From 2b18ca38dc09633b1ab216ac87aac429e9a5eb08 Mon Sep 17 00:00:00 2001
From: "Molecule AI Dev Engineer A (Kimi)"
 <dev-engineer-a-kimi@agents.moleculesai.app>
Date: Thu, 4 Jun 2026 21:17:20 +0000
Subject: [PATCH 1/2] fix(canvas): platform-managed provider must not
 require/show/send credential (#2245)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CreateWorkspaceDialog treated all providers with envVars as BYOK,
blocking submission, showing a credential input, and sending an empty
secrets payload for platform-managed providers whose token is injected
by the control-plane provisioner.

Changes:
- Add isPlatformManagedProvider() discriminator to ProviderModelSelector.
- Skip validation when provider is platform-managed.
- Hide credential input and show "Platform-managed — no key required".
- Omit secrets from POST body for platform-managed providers.
- Add vitest regression tests for all three behaviors + BYOK regression.

Closes #2245

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .../src/components/CreateWorkspaceDialog.tsx  | 11 ++-
 .../src/components/ProviderModelSelector.tsx  |  4 +
 .../__tests__/CreateWorkspaceDialog.test.tsx  | 91 +++++++++++++++++++
 3 files changed, 103 insertions(+), 3 deletions(-)

diff --git a/canvas/src/components/CreateWorkspaceDialog.tsx b/canvas/src/components/CreateWorkspaceDialog.tsx
index f03e61924..47f47f6ad 100644
--- a/canvas/src/components/CreateWorkspaceDialog.tsx
+++ b/canvas/src/components/CreateWorkspaceDialog.tsx
@@ -10,6 +10,7 @@ import {
   buildProviderCatalog,
   buildProviderCatalogFromRegistry,
   findProviderForModel,
+  isPlatformManagedProvider,
   type SelectorModel,
   type SelectorValue,
   type RegistryProvider,
@@ -290,7 +291,7 @@ export function CreateWorkspaceButton() {
       setError("Model is required");
       return;
     }
-    if (!isExternal && selectedLLMProvider?.envVars.length && !llmSecret.trim()) {
+    if (!isExternal && !isPlatformManagedProvider(selectedLLMProvider) && selectedLLMProvider?.envVars.length && !llmSecret.trim()) {
       setError("Provider credential is required");
       return;
     }
@@ -325,7 +326,7 @@ export function CreateWorkspaceButton() {
           ? {
               model: llmSelection.model.trim(),
               llm_provider: nativeProvider.vendor,
-              ...(nativeProvider.envVars.length > 0
+              ...(!isPlatformManagedProvider(nativeProvider) && nativeProvider.envVars.length > 0
                 ? { secrets: { [nativeProvider.envVars[0]]: llmSecret.trim() } }
                 : {}),
             }
@@ -521,7 +522,11 @@ export function CreateWorkspaceButton() {
                   idPrefix="create-workspace-llm"
                   variant="stack"
                 />
-                {selectedLLMProvider.envVars.length > 0 && (
+                {isPlatformManagedProvider(selectedLLMProvider) ? (
+                  <p className="text-[11px] text-ink-mid">
+                    Platform-managed — no key required
+                  </p>
+                ) : selectedLLMProvider.envVars.length > 0 && (
                   <div>
                     <label htmlFor="llm-secret-input" className="text-[11px] text-ink-mid block mb-1">
                       {selectedLLMProvider.envVars[0]}
diff --git a/canvas/src/components/ProviderModelSelector.tsx b/canvas/src/components/ProviderModelSelector.tsx
index 1bb677be8..7806dd602 100644
--- a/canvas/src/components/ProviderModelSelector.tsx
+++ b/canvas/src/components/ProviderModelSelector.tsx
@@ -345,6 +345,10 @@ export function buildProviderCatalogFromRegistry(
   return Array.from(buckets.values());
 }
 
