fix: offer the Anthropic API key instead of demanding it

[Desperado]

Summary

After logging in to QualityMax, qmax-code demanded an Anthropic API key before it would start: the startup prompt had no skip, and answering it empty hard-exited the process. The key is now offered, never demanded — skipping is a supported state that lands in the REPL, where inference can be configured at any time.

Why now

User-reported: after first login and later re-authorization, the CLI kept asking for an Anthropic key with no ability to skip. Every alternative backend (Claude Code, Codex, Antigravity, opencode, Cerebras, Ollama) runs without one, so the demand dead-ended exactly the users who didn't need it. Onboarding also asked for the key separately from the startup prompt, so first runs were asked twice and then kicked out.

Key changes

• Startup key prompt is a paste-or-skip chooser, asked at most once per process (startup stays quiet when onboarding already offered the key); skipping prints the /keys, /orch, /cerebras, /ollama paths and continues into the REPL instead of exiting
• Onboarding step 3 shows the same paste-or-skip choice and names the keyless backends
• New REPL turn pre-check (embeddedInferenceAvailable): a turn with no inference backend is refused with actionable guidance instead of failing mid-request with a raw 401
• Offer/exit conditions extracted into shouldOfferAnthropicKey / shouldExitWithoutInference with table tests; onboarding keychain writes go through a test seam
• Headless one-shot runs without any inference still fail fast, with the error reworded to list the keyless backend options

Risks / notes

• Interactive runs that skip the key now start a REPL whose AI turns refuse with guidance — intentional, but it turns a hard exit into a degraded-but-usable session
• Standalone local mode without Ollama follows the same offer/skip path; its skip message points at the ollama_url / ollama_model config
• internal/update.TestExtractBinaryZip fails on current main independent of this change; expect that one red in CI

Review instructions

Start with the offer/exit block in main.go (shouldOfferAnthropicKey / shouldExitWithoutInference and their call site), then promptAnthropicKey in internal/setup/interactive.go, then the turn guard + embeddedInferenceAvailable in internal/repl/repl.go. The predicates carry the behavior contract; the table tests in main_validation_test.go, interactive_test.go, and backend_switch_test.go pin each branch.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: evidence-backed scan

Files eligible: 7 · Files reviewed: 7 · Files with findings: 0 · Findings: 0 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 6, reviewed 6 · LLM · served gemini-3.1-flash-lite
SAST	completed · eligible 7, reviewed 7 · hybrid · served qwen3.7-plus
Overall review evidence	clean
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Change diagram — Flow

graph TD
    Start[Start Startup] --> CheckInteractive{Interactive?}
    CheckInteractive -- Yes --> Onboarding[RunInteractive]
    Onboarding --> OfferKey{Offer Anthropic Key}
    OfferKey -->|Skip| Continue[Continue to REPL]
    OfferKey -->|Paste| SaveKey[Save Key]
    SaveKey --> Continue
    CheckInteractive -- No --> Headless{Headless?}
    Headless -- Yes --> CheckInference{Inference Available?}
    CheckInference -- No --> Exit[Exit with Error]
    CheckInference -- Yes --> Run[Run Turn]
    Continue --> CheckInference

Loading

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: VERIFIED independently judged patch · REPRODUCED verified finding · GROUNDED deterministic evidence · MODEL-ONLY model judgment.

QualityMax project results are available in the configured project.

_{Receipt · commit 4013e65747f01156a8b5784f1bd747d0c3eaa749 · run 2026-09-15T13:31:11+00:00 · model served qwen3.7-plus, gemini-3.1-flash-lite · model requested qwen3.7-plus, gemini-3.1-flash-lite · model review recorded — 1334 model output tokens · model source repository ai_review_preferences.preferred_model · re-review 2 · proof counts {}}

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	✅ Clean · gemini-3.1-flash-lite · completed · 6 eligible / 6 reviewed · gemini-3.1-flash-lite
🔍 SAST	completed · 7 eligible / 7 reviewed · qwen3.7-plus
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5210608812 and overview #5680954116 confirmed
🧪 Repo Tests	✅ 839/839 passed (go)

_{Powered by QualityMax — AI-Powered Test Automation}