fix(cloud): gate ensureElizaAppProvisioning on credits (return insufficient_credits, don't 500 onboarding) (#11499)

[NubsCarson]

Closes #11499.

The gap

ensureElizaAppProvisioning (packages/cloud/shared/src/lib/services/eliza-app/provisioning.ts) was the only provisioning entry point that skipped the otherwise-universal checkAgentCreditGate — every other create/provision/resume/wake/restart path runs the gate before createAgent. It is reached from the public onboarding chat (runOnboardingChat, onboarding-chat.ts), so a drained returning org (starter grant already consumed, no live sandbox) could still mint a container. And because runOnboardingChat has no enclosing try/catch, a throwing gate would have 500'd the whole onboarding turn — hence the return-a-status design below.

Fix (as prescribed by @lalalune on #11499)

provisioning.ts — after ensureElizaAppStarterCredits (so fresh orgs get the $5 grant and pass the $0.10 MINIMUM_DEPOSIT gate) and after the existing-sandbox early return (so an org with a live sandbox still gets it back untouched), call checkAgentCreditGate(organizationId) before createAgent. On !allowed, log a warn and return { status: "insufficient_credits", agentId: null, bridgeUrl: null, sandbox: null } instead of throwing. The reuse guard and the enqueue-throw cleanup are unchanged.

onboarding-chat.ts — mapped the new status in the reply path:

• fallbackReply: new branch → "You're out of credits… Add credits at <app>/dashboard/billing and I'll start your private agent." (reuses ELIZA_APP_PRICING_SUMMARY + the existing onboardingAppPath helper).
• generateOnboardingReply: early deterministic return for insufficient_credits (money-state copy stays exact — the model never improvises billing links/amounts).

Type note: ElizaAppProvisioningStatus.status is typed string (not a literal union), and every consumer does plain === checks ("running", "error", "none") — no exhaustive switch anywhere, so the new value is additive-safe. publicElizaAppProvisioningPayload passes it through and already omits the null agentId/bridgeUrl, so the wire payload for a denial is { status: "insufficient_credits" } — consistent with the canonical insufficient_credits code used by the 402 body and cron agent-billing.

Tests (provisioning.test.ts)

• New: drained returning org (grant already consumed → starter credits no-op, no sandbox, gate !allowed) → createAgent/enqueueAgentProvision/addCredits NOT called, result is exactly the insufficient_credits status.
• Extended: fresh-org test now mocks the gate allowed and asserts it was called — grant lands before the gate, so fresh orgs still provision.
• Extended: existing-sandbox test asserts the gate is NOT called — a drained org with a live sandbox still gets it back (early return sits before the gate).
• Gate mocked via the file's existing mock.module pattern (../agent-billing-gate), reset in beforeEach like the other mocks.

Files

• packages/cloud/shared/src/lib/services/eliza-app/provisioning.ts
• packages/cloud/shared/src/lib/services/eliza-app/onboarding-chat.ts
• packages/cloud/shared/src/lib/services/eliza-app/provisioning.test.ts

Caveat

Local typecheck/tests couldn't run (box at 100% disk, worktree has no node_modules); static-verified by grep (export exists, CreditGateResult.allowed/.balance shape matches usage, no exhaustive status switches, onboarding-chat.test.ts fully mocks ./provisioning so the new import chain doesn't leak there). CI must confirm typecheck + provisioning.test.ts.

@lalalune — this is your prescribed approach from #11499 verbatim; flagging for your review. Not self-merging.

— [cloud-security]

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: caf61700-0c3e-4ae2-ac5f-a271229529e3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nubs/eliza-app-provisioning-credit-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.