create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/api/setup.js

@@ -18,6 +18,31 @@
 // all three move here VERBATIM (misc-ops.js's workspace handlers are the
 // precedent for a verbatim body living alongside dispatch-only wiring in the
 // same module).
+//
+// Landing-throughput WP-5 shard S2 (design doc §5 D-10 "move-only", §6 "Shard
+// module seam", §8 WP-5, §9 S-21..S-27): three more setup handlers move out of
+// server.js VERBATIM -- apiSetupTestKey (GET /api/setup/test-key),
+// apiSetupDetectKey (GET /api/setup/detect-key) and apiSetupSave
+// (POST /api/setup/save). Each body is identical to server.js's declaration
+// except for the `_deps.` prefix on every identifier that used to resolve to a
+// server.js top-level binding (D-10 rule 1), proven by
+// `node bin/move-only-check.js`. Injected deps, per function:
+//   apiSetupTestKey: CONFIG_DIR, MODEL_PROBE_ORDER, codexPaths, fs,
+//     getWalleStatusData, hostIdentityAccessAllowed, missingBinaryChild,
+//     oauthProxySupervisor, probeModel, resolveAgentCliCommand,
+//     sanitizeSetupProviderType, serverConfig, walleClient
+//   apiSetupDetectKey: CONFIG_DIR, codexPaths, execFileSync, fs,
+//     hostIdentityAccessAllowed, path, probeModel, readUserShellEnv,
+//     resolveAgentCliCommand, sanitizeSetupProviderType, serverConfig
+//   apiSetupSave: CONFIG_DIR, SETUP_PROVIDER_TYPES, __dirname,
+//     atomicWriteFileSync, fs, path, resolveEnvFilePath,
+//     sanitizeSetupProviderType, serverConfig, setup, setupProviderTypeList,
+//     telemetry, walleClient, walleSupervisor
+// `__dirname` is injected although it is NOT a server.js top-level binding: it
+// is the CommonJS wrapper parameter, so left bare in this file it would resolve
+// to lib/api/ instead of server.js's own directory and silently change
+// resolveEnvFilePath's repoRoot (D-10 rule 9, "behaviour: none changes"). It is
+// passed by value, same as every immutable binding.
 
 const { registerApiRoutes } = require('../api-router');
 
@@ -25,15 +50,12 @@ let _deps = null;
 
 function configure({
   apiSetupStatus,
-  apiSetupTestKey,
   apiSetupDetectCodexCli,
-  apiSetupDetectKey,
   apiSetupDetectGeminiCli,
   apiSetupDetectClaudeCli,
   apiSetupOauthProxyStart,
   apiSetupOauthProxyStop,
   apiSetupOauthProxyStatus,
-  apiSetupSave,
   apiSetupProviders,
   apiSetupSaveProvider,
   apiSetupTestProvider,
@@ -49,18 +71,40 @@ function configure({
   listWalleModelsViaOwner,
   walleOwnerWrite,
   serverConfig,
+  // WP-5 shard S2 move-only deps (see this file's header): the top-level
+  // server.js bindings apiSetupTestKey/apiSetupDetectKey/apiSetupSave used to
+  // close over. Immutable bindings, passed by value; `__dirname` is
+  // server.js's own module-wrapper directory (see header).
+  CONFIG_DIR,
+  MODEL_PROBE_ORDER,
+  codexPaths,
+  execFileSync,
+  fs,
+  path,
+  getWalleStatusData,
+  hostIdentityAccessAllowed,
+  missingBinaryChild,
+  oauthProxySupervisor,
+  probeModel,
+  readUserShellEnv,
+  resolveAgentCliCommand,
+  atomicWriteFileSync,
+  resolveEnvFilePath,
+  setup,
+  setupProviderTypeList,
+  telemetry,
+  walleClient,
+  walleSupervisor,
+  __dirname,
 } = {}) {
   _deps = {
     apiSetupStatus,
-    apiSetupTestKey,
     apiSetupDetectCodexCli,
-    apiSetupDetectKey,
     apiSetupDetectGeminiCli,
     apiSetupDetectClaudeCli,
     apiSetupOauthProxyStart,
     apiSetupOauthProxyStop,
     apiSetupOauthProxyStatus,
-    apiSetupSave,
     apiSetupProviders,
     apiSetupSaveProvider,
     apiSetupTestProvider,
@@ -76,6 +120,27 @@ function configure({
     listWalleModelsViaOwner,
     walleOwnerWrite,
     serverConfig,
+    CONFIG_DIR,
+    MODEL_PROBE_ORDER,
+    codexPaths,
+    execFileSync,
+    fs,
+    path,
+    getWalleStatusData,
+    hostIdentityAccessAllowed,
+    missingBinaryChild,
+    oauthProxySupervisor,
+    probeModel,
+    readUserShellEnv,
+    resolveAgentCliCommand,
+    atomicWriteFileSync,
+    resolveEnvFilePath,
+    setup,
+    setupProviderTypeList,
+    telemetry,
+    walleClient,
+    walleSupervisor,
+    __dirname,
   };
 }
 
@@ -226,15 +291,15 @@ async function handleSetupModelsByType(req, res, type) {
 function register() {
   registerApiRoutes('setup', [
     { method: 'GET', path: '/api/setup/status', handler: (req, res, url) => _deps.apiSetupStatus(req, res, url) },
-    { method: 'GET', path: '/api/setup/test-key', handler: (req, res, url) => _deps.apiSetupTestKey(req, res, url) },
+    { method: 'GET', path: '/api/setup/test-key', handler: (req, res, url) => apiSetupTestKey(req, res, url) },
     { method: 'GET', path: '/api/setup/detect-codex-cli', handler: (req, res, url) => _deps.apiSetupDetectCodexCli(req, res, url) },
