topos: multi-provider local auth — picker, loopback OAuth, API key, Ollama

When 'latere topos --local' has no model credential it now shows a provider
picker (TUI): sign in with Claude (browser, loopback OAuth — no copy/paste),
paste an Anthropic API key, or use Ollama (local models, no key). The choice is
saved to ~/.config/latere/topos-provider.json and the agent uses it.

This fixes the 429: it lets you run on a dedicated credential (your own Claude
login, an API key with its own quota, or fully local Ollama) instead of the
shared CLAUDE_CODE_OAUTH_TOKEN that's rate-limited alongside Claude Code.

Credential order: ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN[_AUTO], saved
provider config. 'latere topos login' now uses loopback (no paste). One-shot/
non-TTY fails with a clear message instead of launching the TUI. OpenAI/Gemini
are omitted until their SDK adapters exist (today they're stubs). Tests cover the
picker, provider resolution, config round-trip, PKCE, and token store/refresh.

Author: changkun

internal/commands/topos_auth_tui.go

@@ -0,0 +1,159 @@
+// Copyright 2026 The Latere Authors. All rights reserved.
+// Use of this source code is governed by an Apache-2.0
+// license that can be found in the LICENSE file.
+
+package commands
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"github.com/charmbracelet/bubbles/textinput"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+)
+
+// The auth picker shown by `latere topos --local` when no model credential is
+// configured: choose a provider and sign in / enter a key, like opencode's auth
+// flow. Only providers whose SDK adapter actually works are offered (Anthropic,
+// Ollama); OpenAI/Gemini are pending their adapters.
+
+type authChoice int
+
+const (
+	authCancel authChoice = iota
+	authClaude            // Claude OAuth (browser)
+	authAPIKey            // Anthropic API key
+	authOllama            // local Ollama
+)
+
+type authResult struct {
+	choice authChoice
+	apiKey string
+}
+
+type authOption struct {
+	label  string
+	choice authChoice
+}
+
+type authModel struct {
+	options  []authOption
+	cursor   int
+	entering bool // true while typing an API key
+	input    textinput.Model
+	result   authResult
+}
+
+func newAuthModel() authModel {
+	in := textinput.New()
+	in.Placeholder = "sk-ant-api03-..."
+	in.Prompt = "API key: "
+	return authModel{
+		options: []authOption{
+			{"Sign in with Claude (opens your browser)", authClaude},
+			{"Use an Anthropic API key", authAPIKey},
+			{"Use Ollama (local models, no key)", authOllama},
+		},
+		input: in,
+	}
+}
+
+func (m authModel) Init() tea.Cmd { return nil }
+
+func (m authModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	key, ok := msg.(tea.KeyMsg)
+	if !ok {
+		return m, nil
+	}
+	if m.entering {
+		switch key.Type {
+		case tea.KeyEnter:
+			m.result = authResult{choice: authAPIKey, apiKey: strings.TrimSpace(m.input.Value())}
+			return m, tea.Quit
+		case tea.KeyEsc:
+			m.entering = false
+			return m, nil
+		}
+		var cmd tea.Cmd
+		m.input, cmd = m.input.Update(msg)
+		return m, cmd
+	}
+
+	switch key.String() {
+	case "ctrl+c", "q", "esc":
+		m.result = authResult{choice: authCancel}
+		return m, tea.Quit
+	case "up", "k":
+		if m.cursor > 0 {
+			m.cursor--
+		}
+	case "down", "j":
+		if m.cursor < len(m.options)-1 {
+			m.cursor++
+		}
+	case "enter":
+		sel := m.options[m.cursor].choice
+		if sel == authAPIKey {
+			m.entering = true
+			m.input.Focus()
+			return m, textinput.Blink
+		}
+		m.result = authResult{choice: sel}
+		return m, tea.Quit
+	}
+	return m, nil
+}
+
+var (
+	authTitle = lipgloss.NewStyle().Bold(true)
+	authSel   = lipgloss.NewStyle().Bold(true)
+	authDim   = lipgloss.NewStyle().Faint(true)
+)
+
+func (m authModel) View() string {
+	var b strings.Builder
+	b.WriteString(authTitle.Render("Sign in to Topos") + "  " + authDim.Render("choose a model provider") + "\n\n")
+	if m.entering {
+		b.WriteString(m.input.View() + "\n\n")
+		b.WriteString(authDim.Render("[enter] save   [esc] back") + "\n")
+		return b.String()
+	}
+	for i, o := range m.options {
+		cursor := "  "
+		label := o.label
+		if i == m.cursor {
+			cursor = "▸ "
+			label = authSel.Render(o.label)
+		}
+		b.WriteString(cursor + label + "\n")
+	}
+	b.WriteString("\n" + authDim.Render("[↑↓] move   [enter] select   [q] cancel") + "\n")
+	return b.String()
+}
+
+// runAuthPicker shows the provider picker and applies the choice: a Claude OAuth
+// login, a stored Anthropic API key, or Ollama. It returns an error if the user
+// cancels or the chosen step fails.
+func runAuthPicker(ctx context.Context) error {
+	p := tea.NewProgram(newAuthModel(), tea.WithContext(ctx))
+	fm, err := p.Run()
+	if err != nil {
+		return err
+	}
+	res := fm.(authModel).result
+	switch res.choice {
+	case authClaude:
+		return loopbackClaudeLogin(ctx)
+	case authAPIKey:
+		if res.apiKey == "" {
+			return errors.New("no API key entered")
+		}
+		return saveProviderConfig(providerConfig{Provider: "anthropic", Method: "apikey", APIKey: res.apiKey})
+	case authOllama:
+		return saveProviderConfig(providerConfig{Provider: "ollama"})
+	default:
+		return errors.New("sign-in cancelled")
+	}
+}

internal/commands/topos_claude_auth.go

@@ -12,6 +12,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
@@ -30,7 +31,6 @@ const (
 	// CLI integration (no secret; PKCE protects the exchange).
 	claudeOAuthClientID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
 	claudeAuthorizeURL  = "https://claude.ai/oauth/authorize"
-	claudeRedirectURI   = "https://console.anthropic.com/oauth/code/callback"
 	claudeScopes        = "org:create_api_key user:profile user:inference"
 )
 
