The provider step was filtered to API_KEY only, which hid GitHub
Copilot, Google Antigravity, and GPT account from the founding-CEO
runtime picker even though they are first-class providers in the
catalog. Show every non-cloud provider, render an "Access token" field
in place of the API-key field for OAuth and account auths, and surface
a button that opens the provider's official sign-in page via the new
openExternalUrl IPC (validated to http(s) only).
OnboardingService.resolveProvider now accepts any non-cloud auth type.
Cloud providers still route through Settings since their multi-field
config does not fit the linear onboarding step.
The catalog only carried one defaultModel string per provider, which
forced users to type model ids by hand and made the onboarding /
providers panel feel like the original AgentCompany was missing models.
- src/shared/provider-models.ts holds the canonical id/name list per
provider key (~165 entries across OpenAI, Anthropic, xAI, Groq,
GitHub Copilot, Antigravity, GPT account, Azure, Bedrock, Vertex)
- ProviderCatalogEntry now exposes a models[] array
- Onboarding ProviderStep renders a <select> populated from the active
provider's catalog instead of a freeform text input
- ProvidersPanel connect dialog uses the same picker for API key,
OAuth, and account auth flows
- TeamPage hire dialog adds a <datalist> with every catalog model so
manual entry is autocompletable
OAuth, account, and cloud providers previously fell into the same
password input as API key providers, which made them impossible to
connect properly. Split the connect dialog by auth type:
- api_key: secret + model (unchanged)
- oauth_pkce / account_subscription: button that opens the provider's
official sign-in URL in a session-partitioned BrowserWindow, then a
paste field for the access token returned by the provider
- cloud: multi-field form (base URL, region, project, deployment,
credential) serialized into the encrypted secret payload
Each catalog entry now carries signInUrl and credentialHelp so the
dialog can render the right instructions without baking copy into the
renderer.
Backed by a new launchProviderSignIn IPC method on ProviderService that
opens a hardened popup (nodeIntegration off, contextIsolation on,
sandbox on, permission denies) and records an audit event.
ZacharyZhang-NY
