Preflight rejects the Claude Code subscription path: `--no-deploy` run fails with "ANTHROPIC_API_KEY MISSING" despite "Brain ok — riding your Claude Code login"

[ciprianmelian]

The outer environment check (bin/explainmyrepo.mjs:166) and the brain client (src/claude.mjs) both support running the brain stations on a logged-in Claude Code install with no API key — callClaude() auto-selects claude -p when no key is set, and the help text advertises this. But the orchestrator's credential preflight never learned about that path:

// src/orchestrator.mjs:160
if (brainIds.some((id) => ids.has(id)) && !has(['ANTHROPIC_API_KEY', 'CLAUDE_API_KEY'])) {

Repro: on a machine with a logged-in Claude Code CLI and no ANTHROPIC_API_KEY:

npx explainmyrepo https://github.com/PrimeIntellect-ai/prime-agent --no-deploy

→ the first preflight prints ✓ Brain ok — no API key, riding your Claude Code login, then the station preflight aborts with MISSING ANTHROPIC_API_KEY … nothing was built.

Fix (verified locally against 0.5.0 — build proceeds through the stations on the CLI brain):

-import { resolveModel } from './claude.mjs';
+import { resolveModel, claudeCliAvailable } from './claude.mjs';
...
-  if (brainIds.some((id) => ids.has(id)) && !has(['ANTHROPIC_API_KEY', 'CLAUDE_API_KEY'])) {
+  if (brainIds.some((id) => ids.has(id)) && !has(['ANTHROPIC_API_KEY', 'CLAUDE_API_KEY']) && !claudeCliAvailable()) {

[stuinfla]

Fixed in bbf8acb / f7c3dda. Thank you — and apologies for the 43 hours of silence on a report that arrived with the file, the line, and the fix already in it.

You were right, including about the cause. src/claude.mjs has always routed to a logged-in Claude CLI when no API key is present. The preflight in src/orchestrator.mjs independently re-implemented only the key check, so it refused you before the layer that would have worked for you ever ran.

What I changed, and why it's slightly more than your patch. Adding the CLI branch to the preflight would have fixed your symptom. But the actual defect was that "can the brain run?" was answered in two places, so one of them could be taught something the other never learned. There is now a single exported resolveBrainLane() that both callers ask, plus a source-shape test that fails if the orchestrator ever goes back to deriving it itself.

That turned out to matter within the same day: the default authoring model is now an OpenRouter one, and without the shared predicate a user with only an OPENROUTER_API_KEY would have hit your exact bug in a new costume — refused at the door by a gate holding a stale list of valid credentials.

The refusal message now names both lanes and says plainly that the CLI path needs no key at all — the thing you had to read source to discover.

Also fixed alongside, because it would have hit you the moment you got past the door: temperature is now deprecated on claude-sonnet-5 and returns HTTP 400, which killed every local run at the first brain station (#17).