-    { method: 'GET', path: '/api/setup/detect-key', handler: (req, res, url) => _deps.apiSetupDetectKey(req, res, url) },
+    { method: 'GET', path: '/api/setup/detect-key', handler: (req, res, url) => apiSetupDetectKey(req, res, url) },
     { method: 'GET', path: '/api/setup/detect-gemini-cli', handler: (req, res, url) => _deps.apiSetupDetectGeminiCli(req, res, url) },
     { method: 'GET', path: '/api/setup/detect-claude-cli', handler: (req, res, url) => _deps.apiSetupDetectClaudeCli(req, res, url) },
     { method: 'POST', path: '/api/setup/oauth-proxy/start', handler: (req, res, url) => _deps.apiSetupOauthProxyStart(req, res, url) },
     { method: 'POST', path: '/api/setup/oauth-proxy/stop', handler: (req, res, url) => _deps.apiSetupOauthProxyStop(req, res, url) },
     { method: 'GET', path: '/api/setup/oauth-proxy/status', handler: (req, res, url) => _deps.apiSetupOauthProxyStatus(req, res, url) },
-    { method: 'POST', path: '/api/setup/save', handler: (req, res, url) => _deps.apiSetupSave(req, res, url) },
+    { method: 'POST', path: '/api/setup/save', handler: (req, res, url) => apiSetupSave(req, res, url) },
     { method: 'GET', path: '/api/setup/providers', handler: (req, res, url) => _deps.apiSetupProviders(req, res, url) },
     { method: 'POST', path: '/api/setup/save-provider', handler: (req, res, url) => _deps.apiSetupSaveProvider(req, res, url) },
     { method: 'POST', path: '/api/setup/test-provider', handler: (req, res, url) => _deps.apiSetupTestProvider(req, res, url) },
@@ -267,4 +332,758 @@ function register() {
   ]);
 }
 
-module.exports = { configure, register };
+async function apiSetupTestKey(req, res, url) {
+    const providerParam = _deps.sanitizeSetupProviderType(url.searchParams.get('provider') || '');
+    const authMethodParam = url.searchParams.get('auth_method') || '';
+    const walleStatus = await _deps.getWalleStatusData().catch(() => ({}));
+    const walleProvider = walleStatus.walle_provider || 'anthropic';
+    const walleModel = walleStatus.walle_model || '';
+
+    // ── auth_method=claude_cli: shell out to `claude auth status` (JSON
+    //    output, no API call, no tokens burned). Tells us whether the CLI
+    //    is installed AND authenticated, plus the user's email + plan.
+    if (providerParam === 'anthropic' && authMethodParam === 'claude_cli') {
+      const respond = (data) => {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(data));
+      };
+      const { spawn } = require('child_process');
+      // Scrub ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN so the CLI reports the
+      // subscription auth (claude.ai login) we actually want to validate
+      // here — otherwise it just echoes back "apiKeySource": "ANTHROPIC_API_KEY"
+      // and we'd be testing the wrong path.
+      const childEnv = { ...process.env };
+      delete childEnv.ANTHROPIC_API_KEY;
+      delete childEnv.ANTHROPIC_AUTH_TOKEN;
+      let proc;
+      try {
+        proc = spawn(_deps.resolveAgentCliCommand('claude'), ['auth', 'status'], {
+          stdio: ['ignore', 'pipe', 'pipe'],
+          timeout: 15000,
+          env: childEnv,
+        });
+      } catch (err) {
+        return respond({ ok: false, error: 'Could not spawn claude: ' + err.message });
+      }
+      let stdout = '';
+      let stderr = '';
+      proc.stdout.on('data', (d) => { stdout += d.toString(); });
+      proc.stderr.on('data', (d) => { stderr += d.toString(); });
+      proc.on('error', (err) => {
+        respond({
+          ok: false,
+          error: err.code === 'ENOENT'
+            ? 'claude CLI not on PATH. Install Claude Code from claude.com/claude-code.'
+            : 'spawn failed: ' + err.message,
+        });
+      });
+      proc.on('close', (code) => {
+        if (code !== 0) {
+          return respond({ ok: false, error: 'claude auth status exited ' + code + ': ' + (stderr || stdout).slice(0, 300) });
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(stdout);
+        } catch (parseErr) {
+          return respond({ ok: false, error: 'claude auth status stdout not JSON: ' + stdout.slice(0, 200) });
+        }
+        if (!parsed.loggedIn) {
+          return respond({ ok: false, error: 'CLI installed but not signed in. Run `claude auth login`.' });
+        }
+        // Display "email · subscription" e.g. "user@example.com · pro"
+        const label = [parsed.email, parsed.subscriptionType].filter(Boolean).join(' · ');
+        respond({ ok: true, model: label || 'claude.ai', reply: parsed.authMethod || 'subscription' });
+      });
+      return;
+    }
+
+    // ── auth_method=oauth_proxy: probe the running proxy on its loopback
+    //    port, then send a minimal /v1/messages request through it. Flips
+    //    `running=false` to a clear error so the user knows to enable it.
