feat(reborn-cli): onboarding journey — keychain master key, two-prompt setup, login link

crates/ironclaw_llm/src/config.rs

@@ -458,6 +458,31 @@ impl LlmConfig {
                 .unwrap_or_else(|| self.nearai.model.clone()),
         }
     }
+
+    /// Resolve the base URL of the backend `serve` actually boots with, when
+    /// the backend has one.
+    ///
+    /// Mirrors `active_model_name`'s per-backend dispatch. Exists so callers
+    /// outside this crate (the boot-time resolved-LLM debug trace, tests)
+    /// can observe the base URL without reaching into backend-specific
+    /// fields directly. `bedrock` and `gemini_oauth` authenticate via the AWS
+    /// credential chain / a fixed Google OAuth endpoint rather than an
+    /// operator-configurable base URL, so they return `None`.
+    pub fn active_base_url(&self) -> Option<String> {
+        match self.backend.as_str() {
+            "nearai" | "near_ai" | "near" => Some(self.nearai.base_url.clone()),
+            "bedrock" | "aws_bedrock" | "aws" | "gemini_oauth" | "gemini-oauth" => None,
+            "openai_codex" | "openai-codex" | "codex" => self
+                .openai_codex
+                .as_ref()
+                .map(|cfg| cfg.api_base_url.clone()),
+            _ => self
+                .provider
+                .as_ref()
+                .map(|cfg| cfg.base_url.clone())
+                .or_else(|| Some(self.nearai.base_url.clone())),
+        }
+    }
 }
 
 /// NEAR AI configuration.
@@ -699,4 +724,107 @@ mod tests {
         assert_eq!(cfg.session_path, PathBuf::from("/tmp/sess.json"));
         assert_eq!(cfg.token_refresh_margin_secs, 60);
     }
+
+    /// Minimal `LlmConfig` with every optional backend-specific config left
+    /// `None` — the caller sets `backend` and populates whichever field the
+    /// case under test dispatches on.
+    fn base_llm_config(backend: &str) -> LlmConfig {
+        LlmConfig {
+            backend: backend.to_string(),
+            session: SessionConfig::default(),
+            nearai: NearAiConfig {
+                model: "test-model".to_string(),
+                cheap_model: None,
+                base_url: "https://cloud-api.near.ai".to_string(),
+                api_key: None,
+                fallback_model: None,
+                max_retries: 0,
+                circuit_breaker_threshold: None,
+                circuit_breaker_recovery_secs: 30,
+                response_cache_enabled: false,
+                response_cache_ttl_secs: 3600,
+                response_cache_max_entries: 1000,
+                failover_cooldown_secs: 300,
+                failover_cooldown_threshold: 3,
+                smart_routing_cascade: true,
+            },
+            provider: None,
+            bedrock: None,
+            gemini_oauth: None,
+            openai_codex: None,
+            request_timeout_secs: DEFAULT_REQUEST_TIMEOUT_SECS,
+            cheap_model: None,
+            smart_routing_cascade: true,
+            max_retries: 0,
+            circuit_breaker_threshold: None,
+            circuit_breaker_recovery_secs: 30,
+            response_cache_enabled: false,
+            response_cache_ttl_secs: 3600,
+            response_cache_max_entries: 1000,
+        }
+    }
+
+    /// `active_base_url` dispatches per-backend, mirroring `active_model_name`:
+    /// nearai aliases resolve to the nearai base URL, bedrock/gemini_oauth
+    /// have none (fixed credential chain / OAuth endpoint), openai_codex
+    /// reads its own config (or `None` when unset), a registry-backed
+    /// provider reads its config, and an unknown backend with no provider
+    /// config falls back to the nearai base URL.
+    #[test]
+    fn active_base_url_dispatches_backend_aliases_and_fallbacks() {
+        for alias in ["nearai", "near_ai", "near"] {
+            let cfg = base_llm_config(alias);
+            assert_eq!(
+                cfg.active_base_url().as_deref(),
+                Some("https://cloud-api.near.ai")
+            );
+        }
+
+        for backend in [
+            "bedrock",
+            "aws_bedrock",
+            "aws",
+            "gemini_oauth",
+            "gemini-oauth",
+        ] {
+            let cfg = base_llm_config(backend);
+            assert_eq!(cfg.active_base_url(), None);
+        }
+
+        let mut cfg = base_llm_config("openai_codex");
+        cfg.openai_codex = Some(OpenAiCodexConfig::build(
+            None,
+            None,
+            Some("https://codex.example".to_string()),
+            None,
+            None,
+            None,
+        ));
+        assert_eq!(
+            cfg.active_base_url().as_deref(),
+            Some("https://codex.example")
+        );
+
+        let cfg_no_codex_config = base_llm_config("codex");
+        assert_eq!(cfg_no_codex_config.active_base_url(), None);
+
+        let mut cfg = base_llm_config("openai");
+        cfg.provider = Some(RegistryProviderConfig::generic(
+            ProviderProtocol::OpenAiCompletions,
+            "openai",
+            None,
+            "https://api.openai.com/v1",
+            "gpt-test",
+        ));
+        assert_eq!(
+            cfg.active_base_url().as_deref(),
+            Some("https://api.openai.com/v1")
+        );
+
+        let cfg_unknown_no_provider = base_llm_config("some_unknown_backend");
+        assert_eq!(
+            cfg_unknown_no_provider.active_base_url().as_deref(),
+            Some("https://cloud-api.near.ai")
+        );
+    }
 }

