feat(ui): add instance-scoped provider manager from model selector#476
Conversation
Move provider authentication management out of global settings and into the model selector so the flow always runs against a live OpenCode instance with project-specific provider state. This lets users inspect configured providers, start new connections, and complete OAuth flows directly from the place where model selection fails or needs additional setup. Implement a provider manager modal launched from the model selector footer, with source-aware configured provider handling, provider auth discovery, API-key and OAuth connection flows, cancellable OAuth waiting, and config-driven restrictions for providers declared in opencode.jsonc or environment variables. The UI keeps the existing square-corner visual language, shows richer provider details in the connect picker, and refreshes provider state through global dispose after auth changes so newly connected providers appear immediately. Validation: npm run typecheck --workspace @codenomad/ui; npm run build --workspace @codenomad/ui
|
I want you to perform the gatekeeper checks for latest PR state check for regressions |
|
Gatekeeper review for latest PR state. Understood request: review PR #476 ruthlessly for regressions and implementation quality. I did not make code changes. Findings:
Impact: any provider OAuth method that requires prompt data can render UI fields, accept user input, then authorize without those values. That flow will fail or silently use incomplete auth details. This needs either an SDK/API update that supports prompt inputs end-to-end, or a different request path that explicitly sends those fields.
Impact: if the user starts an auto OAuth wait and closes via the visible X button, the callback request can keep running after the modal is closed, then refresh providers/reset state later. Reopening can also expose stale flow state until another path resets it. The close button should go through the same close handler/reset path as Escape/overlay close.
This path is currently hidden for Quality concerns:
Validation:
Gatekeeper verdict: changes requested. I would not merge until findings 1 and 2 are fixed; finding 3 should also be corrected while touching the same provider auth integration. -- |
Prevent the provider manager modal from leaving stale OAuth work behind by routing the header close button through the shared dialog close handler, which now consistently resets local state and aborts any in-flight OAuth callback wait before the modal disappears. Align the source-aware disconnect path with the pinned SDK contract by sending config updates under the expected config payload key. Also stop advertising prompt-based OAuth methods as working in this SDK build: when a provider requires extra OAuth prompt inputs, the modal now explains that the current client cannot submit them instead of collecting values that would be dropped from the request. Validation: npm run typecheck --workspace @codenomad/ui; npm run build --workspace @codenomad/ui
|
check again |
|
PR builds are available as GitHub Actions artifacts: https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/25995220743 Artifacts expire in 7 days.
|
|
Follow-up gatekeeper review for latest PR state ( Understood request: re-check the PR after the latest push and verify the prior gatekeeper findings. I did not make code changes. Status of prior findings:
Remaining finding:
Impact: on web/remote UI, clicking Continue can move the flow to code/waiting while no provider auth page opens and the user has no link to click or copy. This is especially risky because the feature is now launched from the model selector and is expected to work against live instances, including non-Tauri access. Suggested fix: after authorization data is returned, render an explicit “Open authorization page” link/button using Quality notes:
Validation:
Gatekeeper verdict: changes still requested because of the browser OAuth launch/fallback issue. The previous blocking SDK integration issues are fixed, but OAuth should not rely on a post-await -- |
|
PR builds are available as GitHub Actions artifacts: https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/25995396978 Artifacts expire in 7 days.
|
Improve provider authentication behavior for web and remote browser hosts by pre-opening a popup synchronously on the user gesture, then navigating that popup once the OAuth authorization URL is returned. This avoids relying on post-await window.open behavior that popup blockers commonly reject. Keep the OAuth code and waiting states actionable even when the popup cannot be opened by surfacing explicit fallback controls to open the authorization page manually, redirect the current tab, or copy the link. The external URL helper now reports whether a browser-host open attempt actually succeeded so the modal can show clear blocked-popup guidance instead of leaving users stuck after Continue. Validation: npm run typecheck --workspace @codenomad/ui; npm run build --workspace @codenomad/ui
|
Check again |
|
Follow-up gatekeeper review for latest PR state ( Understood request: re-check after the latest push and verify the prior OAuth fallback blocker. I did not make code changes. Status of prior findings:
Remaining non-blocking concern:
Suggested fix: in the Quality notes:
Validation:
Gatekeeper verdict: no remaining merge-blocking findings from my review. I would prefer the popup cleanup fix before merge, but the previous blocker is materially addressed. -- |
|
PR builds are available as GitHub Actions artifacts: https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/25996595695 Artifacts expire in 7 days.
|
Improve provider OAuth handling for remote and browser-hosted sessions by pre-opening a popup synchronously on the user gesture and navigating it only after the authorization URL is returned. This preserves browser user activation for popup-based flows while still keeping local desktop behavior unchanged. Add explicit fallback actions in the OAuth waiting and code-entry states so users can continue even if popup launch fails: open the authorization page in a new tab, redirect the current tab, or copy the link. The external URL helper now reports whether browser-host launches actually succeed, allowing the modal to surface blocked-popup guidance instead of leaving the user stuck without a path forward. Validation: npm run typecheck --workspace @codenomad/ui; npm run build --workspace @codenomad/ui
|
PR builds are available as GitHub Actions artifacts: https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/25996972423 Artifacts expire in 7 days.
|
|
And now again |
|
Follow-up gatekeeper review for latest PR state ( Understood request: re-check after the latest push and verify the prior popup-cleanup concern. I did not make code changes. Status of prior findings:
Findings:
Quality notes:
Validation:
Gatekeeper verdict: approve from review standpoint. I do not see a reason to block merge on the current code state. -- |
1 participant
Summary
Validation