+    if (providerParam === 'anthropic' && authMethodParam === 'oauth_proxy') {
+      const respond = (data) => {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(data));
+      };
+      const proxyStatus = await _deps.oauthProxySupervisor.status();
+      if (!proxyStatus.running) {
+        return respond({ ok: false, error: 'OAuth proxy is not running yet. Save the Anthropic card to start it, then test again.', proxy_status: proxyStatus, remediation: 'save_provider' });
+      }
+      const port = proxyStatus.port;
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/v1/messages`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'anthropic-version': '2023-06-01',
+          },
+          body: JSON.stringify({
+            model: 'claude-haiku-4-5-20251001',
+            max_tokens: 20,
+            messages: [{ role: 'user', content: 'reply with the literal string OK and nothing else' }],
+          }),
+          signal: AbortSignal.timeout(20000),
+        });
+        if (!r.ok) {
+          const txt = await r.text().catch(() => '');
+          return respond({ ok: false, error: `Proxy returned ${r.status}: ${txt.slice(0, 250)}` });
+        }
+        const d = await r.json();
+        const reply = (d.content || []).filter((b) => b.type === 'text').map((b) => b.text).join('').trim();
+        return respond({
+          ok: reply.length > 0,
+          model: d.model || 'claude-haiku-4-5',
+          reply: reply.slice(0, 50),
+        });
+      } catch (err) {
+        return respond({ ok: false, error: 'Proxy probe failed: ' + err.message });
+      }
+    }
+
+    const _testStoredProvider = async (type, fallbackModel, extraBody = {}) => {
+      try {
+        const providersResp = await _deps.walleClient.requestJson('/api/models/providers');
+        const providers = Array.isArray(providersResp.json?.providers) ? providersResp.json.providers : [];
+        const keylessProvider = type === 'ollama' || type === 'mlx';
+        const provider = providers.find((item) => item.type === type && item.enabled !== 0 && (keylessProvider || item.has_key));
+        if (!provider) return null;
+        const testResp = await _deps.walleClient.requestJson('/api/models/test-connection', {
+          method: 'POST',
+          body: { type, instance_id: provider.id, ...extraBody },
+        });
+        if (testResp.status >= 200 && testResp.status < 300 && testResp.json?.ok) {
+          const firstModel = Array.isArray(testResp.json.models) && testResp.json.models[0]?.id;
+          return { ok: true, model: testResp.json.probe?.model || firstModel || fallbackModel, probe: testResp.json.probe || null };
+        }
+        return { ok: false, error: testResp.json?.error || 'Provider not available', probe: testResp.json?.probe || null };
+      } catch {
+        return null;
+      }
+    };
+
+    // ── Ollama test (local runtime, no API key) ──
+    if (providerParam === 'ollama') {
+      const ollamaModel = (walleProvider === 'ollama' && walleModel) ? walleModel : (url.searchParams.get('model') || process.env.OLLAMA_MODEL || 'gemma4:e4b');
+      const stored = await _testStoredProvider('ollama', ollamaModel, { model: ollamaModel });
+      if (stored) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(stored));
+        return;
+      }
+      try {
+        const testResp = await _deps.walleClient.requestJson('/api/models/test-connection', {
+          method: 'POST',
+          body: {
+            type: 'ollama',
+            model: ollamaModel,
+            baseUrl: process.env.OLLAMA_BASE_URL || 'http://127.0.0.1:11434',
+          },
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        if (testResp.status >= 200 && testResp.status < 300 && testResp.json?.ok) {
+          res.end(JSON.stringify({
+            ok: true,
+            model: testResp.json.probe?.model || ollamaModel,
+            probe: testResp.json.probe || null,
+          }));
+        } else {
+          res.end(JSON.stringify({
+            ok: false,
+            error: testResp.json?.error || `Ollama probe failed with HTTP ${testResp.status}`,
+            probe: testResp.json?.probe || null,
+          }));
+        }
+      } catch (e) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: e.message }));
+      }
+      return;
+    }
+
+    // ── Google key test ──
+    if (providerParam === 'google') {
+      const googleKey = _deps.serverConfig.GOOGLE_API_KEY || '';
+      if (!googleKey) {
+        const stored = await _testStoredProvider('google', 'gemini-2.5-flash');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(stored || { ok: false, error: 'No Google API key configured.' }));
+        return;
+      }
+      // Detect stale ya29 access tokens — these are short-lived and can't be refreshed without GOOGLE_AUTH_MODE=oauth
+      if (googleKey.startsWith('ya29.') && _deps.serverConfig.GOOGLE_AUTH_MODE !== 'oauth') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Stored key is a stale Gemini CLI OAuth token (ya29.*). Get an API key from aistudio.google.com/apikey or use "Use Gemini CLI Credentials" on the setup page.' }));
+        return;
+      }
+      const isOAuth = _deps.serverConfig.GOOGLE_AUTH_MODE === 'oauth';
+      const testUrl = isOAuth
+        ? 'https://generativelanguage.googleapis.com/v1beta/models?pageSize=1'
+        : `https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(googleKey)}&pageSize=1`;
+      const headers = isOAuth ? { 'Authorization': `Bearer ${googleKey}` } : {};
+      const googleModel = (walleProvider === 'google' && walleModel && walleModel.startsWith('gemini')) ? walleModel : 'gemini-2.5-flash';
+      fetch(testUrl, { headers }).then(async (resp) => {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        if (resp.ok) { res.end(JSON.stringify({ ok: true, model: googleModel })); }
+        else { const body = await resp.json().catch(() => ({})); res.end(JSON.stringify({ ok: false, error: body?.error?.message || `HTTP ${resp.status}` })); }
+      }).catch(e => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ ok: false, error: e.message })); });
+      return;
+    }
+
+    // ── OpenAI codex_cli test: shell out to `codex login status` (free, no
+    //    API call, no tokens). Mirrors anthropic's claude_cli test pattern.
+    if (providerParam === 'openai' && authMethodParam === 'codex_cli') {
+      const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+      const spawn = _deps.hostIdentityAccessAllowed({ configDir: _deps.CONFIG_DIR }) ? require('child_process').spawn : _deps.missingBinaryChild;
+      const childEnv = { ...process.env };
+      delete childEnv.OPENAI_API_KEY; // force ChatGPT subscription path
+      let proc;
+      try {
+        proc = spawn(_deps.resolveAgentCliCommand('codex'), ['login', 'status'], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 10000, env: childEnv });
+      } catch (err) {
+        return respond({ ok: false, error: 'Could not spawn codex: ' + err.message });
+      }
+      let stdout = '';
+      let stderr = '';
+      proc.stdout.on('data', (d) => { stdout += d.toString(); });
+      proc.stderr.on('data', (d) => { stderr += d.toString(); });
+      proc.on('error', (err) => {
+        respond({
+          ok: false,
+          error: err.code === 'ENOENT'
+            ? 'codex CLI not on PATH. Install Codex from chatgpt.com/codex.'