crates/ironclaw_llm/src/resolution.rs

@@ -56,6 +56,18 @@ impl ResolvedProviderConfig {
             Self::Dedicated(config) => &config.model,
         }
     }
+
+    /// The resolved API key, if the provider carries one — the same value
+    /// (from env) that would otherwise only ever reach a live provider
+    /// client, exposed so a caller (onboard's env-detect step) can persist
+    /// it into the encrypted secret store rather than leaving it only in
+    /// the process's shell env.
+    pub fn api_key(&self) -> Option<&SecretString> {
+        match self {
+            Self::Registry(config) => config.api_key.as_ref(),
+            Self::Dedicated(config) => config.api_key.as_ref(),
+        }
+    }
 }
 
 /// Provider selection overrides supplied by a composition root.
@@ -420,7 +432,7 @@ fn apply_registry_provider_env(config: &mut RegistryProviderConfig) -> Result<()
 
 fn nearai_config_from_env(chain: &ChainSettings) -> Result<NearAiConfig, LlmError> {
     let api_key = nonempty_env("NEARAI_API_KEY").map(SecretString::from);
-    let base_url = default_nearai_base_url(api_key.is_some(), nonempty_env("NEARAI_BASE_URL"));
+    let base_url = default_nearai_base_url(nonempty_env("NEARAI_BASE_URL"));
     Ok(build_nearai_config(
         NearAiRuntimeFields {
             model: nonempty_env("NEARAI_MODEL").unwrap_or_else(|| crate::DEFAULT_MODEL.to_string()),
@@ -443,7 +455,7 @@ fn nearai_config_from_dedicated(
     } else {
         Some(resolved.base_url.clone())
     };
-    let base_url = default_nearai_base_url(api_key.is_some(), configured_base_url);
+    let base_url = default_nearai_base_url(configured_base_url);
 
     Ok(build_nearai_config(
         NearAiRuntimeFields {
@@ -487,19 +499,27 @@ fn build_nearai_config(fields: NearAiRuntimeFields, chain: &ChainSettings) -> Ne
 }
 
 pub const NEARAI_CLOUD_DEFAULT_BASE_URL: &str = "https://cloud-api.near.ai";
+/// No longer used by [`default_nearai_base_url`] (nearai always defaults to
+/// cloud regardless of key presence — see that function's doc comment).
+/// Kept only because `session.rs`'s OAuth/session-token auth URL default and
+/// v1 `src/` still reference it independently of provider-config base-URL
+/// resolution.
 pub const NEARAI_PRIVATE_DEFAULT_BASE_URL: &str = "https://private.near.ai";
 
