(|error| {
+                        anyhow::anyhow!("ChatGPT account authentication failed: {error}")
+                    })?,
+            )
+        } else {
+            None
+        };
+        let auth_secret = account_token.as_deref().unwrap_or(&self.api_key);
+
+        let auth_header_mode = if self.use_account_auth {
+            AuthHeaderMode::BearerOnly
+        } else {
+            AuthHeaderMode::BearerAndApiKey
+        };
         let manager = ResponsesStreamingManager::new(
             &self.client,
             &self.endpoint,
-            &self.api_key,
+            auth_secret,
             StreamCallbacks {
                 assistant: None,
                 reasoning: None,
             },
             self.initial_response_timeout,
             self.inter_chunk_timeout,
-        );
+        )
+        .with_auth_header_mode(auth_header_mode);
 
         let provider_rx = manager.stream_agent(&request).await?;
 
@@ -557,15 +597,6 @@ fn to_data_uri(data: &[u8], media_type: &str) -> String {
     format!("data:{media_type};base64,{}", BASE64.encode(data))
 }
 
-fn get_env_non_empty(key: &str, label: &str) -> Result<String> {
-    let value = env::var(key).with_context(|| format!("{label} is required. Set {key}."))?;
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        anyhow::bail!("{label} is required. Set {key}.");
-    }
-    Ok(trimmed.to_string())
-}
-
 fn parse_env_u64(key: &str, default: u64) -> u64 {
     env::var(key)
         .ok()
@@ -848,6 +879,7 @@ mod tests {
             previous_response_id: Arc::new(Mutex::new(None)),
             initial_response_timeout: Duration::from_secs(1),
             inter_chunk_timeout: Duration::from_secs(1),
+            use_account_auth: false,
         };
         let messages = vec![Message::new(
             Role::User,
@@ -890,6 +922,7 @@ mod tests {
             previous_response_id: Arc::clone(&stored_chain),
             initial_response_timeout: Duration::from_secs(1),
             inter_chunk_timeout: Duration::from_secs(1),
+            use_account_auth: false,
         };
 
         // Pre-condition: stored chain holds prior failed attempt's response id.
@@ -923,6 +956,7 @@ mod tests {
             previous_response_id: Arc::clone(&stored_chain),
             initial_response_timeout: Duration::from_secs(1),
             inter_chunk_timeout: Duration::from_secs(1),
+            use_account_auth: false,
         };
 
         let options = StreamOptions::default();
@@ -1001,6 +1035,7 @@ mod tests {
             previous_response_id: Arc::clone(&stored_chain),
             initial_response_timeout: Duration::from_secs(1),
             inter_chunk_timeout: Duration::from_secs(1),
+            use_account_auth: false,
         };
         let reset_options = StreamOptions {
             reset_chain: true,
@@ -1177,6 +1212,7 @@ mod tests {
             previous_response_id: Arc::clone(&stored_chain),
             initial_response_timeout: Duration::from_secs(2),
             inter_chunk_timeout: Duration::from_secs(2),
+            use_account_auth: false,
         };
         let messages = vec![Message::new(
             Role::User,