@@ -9295,33 +9328,46 @@ export default function App() {
{MODEL_GROUPS.map((group, groupIndex) => (
{groupIndex > 0 &&
}
-
{group.group}
- {group.items.map((model) => (
-
{
- if (model.disabled) return;
- setSelectedModel(model);
- setModelOpen(false);
- }}
- >
-
-
-
-
-
{model.label}
- {model.disabled ? (
-
{model.desc}
- ) : model.tag !== "default" && configuredProviders[model.tag] ? (
-
✓ API key saved — ready to use
- ) : (
-
{model.desc}
- )}
+
+ {group.group}
+ {SHARED_DEPLOYMENT && groupIndex === 0 ? " — unavailable in web app" : ""}
+
+ {group.items.map((model) => {
+ // Cloud items stay visible (so visitors know they
+ // exist) but unselectable here -- same reasoning
+ // as the Settings credential rows: no safe way to
+ // bring your own cloud key to a shared server.
+ const lockedByDeployment = SHARED_DEPLOYMENT && model.tag !== "default";
+ const isDisabled = model.disabled || lockedByDeployment;
+ return (
+
{
+ if (isDisabled) return;
+ setSelectedModel(model);
+ setModelOpen(false);
+ }}
+ >
+
+
+
+
+ {model.label}
+ {lockedByDeployment ? (
+ Unavailable in the web app
+ ) : model.disabled ? (
+ {model.desc}
+ ) : model.tag !== "default" && configuredProviders[model.tag] ? (
+ ✓ API key saved — ready to use
+ ) : (
+ {model.desc}
+ )}
+
-
- ))}
+ );
+ })}
))}
diff --git a/src/goldilocks_agent/server.py b/src/goldilocks_agent/server.py
index 029cf5e..17f44fc 100644
--- a/src/goldilocks_agent/server.py
+++ b/src/goldilocks_agent/server.py
@@ -346,6 +346,17 @@ async def get_chat_history(thread_id: str) -> dict:
@app.post("/api/credentials")
async def save_credential(request: CredentialRequest) -> dict:
+ # `~/.config/goldilocks/config.toml` is one file on the server, not a
+ # per-thread/per-user store (unlike the checkpointer) -- letting any
+ # visitor write to it in the shared deployment would mean the first
+ # person who opens Settings sets everyone else's provider key (their own
+ # account gets billed for the whole instance's traffic, silently). This
+ # deployment mode is LLM-locked to a fixed local model precisely so this
+ # can't come up (see resolve_model()'s env-var override) -- rejecting
+ # here too is defense in depth, not just the frontend happening not to
+ # show the field, same reasoning as `_reject_in_shared_deployment` below
+ # for projects/conversations.
+ _reject_in_shared_deployment()
write_credential(request.provider, request.api_key)
return {"ok": True}
@@ -353,6 +364,7 @@ async def save_credential(request: CredentialRequest) -> dict:
@app.get("/api/credentials")
async def get_credentials_status() -> dict[str, bool]:
"""Presence per provider only -- never returns the key itself."""
+ _reject_in_shared_deployment()
return configured_providers()
diff --git a/tests/test_server.py b/tests/test_server.py
index 1ac813b..d527408 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -56,6 +56,22 @@ def test_shared_deployment_blocks_projects_and_conversations_routes(
assert client.delete("/api/conversations/some-id").status_code == 404
+def test_shared_deployment_blocks_credentials_routes(tmp_path, monkeypatch) -> None:
+ """`~/.config/goldilocks/config.toml` is one file on the server, not a
+ per-thread/per-user store -- letting any visitor write to it on a shared
+ server would mean the first person who opens Settings sets everyone
+ else's provider key (their own account gets billed for the whole
+ instance's traffic, silently). Refused at the route, not just left
+ unused by the shared-mode frontend build."""
+ monkeypatch.setenv("GOLDILOCKS_AGENT_SHARED_DEPLOYMENT", "1")
+ with _make_client(tmp_path, monkeypatch) as client:
+ assert client.get("/api/credentials").status_code == 404
+ save_response = client.post(
+ "/api/credentials", json={"provider": "anthropic", "api_key": "sk-test"}
+ )
+ assert save_response.status_code == 404
+
+
def test_shared_deployment_skips_conversation_indexing(tmp_path, monkeypatch) -> None:
monkeypatch.setenv("GOLDILOCKS_AGENT_SHARED_DEPLOYMENT", "1")
calls = []