+export function isPlatformManagedProvider(p?: { vendor?: string; billingMode?: string }): boolean {
+  return p?.vendor === "platform" || p?.billingMode === "platform_managed";
+}
+
 /** Find the provider entry that contains a given model id. Used by
  *  callers to back-derive the provider when only the model is known
  *  (e.g. ConfigTab loading from saved state). */
diff --git a/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx b/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx
index 9eb4d18f8..9719812bd 100644
--- a/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx
+++ b/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx
@@ -657,3 +657,94 @@ describe("CreateWorkspaceDialog — budget_limit field", () => {
     expect(budgetInput.value).toBe("");
   });
 });
+
+// ---------------------------------------------------------------------------
+// Platform-managed provider credential gate (#2245)
+// ---------------------------------------------------------------------------
+
+const PLATFORM_MANAGED_TEMPLATE = {
+  id: "platform-test",
+  name: "Platform Test",
+  runtime: "claude-code",
+  model: "moonshot/kimi-k2.6",
+  providers: ["platform"],
+  models: [
+    { id: "moonshot/kimi-k2.6", name: "Kimi K2.6", provider: "platform", required_env: ["MOLECULE_LLM_USAGE_TOKEN"] },
+  ],
+};
+
+describe("CreateWorkspaceDialog — platform-managed provider (#2245)", () => {
+  beforeEach(() => {
+    mockGet.mockImplementation(async (url: string) => {
+      if (url === "/templates") {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return [PLATFORM_MANAGED_TEMPLATE] as any;
+      }
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      return SAMPLE_WORKSPACES as any;
+    });
+  });
+
+  it("does NOT require a credential for platform-managed provider", async () => {
+    await openDialog();
+    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
+      target: { value: "Platform Agent" },
+    });
+
+    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
+    fireEvent.click(createBtn!);
+
+    await waitFor(() => expect(mockPost).toHaveBeenCalled());
+    expect(screen.queryByRole("alert")).toBeNull();
+  });
+
+  it("does NOT render the credential input for platform-managed provider", async () => {
+    await openDialog();
+    expect(document.getElementById("llm-secret-input")).toBeNull();
+    expect(screen.getByText("Platform-managed — no key required")).toBeTruthy();
+  });
+
+  it("does NOT send secrets in POST body for platform-managed provider", async () => {
+    await openDialog();
+    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
+      target: { value: "Platform Agent" },
+    });
+
+    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
+    fireEvent.click(createBtn!);
+
+    await waitFor(() => expect(mockPost).toHaveBeenCalled());
+    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
+    expect(body.secrets).toBeUndefined();
+    expect(body.llm_provider).toBe("platform");
+    expect(body.model).toBe("moonshot/kimi-k2.6");
+  });
+
+  it("still requires a credential for BYOK provider", async () => {
+    mockGet.mockImplementation(async (url: string) => {
+      if (url === "/templates") {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return [SAMPLE_TEMPLATES[0]] as any;
+      }
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      return SAMPLE_WORKSPACES as any;
+    });
+
+    await openDialog();
+    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
+      target: { value: "BYOK Agent" },
+    });
+    fireEvent.change(document.querySelector("[data-testid='provider-select']") as HTMLSelectElement, {
+      target: { value: "minimax|MINIMAX_API_KEY" },
+    });
+
+    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
+    fireEvent.click(createBtn!);
+
+    await waitFor(() => {
+      const alert = screen.getByRole("alert");
+      expect(alert.textContent).toContain("Provider credential is required");
+    });
+    expect(mockPost).not.toHaveBeenCalled();
+  });
+});
-- 
2.52.0


From b3cc713fbf9d18c0bf6b9691a156d7a76cab8470 Mon Sep 17 00:00:00 2001
From: "Molecule AI Dev Engineer A (Kimi)"
 <dev-engineer-a-kimi@agents.moleculesai.app>
Date: Thu, 4 Jun 2026 22:57:06 +0000
Subject: [PATCH 2/2] test(canvas): select template in platform-managed
 provider tests so LLM catalog loads (#2254 CI fix)

---
 canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx b/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx
index 9719812bd..c7945d5dd 100644
--- a/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx
+++ b/canvas/src/components/__tests__/CreateWorkspaceDialog.test.tsx
@@ -687,6 +687,7 @@ describe("CreateWorkspaceDialog — platform-managed provider (#2245)", () => {
 
   it("does NOT require a credential for platform-managed provider", async () => {
     await openDialog();
+    await setTemplate("platform-test");
     fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
       target: { value: "Platform Agent" },
     });
@@ -700,12 +701,14 @@ describe("CreateWorkspaceDialog — platform-managed provider (#2245)", () => {
 
   it("does NOT render the credential input for platform-managed provider", async () => {
     await openDialog();
+    await setTemplate("platform-test");
     expect(document.getElementById("llm-secret-input")).toBeNull();
     expect(screen.getByText("Platform-managed — no key required")).toBeTruthy();
   });
 
   it("does NOT send secrets in POST body for platform-managed provider", async () => {
     await openDialog();
+    await setTemplate("platform-test");
     fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
       target: { value: "Platform Agent" },
     });
-- 
2.52.0