+            : 'spawn failed: ' + err.message,
+        });
+      });
+      proc.on('close', (code) => {
+        if (code !== 0) {
+          return respond({ ok: false, error: 'codex login status exited ' + code + ': ' + (stderr || stdout).slice(0, 300) });
+        }
+        // codex login status prints to stderr; combine streams for the match.
+        const combined = stdout + '\n' + stderr;
+        const loggedIn = /logged in/i.test(combined);
+        if (!loggedIn) {
+          return respond({ ok: false, error: 'Codex installed but not logged in. Run `codex login`.' });
+        }
+        // Parse plan from auth.json JWT (best-effort, same as detect)
+        let plan = null;
+        try {
+          const auth = JSON.parse(_deps.fs.readFileSync(_deps.codexPaths.codexAuthPath(), 'utf8'));
+          const accessToken = auth?.tokens?.access_token;
+          if (accessToken) {
+            const parts = accessToken.split('.');
+            if (parts.length >= 2) {
+              const pad = '='.repeat((-parts[1].length) & 3);
+              const payload = JSON.parse(Buffer.from(parts[1] + pad, 'base64url').toString('utf8'));
+              plan = payload?.['https://api.openai.com/auth']?.chatgpt_plan_type || null;
+            }
+          }
+        } catch { /* best-effort */ }
+        const emailMatch = combined.match(/[\w.+-]+@[\w-]+\.[\w.-]+/);
+        const label = [emailMatch ? emailMatch[0] : null, plan].filter(Boolean).join(' · ');
+        respond({ ok: true, model: label || 'ChatGPT subscription', reply: 'codex' });
+      });
+      return;
+    }
+
+    // ── DeepSeek key test (api_key — direct API, OpenAI-compatible) ──
+    if (providerParam === 'deepseek') {
+      const deepseekKey = _deps.serverConfig.DEEPSEEK_API_KEY || '';
+      if (!deepseekKey) {
+        const stored = await _testStoredProvider('deepseek', 'deepseek-v4-flash');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(stored || { ok: false, error: 'No DeepSeek API key configured.' }));
+        return;
+      }
+      const dsModel = (walleProvider === 'deepseek' && walleModel && /^deepseek-/.test(walleModel)) ? walleModel : 'deepseek-v4-flash';
+      // /models is OpenAI-compatible at api.deepseek.com — single GET, no token burn.
+      fetch('https://api.deepseek.com/v1/models', { headers: { 'Authorization': `Bearer ${deepseekKey}` } }).then(async (resp) => {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        if (resp.ok) { res.end(JSON.stringify({ ok: true, model: dsModel })); }
+        else { const body = await resp.json().catch(() => ({})); res.end(JSON.stringify({ ok: false, error: body?.error?.message || `HTTP ${resp.status}` })); }
+      }).catch(e => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ ok: false, error: e.message })); });
+      return;
+    }
+
+    // ── Moonshot / Kimi key test (api_key — direct API, OpenAI-compatible) ──
+    if (providerParam === 'moonshot') {
+      const moonshotKey = _deps.serverConfig.MOONSHOT_API_KEY || '';
+      if (!moonshotKey) {
+        const stored = await _testStoredProvider('moonshot', 'kimi-k2.6');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(stored || { ok: false, error: 'No Moonshot API key configured.' }));
+        return;
+      }
+      const moonshotModel = (walleProvider === 'moonshot' && walleModel && /^(kimi-|moonshot-)/.test(walleModel)) ? walleModel : 'kimi-k2.6';
+      const base = process.env.MOONSHOT_BASE_URL || 'https://api.moonshot.ai/v1';
+      fetch(base.replace(/\/+$/, '') + '/models', { headers: { 'Authorization': `Bearer ${moonshotKey}` } }).then(async (resp) => {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        if (resp.ok) { res.end(JSON.stringify({ ok: true, model: moonshotModel })); }
+        else { const body = await resp.json().catch(() => ({})); res.end(JSON.stringify({ ok: false, error: body?.error?.message || `HTTP ${resp.status}` })); }
+      }).catch(e => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ ok: false, error: e.message })); });
+      return;
+    }
+
+    // ── Z.AI key test (api_key — direct API, OpenAI-compatible) ──
+    if (providerParam === 'zai') {
+      const zaiKey = _deps.serverConfig.ZAI_API_KEY || '';
+      if (!zaiKey) {
+        const stored = await _testStoredProvider('zai', 'glm-5.2');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(stored || { ok: false, error: 'No Z.AI API key configured.' }));
+        return;
+      }
+      const zaiModel = (walleProvider === 'zai' && walleModel && /^glm-/.test(walleModel)) ? walleModel : 'glm-5.2';
+      const base = process.env.ZAI_BASE_URL || 'https://api.z.ai/api/paas/v4/';
+      fetch(base.replace(/\/+$/, '') + '/models', { headers: { 'Authorization': `Bearer ${zaiKey}` } }).then(async (resp) => {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        if (resp.ok) { res.end(JSON.stringify({ ok: true, model: zaiModel })); }
+        else { const body = await resp.json().catch(() => ({})); res.end(JSON.stringify({ ok: false, error: body?.error?.message || `HTTP ${resp.status}` })); }
+      }).catch(e => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ ok: false, error: e.message })); });
+      return;
+    }
+
+    // ── OpenAI key test (api_key — direct API) ──
+    if (providerParam === 'openai') {
+      const openaiKey = _deps.serverConfig.OPENAI_API_KEY || '';
+      if (!openaiKey) {
+        const stored = await _testStoredProvider('openai', 'gpt-4o-mini');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(stored || { ok: false, error: 'No OpenAI API key configured.' }));
+        return;
+      }
+      const openaiModel = (walleProvider === 'openai' && walleModel && /^(gpt|o[1-9])/.test(walleModel)) ? walleModel : 'gpt-4o-mini';
+      fetch('https://api.openai.com/v1/models?limit=1', { headers: { 'Authorization': `Bearer ${openaiKey}` } }).then(async (resp) => {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        if (resp.ok) { res.end(JSON.stringify({ ok: true, model: openaiModel })); }
+        else { const body = await resp.json().catch(() => ({})); res.end(JSON.stringify({ ok: false, error: body?.error?.message || `HTTP ${resp.status}` })); }
+      }).catch(e => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ ok: false, error: e.message })); });
+      return;
+    }
+
+    // ── Anthropic key test (default) ──
+    const apiKey = _deps.serverConfig.ANTHROPIC_API_KEY || _deps.serverConfig.ANTHROPIC_AUTH_TOKEN || '';
+    const baseUrl = _deps.serverConfig.ANTHROPIC_BASE_URL || 'https://api.anthropic.com';
+    const customHeadersB64 = _deps.serverConfig.ANTHROPIC_CUSTOM_HEADERS_B64 || '';
+    const configuredModel = _deps.MODEL_PROBE_ORDER[0];
+    if (!apiKey) {
+      const stored = await _testStoredProvider('anthropic', configuredModel);
+      if (stored) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(stored));
+        return;
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: 'No API key configured.' }));
+      return;
+    }
+    // Try the configured model first; only probe for an alternative if it fails.