-pub fn default_nearai_base_url(
-    api_key_present: bool,
-    configured_base_url: Option<String>,
-) -> String {
-    if let Some(base_url) = configured_base_url {
-        base_url
-    } else if api_key_present {
-        NEARAI_CLOUD_DEFAULT_BASE_URL.to_string()
-    } else {
-        NEARAI_PRIVATE_DEFAULT_BASE_URL.to_string()
-    }
+/// Resolve the nearai provider's base URL: an explicit override always wins,
+/// otherwise the cloud endpoint.
+///
+/// Used to key on API-key presence (cloud when a key was present, private
+/// otherwise), to match the session-token-only private backend's implicit
+/// no-key affordance. That coupling made resolution order load-bearing:
+/// whichever step attached the key had to run *before* this was called, and
+/// an operator-stored key (attached after resolution, from the secret store)
+/// always missed the window and landed on the keyless private default. There
+/// is now exactly one nearai default — cloud — so resolution order no longer
+/// matters and every caller (probe, resolution, snapshot display) agrees
+/// unconditionally.
+pub fn default_nearai_base_url(configured_base_url: Option<String>) -> String {
+    configured_base_url.unwrap_or_else(|| NEARAI_CLOUD_DEFAULT_BASE_URL.to_string())
 }
 
 fn is_registry_protocol(protocol: ProviderProtocol) -> bool {

crates/ironclaw_reborn_cli/Cargo.toml

@@ -106,6 +106,10 @@ chrono = { version = "0.4", features = ["serde"] }
 hex = "0.4.3"
 clap = { version = "4", features = ["derive", "env"] }
 clap_complete = "4.5.0"
+# Masked (echo-suppressed) API-key prompt in `onboard`. Same crate v1's setup
+# wizard uses for secret-input masking — reused here rather than adding a
+# second terminal-masking dependency.
+crossterm = "0.29"
 dotenvy = "0.15"
 ironclaw_reborn_composition = { path = "../ironclaw_reborn_composition", version = "0.1.0" }
 ironclaw_reborn_config = { path = "../ironclaw_reborn_config", version = "0.1.0" }
@@ -118,6 +122,7 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.11"
 tempfile = "3"
+thiserror = "2"
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "signal", "io-util", "io-std", "sync", "time"] }
 tokio-util = { version = "0.7", features = ["rt"] }
 tracing = "0.1"
@@ -145,6 +150,22 @@ ironclaw_reborn_composition = { path = "../ironclaw_reborn_composition", version
 # second, non-serializing lock domain (the #6015 flake). Dev-only: the lock is
 # reached solely from `#[cfg(test)]` code in `runtime::test_env`.
 ironclaw_common = { path = "../ironclaw_common", version = "0.4.2" }
+# Unconditional (not the feature-gated `dep:async-trait` optional dependency
+# above): `commands::onboard::mod`'s write-first-then-config-ordering test
+# implements a fake `ironclaw_secrets::SecretStore` whose `put` always fails,
+# needing `#[async_trait::async_trait]` in every feature combination `cargo
+# test` runs, not just under `webui-v2-beta`.
+async-trait = "0.1"
+# Same fake `SecretStore` impl takes `ResourceScope` / `SecretHandle` /
+# `Timestamp` in its trait method signatures.
+ironclaw_host_api = { path = "../ironclaw_host_api", version = "0.1.0" }
+# Same fake `SecretStore` impl (`FailingSecretStore` in `commands::onboard::mod`'s
+# tests) implements `ironclaw_secrets::SecretStore` directly; production
+# onboarding code only ever touches secrets through
+# `ironclaw_reborn_composition::LlmKeyStore`'s facade (`put_plaintext`), so
+# this stays a dev-only dependency — see
+# `crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs::reborn_cli_binary_crate_stays_separate_from_v1_root`.
+ironclaw_secrets = { path = "../ironclaw_secrets", version = "0.1.0" }
 
 [[bin]]
 name = "ironclaw-reborn"