surface: don't gate the web UI on a provider key when the harness carries its own auth

.env.example

@@ -6,6 +6,10 @@ HARNESS_SECURITY_POSTURE=auto
 #OPENAI_API_KEY=sk-...
 #OPENROUTER_API_KEY=sk-or-...
 
+# HARNESS=claude bills to a Claude subscription instead of a metered provider key.
+# Generate the token with: claude setup-token
+#CLAUDE_CODE_OAUTH_TOKEN=
+
 ORG_ID=acme
 PORT=8080
 

src/api/routes/surface.ts

@@ -4,6 +4,7 @@ import type { Skill, SkillResolution } from "../../skills/skill-store.ts";
 import { ByteSourceTooLargeError } from "../../files/durable-byte-store.ts";
 import {
   defaultModelForHarness,
+  harnessSuppliesOwnModelAuth,
   isHarnessId,
   modelProviderAvailabilityFor,
   modelSupportedByHarness,
@@ -1038,7 +1039,11 @@ async function getSurfaceConfig(ctx: ApiCtx): Promise<void> {
     webuiModels: configuredPicker.length ? configuredPicker : allowed,
     baseModel: resolvedBase,
     harnessId,
-    ...(managedKeys ? { modelProviderConfigured: Object.values(managedKeys).some(Boolean) } : {}),
+    ...(managedKeys
+      ? {
+          modelProviderConfigured: Object.values(managedKeys).some(Boolean) || harnessSuppliesOwnModelAuth(harnessId),
+        }
+      : {}),
     externalSlackParticipants,
     ...(Object.keys(resolvedBranding).length ? { branding: resolvedBranding } : {}),
   });

src/model/pi-models.ts

@@ -220,6 +220,12 @@ export function serviceableModelIds(ids: readonly string[], providers: ModelProv
 
 export const ALL_PROVIDERS_AVAILABLE: ModelProviderAvailability = { anthropic: true, openai: true, openrouter: true };
 
+export const NO_PROVIDERS_AVAILABLE: ModelProviderAvailability = {
+  anthropic: false,
+  openai: false,
+  openrouter: false,
+};
+
 export function modelProviderAvailabilityFor(
   harness: string,
   configKeys: ModelProviderAvailability,
@@ -231,8 +237,12 @@ export function modelProviderAvailabilityFor(
   return ALL_PROVIDERS_AVAILABLE;
 }
 
+export function harnessSuppliesOwnModelAuth(harness: string): boolean {
+  return Object.values(modelProviderAvailabilityFor(harness, NO_PROVIDERS_AVAILABLE)).some(Boolean);
+}
+
 export function onlyProvider(provider: ModelProvider): ModelProviderAvailability {
-  return { anthropic: false, openai: false, openrouter: false, [provider]: true };
+  return { ...NO_PROVIDERS_AVAILABLE, [provider]: true };
 }
 
 export function defaultModelForProvider(harness: string, provider: ModelProvider): string | undefined {

test/pi-models.test.ts

@@ -5,6 +5,7 @@ import {
   auxiliaryModelForProvider,
   defaultModelForHarness,
   defaultModelForProvider,
+  harnessSuppliesOwnModelAuth,
   modelServiceable,
   modelSupportedByHarness,
   onlyProvider,
@@ -175,3 +176,11 @@ test("context token budget is half of each model's real input room", () => {
     assert.ok(budget !== undefined && budget >= 60_000, `${m.id} budget ${budget} suspiciously small`);
   }
 });
+
+test("harnesses that carry their own model auth are exactly the ones needing no provider key", () => {
+  assert.equal(harnessSuppliesOwnModelAuth("claude"), true);
+  assert.equal(harnessSuppliesOwnModelAuth("mock"), true);
+  for (const harness of ["pi", "opencode", "codex"]) {
+    assert.equal(harnessSuppliesOwnModelAuth(harness), false, `${harness} bills through a provider key`);
+  }
+});