+    // Build probe order with configured model at the front (deduplicated)
+    const probeOrder = [configuredModel, ..._deps.MODEL_PROBE_ORDER.filter(m => m !== configuredModel)];
+    _deps.probeModel(apiKey, baseUrl, customHeadersB64, probeOrder).then(({ model, authError }) => {
+      if (model) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true, model }));
+      } else if (authError) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Invalid API key — double-check the key and try again.' }));
+      } else {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'No accessible model found for this key. Check that your key has inference permissions.' }));
+      }
+    }).catch(e => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+    });
+    return;
+  }
+
+async function apiSetupDetectKey(req, res, url) {
+    // Detect API credentials from external sources (NOT .env — that's what we're trying to populate).
+    // Provider-aware: ?provider=openai|google|anthropic. Defaults to anthropic for back-compat.
+    const detectProvider = _deps.sanitizeSetupProviderType(url.searchParams.get('provider') || 'anthropic') || 'anthropic';
+
+    // Helper: read a shell env var via the user's login shell so we get values
+    // sourced from .zshrc / .bashrc / etc., not just our parent process.
+    const readShellEnv = (varName) => {
+      return _deps.readUserShellEnv(varName, 6);
+    };
+
+    // ── OpenAI branch: shell env OPENAI_API_KEY → fallback to codex CLI suggestion
+    if (detectProvider === 'openai') {
+      const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+      const openaiKey = readShellEnv('OPENAI_API_KEY');
+      if (openaiKey && openaiKey.startsWith('sk-')) {
+        return respond({ found: true, key: openaiKey, source: 'shell environment (OPENAI_API_KEY)', provider: 'openai' });
+      }
+      // No API key — probe codex CLI as a Strategy-2 (subscription) suggestion.
+      try {
+        if (!_deps.hostIdentityAccessAllowed({ configDir: _deps.CONFIG_DIR })) throw new Error('host identity access not allowed');
+        const proc = require('child_process').spawnSync(_deps.resolveAgentCliCommand('codex'), ['login', 'status'], { encoding: 'utf8', timeout: 8000 });
+        if (proc.status === 0) {
+          const stdout = (proc.stdout || '').trim();
+          // Output is freeform like "Logged in using ChatGPT". Surface presence + try to parse account email.
+          const emailMatch = stdout.match(/[\w.+-]+@[\w-]+\.[\w.-]+/);
+          let plan = null;
+          try {
+            const auth = JSON.parse(require('fs').readFileSync(_deps.codexPaths.codexAuthPath(), 'utf8'));
+            const accessToken = auth?.tokens?.access_token;
+            if (accessToken) {
+              const parts = accessToken.split('.');
+              if (parts.length >= 2) {
+                const pad = '='.repeat((-parts[1].length) & 3);
+                const payload = JSON.parse(Buffer.from(parts[1] + pad, 'base64url').toString('utf8'));
+                plan = payload?.['https://api.openai.com/auth']?.chatgpt_plan_type || null;
+              }
+            }
+          } catch { /* best-effort */ }
+          return respond({
+            found: false,
+            provider: 'openai',
+            codex_available: true,
+            codex_status: stdout,
+            codex_email: emailMatch ? emailMatch[0] : null,
+            codex_plan: plan,
+            hint: 'No OPENAI_API_KEY in shell env. Codex CLI is logged in — use it for subscription billing instead.',
+          });
+        }
+      } catch { /* codex not on PATH — fine */ }
+      return respond({ found: false, provider: 'openai', hint: 'No OPENAI_API_KEY in shell env. Get a key at platform.openai.com OR install Codex CLI from chatgpt.com/codex' });
+    }
+
+    // ── DeepSeek branch: shell env DEEPSEEK_API_KEY only (no CLI subscription path).
+    if (detectProvider === 'deepseek') {
+      const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+      const dsKey = readShellEnv('DEEPSEEK_API_KEY');
+      if (dsKey && dsKey.startsWith('sk-')) {
+        return respond({ found: true, key: dsKey, source: 'shell environment (DEEPSEEK_API_KEY)', provider: 'deepseek' });
+      }
+      return respond({ found: false, provider: 'deepseek', hint: 'No DEEPSEEK_API_KEY in shell env. Get a key at platform.deepseek.com (prepaid — top up first).' });
+    }
+
+    // ── Moonshot / Kimi branch: shell env MOONSHOT_API_KEY only.
+    if (detectProvider === 'moonshot') {
+      const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+      const moonshotKey = readShellEnv('MOONSHOT_API_KEY');
+      if (moonshotKey) {
+        return respond({ found: true, key: moonshotKey, source: 'shell environment (MOONSHOT_API_KEY)', provider: 'moonshot' });
+      }
+      return respond({ found: false, provider: 'moonshot', hint: 'No MOONSHOT_API_KEY in shell env. Get a key from the Kimi Open Platform console.' });
+    }
+
+    // ── Z.AI branch: shell env ZAI_API_KEY only.
