Enable managed auth in production

[twilson63]

Flips VITE_MANAGED_AUTH to "true". Users sign in with Clerk (Google) and the server provisions a per-user OpenRouter key, so nobody pastes their own.

Rollback is the same line back to "false" — one deploy, no data migration. Projects live in IndexedDB and are untouched either way.

The Phase 2 COEP spike passes

Open since June, and the thing gating this whole rollout. I served a real VITE_MANAGED_AUTH=true production build behind the same COEP: require-corp / COOP: same-origin headers render.yaml sets, and drove it in Chrome:

Check	Result
crossOriginIsolated	true — WebContainers still work
Clerk chunks load	yes, same-origin
External origins requested	none
Blocked by COEP	none

The no-rhc + bundled @clerk/ui approach does exactly what it was meant to. Managed mode also builds cleanly: ~240 code-split chunks, 4.4 MB total, none of it in the entry chunk.

Worth noting the sign-in gate already forces oauthFlow: 'redirect' — COOP: same-origin severs window.opener, so popup OAuth could never report back and Google sign-in would hang. That was handled before I got here.

What this does NOT validate

• The OAuth redirect round-trip. It leaves the origin and comes back; a placeholder key can't exercise it.
• The managed agent loop. /api/agent/step, web_search, web_fetch, and web_post have only ever seen fixtures. Everything validated live so far went through BYOK.

So this deploy is the first time that code serves a real request. Verified already: the API is deployed and healthy (/api/health → 200) and rejects unauthenticated calls cleanly (/api/me → 401).

First-run checklist after deploy

1. Sign in with Google → lands back in the app, not on the Account Portal
2. First turn provisions an OpenRouter key (server log: lazy-provisioning user …)
3. A multi-step turn completes — this exercises the step-token HMAC round-trip for real
4. web_search needs BRAVE_SEARCH_API_KEY or it reports itself unavailable (web_fetch/web_post are unaffected)
5. web_post approval — the one gated tool

🤖 Generated with Claude Code

https://claude.ai/code/session_019gS8yjMedGgujEad6zRD7i

[hyperio-mc]

Review

This is the managed-auth production flip — one config value from false to true, plus updated documentation. Exactly the separation PR #37 recommended.

What's good

Minimal and correct. 2 files, +28/-5. The actual code change is a single value in render.yaml ("false" -> "true"). The rest is documentation updates that record the COEP spike results, what's validated vs not, and the rollback procedure.

COEP spike is thorough. Served a real VITE_MANAGED_AUTH=true production build behind the same COEP/COOP headers, verified crossOriginIsolated=true (WebContainers still work), Clerk chunks load same-origin, zero external origins requested, nothing blocked. The no-rhc + bundled @clerk/ui approach is validated.

Rollback is trivial. Flip the value back to "false" — one deploy, no data migration. Projects live in IndexedDB and are untouched. This is the right risk profile for a production flip.

The comment update is excellent. It documents what must be true in the dashboards (VITE_CLERK_PUBLISHABLE_KEY set, Google enabled as Clerk social connection with your own OAuth credentials), and notes that unset publishable key silently falls back to BYOK because isManagedAuthEnabled() requires both. Future operators won't be confused by a silent fallback.

Honest about gaps. The PR body explicitly lists what this does NOT validate: the OAuth redirect round-trip (can't be tested with placeholder keys) and the managed agent loop (only seen fixtures). The first-run checklist is concrete and actionable.

oauthFlow: 'redirect' already handled. COOP: same-origin severs window.opener, so popup OAuth can't report back. This was handled before — the redirect flow is already forced. Good that it was checked.

CI: all green

3 checks pass — gleam+vitest+build (32s), server (41s), smoke browser (1m31s).

Verdict

This is the cleanest possible production flip — one config value, thorough validation behind it, trivial rollback, honest documentation of remaining gaps. The first-run checklist is the right post-merge plan.

Looks good to merge.

Reviewed by MC Agent