Allow headless commands with connected BYOK providers (fixes #22)

[nandal]

Summary

Fixes #22.

Headless entry points (--scan, --hack, --plan, --agent) previously gated execution strictly on settings.openhack_api_key. When using a BYOK provider (such as OpenAI, Anthropic, Ollama, etc.), model calls only use the provider's resolved credentials and never touch openhack_api_key. Gating on openhack_api_key alone prevented using BYOK providers in CI or headless environments without an OpenHack account key.

Changes

• Replaced the repetitive openhack_api_key gate across _cmd_scan, _cmd_hack, _cmd_plan, and _cmd_agent with a unified _require_auth() helper in openhack/__main__.py.
• For BYOK providers (settings.llm_provider != "openhack"), verify connection via providers.is_connected(settings.llm_provider). If credentials or required environment variables are missing, display an informative error pointing to the specific environment variable required.
• In openhack/config.py, mapped user-saved provider config to LLM_PROVIDER in _build_settings so persisted provider choices apply to headless scans.
• In openhack/providers.py, allowed keyless local providers when LLM_PROVIDER is set in environment.
• Added unit tests in tests/test_cli_dispatch.py verifying auth handling for both connected/disconnected BYOK providers and logged in/out OpenHack accounts.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] Refactors authentication checks for headless commands.

Fix the rejection of keyless providers selected through .env before merging.

Findings

1.  Keyless commands reject `.env` settings ▶
2.  Saved credentials break the test ▶

Fix with agent prompt

### Issue 1
openhack/__main__.py:30-31
If `LLM_PROVIDER=ollama` is set in `.env`, with no saved provider or `OLLAMA_API_KEY`, `_require_auth()` rejects a valid keyless setup. `Settings` reads `.env`, but `is_connected()` checks only saved config and `os.environ`. All four headless commands stop and ask for a key that Ollama does not need. This also breaks runs that previously passed with an OpenHack key.

Use the resolved provider selection for the keyless check and add a `.env` regression test.

### Issue 2
tests/test_cli_dispatch.py:123
This test patches `all_credentials()`, but `is_connected()` calls `get_credential()`, which reads saved credentials directly. If a developer has a saved OpenAI API key or ChatGPT login, `_require_auth()` returns `True` and the test fails despite working code.

Patch `openhack.providers.get_credential` to return `None`, or give the test an isolated credential store.

```suggestion
    monkeypatch.setattr("openhack.providers.get_credential", lambda name: None)
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR lets headless commands use connected BYOK providers instead of requiring an OpenHack account key.

• Headless commands can use connected BYOK providers.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Headless command] --> B[Read settings.llm_provider]
  B --> C{OpenHack?}
  C -->|Yes| D[Check OpenHack key]
  C -->|No| E[Check providers.is_connected]
  D --> F{Accepted?}
  E --> F
  F -->|Yes| G[Run command with selected provider]
  F -->|No| H[Print setup error and stop]

Loading

_{Reviews (1) · Last reviewed commit: "Allow headless commands with connected B..." · Reviewed by Greptile}

[greptile-apps]

Keyless commands reject .env settings

If LLM_PROVIDER=ollama is set in .env, with no saved provider or OLLAMA_API_KEY, _require_auth() rejects a valid keyless setup. Settings reads .env, but is_connected() checks only saved config and os.environ. All four headless commands stop and ask for a key that Ollama does not need. This also breaks runs that previously passed with an OpenHack key.

Use the resolved provider selection for the keyless check and add a .env regression test.

Prompt To Fix With AI

This is a comment left during a code review.
Path: openhack/__main__.py
Line: 30-31

Comment:
**Keyless commands reject `.env` settings**

If `LLM_PROVIDER=ollama` is set in `.env`, with no saved provider or `OLLAMA_API_KEY`, `_require_auth()` rejects a valid keyless setup. `Settings` reads `.env`, but `is_connected()` checks only saved config and `os.environ`. All four headless commands stop and ask for a key that Ollama does not need. This also breaks runs that previously passed with an OpenHack key.

Use the resolved provider selection for the keyless check and add a `.env` regression test.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Saved credentials break the test

This test patches all_credentials(), but is_connected() calls get_credential(), which reads saved credentials directly. If a developer has a saved OpenAI API key or ChatGPT login, _require_auth() returns True and the test fails despite working code.

Patch openhack.providers.get_credential to return None, or give the test an isolated credential store.

Suggested change

	monkeypatch.setattr("openhack.provider_auth.all_credentials", lambda: {})
	monkeypatch.setattr("openhack.providers.get_credential", lambda name: None)

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_cli_dispatch.py
Line: 123

Comment:
**Saved credentials break the test**

This test patches `all_credentials()`, but `is_connected()` calls `get_credential()`, which reads saved credentials directly. If a developer has a saved OpenAI API key or ChatGPT login, `_require_auth()` returns `True` and the test fails despite working code.

Patch `openhack.providers.get_credential` to return `None`, or give the test an isolated credential store.

```suggestion
    monkeypatch.setattr("openhack.providers.get_credential", lambda name: None)
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.