+    if (detectProvider === 'zai') {
+      const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+      const zaiKey = readShellEnv('ZAI_API_KEY');
+      if (zaiKey) {
+        return respond({ found: true, key: zaiKey, source: 'shell environment (ZAI_API_KEY)', provider: 'zai' });
+      }
+      return respond({ found: false, provider: 'zai', hint: 'No ZAI_API_KEY in shell env. Get a key from the Z.AI Open Platform.' });
+    }
+
+    // ── Google branch: shell env GOOGLE_API_KEY / GEMINI_API_KEY → fallback to Gemini CLI OAuth
+    if (detectProvider === 'google') {
+      const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+      const googleKey = readShellEnv('GOOGLE_API_KEY') || readShellEnv('GEMINI_API_KEY');
+      if (googleKey && !googleKey.startsWith('ya29.')) {
+        const which = readShellEnv('GOOGLE_API_KEY') ? 'GOOGLE_API_KEY' : 'GEMINI_API_KEY';
+        return respond({ found: true, key: googleKey, source: `shell environment (${which})`, provider: 'google' });
+      }
+      // Fallback to Gemini CLI's OAuth file (existing /api/setup/detect-gemini-cli handles this richly).
+      return respond({ found: false, provider: 'google', hint: 'No GOOGLE_API_KEY/GEMINI_API_KEY in shell env. Use the Gemini CLI auto-detection if installed, or get a key at aistudio.google.com/apikey' });
+    }
+
+    // ── Anthropic branch: existing logic (devbox / Keychain / shell env). Falls through.
+    let key = '';
+    let source = '';
+    let gateway = null;
+
+    // 1. Devbox corporate gateway (reads auth headers file directly)
+    if (process.platform === 'darwin') {
+      try {
+        const authFile = _deps.path.join(_deps.serverConfig.HOME, '.devbox', 'secrets', 'claude', 'auth_headers');
+        const headers = _deps.fs.readFileSync(authFile, 'utf8').trim();
+        if (headers) {
+          let baseUrl = '';
+          try {
+            const claudeScript = _deps.fs.readFileSync(_deps.path.join(_deps.serverConfig.HOME, '.devbox', 'ai', 'claude', 'claude'), 'utf8');
+            const m = claudeScript.match(/VPN_CHECK_URL="(https?:\/\/[^"]+)"/);
+            if (m) baseUrl = m[1] + '/v1';
+          } catch {}
+          if (baseUrl) {
+            gateway = {
+              base_url: baseUrl,
+              auth_token: 'sk-ant-api03-unused',
+              custom_headers_b64: Buffer.from(headers).toString('base64'),
+            };
+            source = 'Claude Code devbox (' + baseUrl.replace(/https?:\/\//, '').split('/')[0] + ')';
+          }
+        }
+      } catch {}
+    }
+
+    // 2. Claude Code OAuth token from macOS Keychain (checked before shell env — always freshest)
+    if (!gateway && !key && process.platform === 'darwin' && _deps.hostIdentityAccessAllowed({ configDir: _deps.CONFIG_DIR })) {
+      try {
+        const credJson = _deps.execFileSync('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'], { encoding: 'utf8', timeout: 3000 }).trim();
+        if (credJson) {
+          const cred = JSON.parse(credJson);
+          const oauth = cred.claudeAiOauth;
+          if (oauth && oauth.accessToken) {
+            const expired = oauth.expiresAt && oauth.expiresAt < Date.now();
+            if (!expired) {
+              key = oauth.accessToken;
+              source = 'Claude Code (OAuth)';
+            } else {
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ found: false, claude_code_expired: true, hint: 'Found Claude Code, but the OAuth token has expired. Run "claude" in your terminal once to refresh it, then click Detect again.' }));
+              return;
+            }
+          }
+        }
+      } catch {}
+    }
+
+    // 3. Shell environment (fallback — may be stale if sourced from a previous .env)
+    if (!gateway && !key) {
+      try {
+        const result = _deps.readUserShellEnv('ANTHROPIC_API_KEY', 6);
+        if (result && result.length > 5 && result !== 'sk-ant-api03-unused') {
+          key = result;
+          source = 'shell environment';
+        }
+      } catch {}
+    }
+
+    if (!gateway && !key) {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ found: false, hint: 'No API key found. Checked: Claude Code keychain, shell environment, devbox auth. Enter your key manually or get one at console.anthropic.com' }));
+      return;
+    }
+
+    // Probe API to discover the best model accessible with this key
+    const probeKey = key || (gateway ? gateway.auth_token : '');
+    const probeBase = gateway ? gateway.base_url : 'https://api.anthropic.com';
+    const probeHeaders = gateway ? gateway.custom_headers_b64 : null;
+    _deps.probeModel(probeKey, probeBase, probeHeaders).then(({ model: detectedModel }) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      if (gateway) {
+        res.end(JSON.stringify({ found: true, gateway, source, ...(detectedModel ? { model: detectedModel } : {}) }));
+      } else {
+        res.end(JSON.stringify({ found: true, key, source, ...(detectedModel ? { model: detectedModel } : {}) }));
+      }
+    }).catch(() => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      if (gateway) {
+        res.end(JSON.stringify({ found: true, gateway, source }));
+      } else {
+        res.end(JSON.stringify({ found: true, key, source }));
+      }
+    });
+    return;
+  }
+
+async function apiSetupSave(req, res, url) {
+    let body = '';
+    let bodyLen = 0;
+    req.on('data', c => {
+      bodyLen += c.length;
+      if (bodyLen > 8192) { req.destroy(); return; } // 8KB limit
+      body += c;
+    });
+    req.on('end', async () => {
+      try {
+        const data = JSON.parse(body);
+        // Validate and sanitize inputs
+        const ownerName = typeof data.owner_name === 'string'
+          ? data.owner_name.replace(/[\r\n=]/g, '').trim().slice(0, 200)
+          : '';
+        const apiKey = typeof data.api_key === 'string'
+          ? data.api_key.replace(/[\r\n\s]/g, '').slice(0, 200)
+          : '';
+        // Gateway config (corporate Portkey/cybertron setups) — sanitize values
+        let gw = null;
+        if (data.gateway && data.gateway.base_url) {
+          gw = {
+            base_url: String(data.gateway.base_url).replace(/[\r\n]/g, '').slice(0, 500),
+            auth_token: String(data.gateway.auth_token || 'sk-ant-api03-unused').replace(/[\r\n]/g, '').slice(0, 500),
+            custom_headers_b64: String(data.gateway.custom_headers_b64 || '').replace(/[\r\n\s]/g, '').slice(0, 2000),
+          };
+        }
+        const walleModel = typeof data.model === 'string'
+          ? data.model.replace(/[\r\n\s]/g, '').slice(0, 100)
+          : '';
+        const walleProvider = _deps.sanitizeSetupProviderType(data.provider);
+        if (walleProvider && !_deps.SETUP_PROVIDER_TYPES.includes(walleProvider)) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Invalid provider type. Must be one of: ' + _deps.setupProviderTypeList() }));
+          return;
+        }
+        const providerForApiKey = walleProvider || 'anthropic';
+        // Anthropic auth_method picker: 'api_key' (default), 'claude_cli', or
+        // 'oauth_proxy'. Anything else gets normalized to '' (= cleared).
+        // OpenAI auth_method picker: 'api_key' (default) or 'codex_cli'.
+        const anthropicAuthMethods = new Set(['api_key', 'claude_cli', 'oauth_proxy']);
+        const openaiAuthMethods = new Set(['api_key', 'codex_cli']);
+        const validForProvider = walleProvider === 'anthropic'
+          ? anthropicAuthMethods
+          : walleProvider === 'openai'
+            ? openaiAuthMethods
+            : new Set();
+        const authMethod = validForProvider.has(data.auth_method) ? data.auth_method : '';
+        // coding_via_cli: route the coding agent through `claude -p` (subscription
+        // billing) even when the primary auth is api_key. Stored as
+        // WALLE_CODING_USE_CLI=true|false to match what coding-orchestrator reads.
+        const codingViaCli = walleProvider === 'anthropic' && data.coding_via_cli === true;
+        // Accept any non-empty key (Anthropic, Portkey, or other providers)
+        const envPath = _deps.resolveEnvFilePath({ repoRoot: _deps.path.resolve(_deps.__dirname, '..'), dataDir: _deps.CONFIG_DIR });
+        const lines = [];
+        // Build set of keys to strip
+        const keysToReplace = new Set();
+        if (ownerName) keysToReplace.add('WALLE_OWNER_NAME');
+        // WALLE_AUTH_METHOD applies to anthropic (api_key/claude_cli/oauth_proxy)
+        // AND openai (api_key/codex_cli). WALLE_CODING_USE_CLI is anthropic-only.
+        if (walleProvider === 'anthropic' || walleProvider === 'openai') {
+          keysToReplace.add('WALLE_AUTH_METHOD');
+        }
+        if (walleProvider === 'anthropic') {
+          keysToReplace.add('WALLE_CODING_USE_CLI');
+        }
+        if (gw) {
+          // Gateway: strip Anthropic direct key vars
+          keysToReplace.add('ANTHROPIC_API_KEY');
+          keysToReplace.add('ANTHROPIC_BASE_URL');
+          keysToReplace.add('ANTHROPIC_AUTH_TOKEN');
+          keysToReplace.add('ANTHROPIC_CUSTOM_HEADERS_B64');
+        } else if (apiKey) {
+          // Only strip the key for the provider being configured — preserve others
+          if (providerForApiKey === 'openai') { keysToReplace.add('OPENAI_API_KEY'); }
+          else if (providerForApiKey === 'google') { keysToReplace.add('GOOGLE_API_KEY'); keysToReplace.add('GEMINI_API_KEY'); keysToReplace.add('GOOGLE_AUTH_MODE'); keysToReplace.add('GOOGLE_REFRESH_TOKEN'); }
+          else if (providerForApiKey === 'deepseek') { keysToReplace.add('DEEPSEEK_API_KEY'); }
+          else if (providerForApiKey === 'moonshot') { keysToReplace.add('MOONSHOT_API_KEY'); }
+          else if (providerForApiKey === 'zai') { keysToReplace.add('ZAI_API_KEY'); }
+          else if (providerForApiKey === 'anthropic') { keysToReplace.add('ANTHROPIC_API_KEY'); keysToReplace.add('ANTHROPIC_BASE_URL'); keysToReplace.add('ANTHROPIC_AUTH_TOKEN'); keysToReplace.add('ANTHROPIC_CUSTOM_HEADERS_B64'); }
+        }
+        // Read existing .env, keep lines that aren't being replaced
+        try {
+          const existing = _deps.fs.readFileSync(envPath, 'utf8');
+          for (const line of existing.split('\n')) {
+            const m = line.match(/^\s*#?\s*([A-Z0-9_]+)\s*=/);
+            if (m && keysToReplace.has(m[1])) continue; // skip — will re-add below
+            lines.push(line);
+          }
+        } catch { lines.push('# Wall-E configuration'); lines.push(''); }
+        // Strip trailing blank lines
+        while (lines.length > 0 && lines[lines.length - 1].trim() === '') lines.pop();
+        lines.push('');
+        // Add new values
+        if (ownerName) {
+          lines.push(`WALLE_OWNER_NAME=${ownerName}`);
+          _deps.serverConfig.override("WALLE_OWNER_NAME", ownerName, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+        }
+        // WALLE_AUTH_METHOD persistence — applies to anthropic AND openai.
+        if (walleProvider === 'anthropic' || walleProvider === 'openai') {
+          if (authMethod) {
+            lines.push(`WALLE_AUTH_METHOD=${authMethod}`);
+            _deps.serverConfig.override("WALLE_AUTH_METHOD", authMethod, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          } else {
+            delete _deps.serverConfig.WALLE_AUTH_METHOD;
+          }
+        }
+        // WALLE_CODING_USE_CLI is anthropic-only (claude -p override for the
+        // coding agent). Codex's equivalent path is auth_method=codex_cli itself.
+        if (walleProvider === 'anthropic') {
+          if (codingViaCli) {
+            lines.push(`WALLE_CODING_USE_CLI=true`);
+            _deps.serverConfig.override("WALLE_CODING_USE_CLI", 'true', 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          } else {
+            delete _deps.serverConfig.WALLE_CODING_USE_CLI;
+          }
+        }
+        if (gw) {
+          // Gateway setup: save gateway vars, clear direct API key
+          lines.push(`ANTHROPIC_BASE_URL=${gw.base_url}`);
+          lines.push(`ANTHROPIC_AUTH_TOKEN=${gw.auth_token}`);
+          lines.push(`ANTHROPIC_CUSTOM_HEADERS_B64=${gw.custom_headers_b64}`);
+          _deps.serverConfig.override("ANTHROPIC_BASE_URL", gw.base_url, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          _deps.serverConfig.override("ANTHROPIC_AUTH_TOKEN", gw.auth_token, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          _deps.serverConfig.override("ANTHROPIC_CUSTOM_HEADERS_B64", gw.custom_headers_b64, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          delete _deps.serverConfig.ANTHROPIC_API_KEY;
+        } else if (apiKey) {
+          // Save key under the correct provider env var
+          if (providerForApiKey === 'openai') {
+            lines.push(`OPENAI_API_KEY=${apiKey}`);
+            _deps.serverConfig.override("OPENAI_API_KEY", apiKey, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          } else if (providerForApiKey === 'google') {
+            const googleAuthMode = typeof data.google_auth_mode === 'string' ? data.google_auth_mode.replace(/[^a-z]/g, '') : '';
+            const googleRefreshToken = typeof data.google_refresh_token === 'string' ? data.google_refresh_token.replace(/[\r\n]/g, '').slice(0, 2000) : '';
+            lines.push(`GOOGLE_API_KEY=${apiKey}`);
+            _deps.serverConfig.override("GOOGLE_API_KEY", apiKey, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+            if (googleAuthMode === 'oauth' && googleRefreshToken) {
+              lines.push(`GOOGLE_AUTH_MODE=oauth`);
+              lines.push(`GOOGLE_REFRESH_TOKEN=${googleRefreshToken}`);
+              _deps.serverConfig.override("GOOGLE_AUTH_MODE", 'oauth', 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+              _deps.serverConfig.override("GOOGLE_REFRESH_TOKEN", googleRefreshToken, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+            } else {
+              delete _deps.serverConfig.GOOGLE_AUTH_MODE;
+              delete _deps.serverConfig.GOOGLE_REFRESH_TOKEN;
+            }
+          } else if (providerForApiKey === 'deepseek') {
+            lines.push(`DEEPSEEK_API_KEY=${apiKey}`);
+            _deps.serverConfig.override("DEEPSEEK_API_KEY", apiKey, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          } else if (providerForApiKey === 'moonshot') {
+            lines.push(`MOONSHOT_API_KEY=${apiKey}`);
+            _deps.serverConfig.override("MOONSHOT_API_KEY", apiKey, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          } else if (providerForApiKey === 'zai') {
+            lines.push(`ZAI_API_KEY=${apiKey}`);
+            _deps.serverConfig.override("ZAI_API_KEY", apiKey, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          } else if (providerForApiKey === 'anthropic') {
+            // Default: Anthropic
+            lines.push(`ANTHROPIC_API_KEY=${apiKey}`);
+            _deps.serverConfig.override("ANTHROPIC_API_KEY", apiKey, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+            delete _deps.serverConfig.ANTHROPIC_BASE_URL;
+            delete _deps.serverConfig.ANTHROPIC_AUTH_TOKEN;
+            delete _deps.serverConfig.ANTHROPIC_CUSTOM_HEADERS_B64;
+          }
+        }
+        _deps.atomicWriteFileSync(envPath, lines.join('\n') + '\n', { mode: 0o600 });
+        _deps.setup.clearSetupCache(); // so next / request goes to dashboard
+        _deps.telemetry.track('ctm_setup_save', { has_key: !!(apiKey || gw), has_model: !!walleModel });
+
+        // Persist provider config through Wall-E, which owns its brain DB.
+        try {
+          await _deps.walleClient.requestJson('/api/wall-e/setup/config', {
+            method: 'POST',
+            body: {
+              provider: walleProvider,
+              model: walleModel,
+              ownerName,
+              providerConfig: walleProvider ? {
+                id: `${walleProvider}-default`,
+                baseUrl: gw ? gw.base_url : null,
+                apiKeyEncrypted: gw ? gw.auth_token : (apiKey || null),
+                customHeaders: gw ? gw.custom_headers_b64 : null,
+              } : null,
+            },
+          });
+        } catch (dbErr) {
+          console.error('[setup] Failed to persist Wall-E config:', dbErr.message);
+        }
+
+        // Restart Wall-E so it picks up new config
+        if (apiKey || gw || walleModel || walleProvider) {
+          _deps.walleSupervisor.restartQuiet();
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true }));
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: e.message }));
+      }
+    });
+    return;
+  }
+
+// WP-5 shard S2: the three verbatim bodies above are appended here by
+// bin/move-only-check.js's proof (identical to server.js's declarations up to
+// the `_deps.` prefix).
+module.exports = { configure, register, apiSetupTestKey, apiSetupDetectKey, apiSetupSave };