@@ -96,37 +96,6 @@ func newPKCE() (pkce, error) {
 	return pkce{verifier: verifier, challenge: base64.RawURLEncoding.EncodeToString(sum[:])}, nil
 }
 
-// claudeAuthorizeURL builds the authorize URL for the manual-paste flow
-// (code=true makes the callback page display the code for the user to paste).
-func buildClaudeAuthorizeURL(p pkce) string {
-	q := url.Values{
-		"code":                  {"true"},
-		"client_id":             {claudeOAuthClientID},
-		"response_type":         {"code"},
-		"redirect_uri":          {claudeRedirectURI},
-		"scope":                 {claudeScopes},
-		"code_challenge":        {p.challenge},
-		"code_challenge_method": {"S256"},
-		"state":                 {p.verifier},
-	}
-	return claudeAuthorizeURL + "?" + q.Encode()
-}
-
-// exchangeClaudeCode trades the pasted "code#state" for tokens. The callback
-// page returns the authorization code and state joined by '#'.
-func exchangeClaudeCode(ctx context.Context, httpc *http.Client, pasted string, p pkce) (claudeToken, error) {
-	code, state, _ := strings.Cut(strings.TrimSpace(pasted), "#")
-	body, _ := json.Marshal(map[string]string{
-		"grant_type":    "authorization_code",
-		"code":          code,
-		"state":         state,
-		"client_id":     claudeOAuthClientID,
-		"redirect_uri":  claudeRedirectURI,
-		"code_verifier": p.verifier,
-	})
-	return postClaudeToken(ctx, httpc, body)
-}
-
 // refreshClaudeToken renews an expired access token using the refresh token.
 func refreshClaudeToken(ctx context.Context, httpc *http.Client, refresh string) (claudeToken, error) {
 	body, _ := json.Marshal(map[string]string{
@@ -169,32 +138,80 @@ func postClaudeToken(ctx context.Context, httpc *http.Client, body []byte) (clau
 	return t, nil
 }
 
-// runClaudeLogin drives the interactive login: open the browser, read the pasted
-// code, exchange it, and store the token.
+// runClaudeLogin drives the Claude OAuth login (loopback: no copy/paste).
 func runClaudeLogin(ctx context.Context) error {
+	return loopbackClaudeLogin(ctx)
+}
+
+// loopbackClaudeLogin runs the Claude OAuth flow with a localhost redirect, so
+// the browser hands the code back automatically — no copy/paste. It stores the
+// token and records the provider choice (anthropic / oauth).
+func loopbackClaudeLogin(ctx context.Context) error {
 	p, err := newPKCE()
 	if err != nil {
 		return err
 	}
-	authURL := buildClaudeAuthorizeURL(p)
-	fmt.Fprintln(os.Stderr, "Sign in to Claude to authorize the local agent:")
-	fmt.Fprintln(os.Stderr, "\n  "+authURL+"\n")
-	_ = openBrowser(authURL)
-	fmt.Fprint(os.Stderr, "Paste the code shown after you approve, then press Enter:\n> ")
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return fmt.Errorf("claude login: open loopback: %w", err)
+	}
+	defer func() { _ = ln.Close() }()
+	redirectURI := fmt.Sprintf("http://localhost:%d/callback", ln.Addr().(*net.TCPAddr).Port)
 
-	var pasted string
-	if _, err := fmt.Fscanln(os.Stdin, &pasted); err != nil {
-		return fmt.Errorf("read code: %w", err)
+	q := url.Values{
+		"client_id":             {claudeOAuthClientID},
+		"response_type":         {"code"},
+		"redirect_uri":          {redirectURI},
+		"scope":                 {claudeScopes},
+		"code_challenge":        {p.challenge},
+		"code_challenge_method": {"S256"},
+		"state":                 {p.verifier},
 	}
-	tok, err := exchangeClaudeCode(ctx, &http.Client{Timeout: 30 * time.Second}, pasted, p)
-	if err != nil {
-		return err
+	authURL := claudeAuthorizeURL + "?" + q.Encode()
+
+	type result struct {
+		code, state string
 	}
-	if err := saveClaudeToken(tok); err != nil {
-		return err
+	resCh := make(chan result, 1)
+	srv := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		qq := r.URL.Query()
+		if qq.Get("code") == "" {
+			http.Error(w, "missing code", http.StatusBadRequest)
+			return
+		}
+		_, _ = io.WriteString(w, "Signed in. You can close this tab and return to the terminal.")
+		resCh <- result{code: qq.Get("code"), state: qq.Get("state")}
+	})}
+	go func() { _ = srv.Serve(ln) }()
+	defer func() { _ = srv.Shutdown(context.Background()) }()
+
+	fmt.Fprintln(os.Stderr, "Opening your browser to sign in to Claude...")
+	fmt.Fprintln(os.Stderr, "If it doesn't open, visit:\n\n  "+authURL+"\n")
+	_ = openBrowser(authURL)
+
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case res := <-resCh:
+		body, _ := json.Marshal(map[string]string{
+			"grant_type":    "authorization_code",
+			"code":          res.code,
+			"state":         res.state,
+			"client_id":     claudeOAuthClientID,
+			"redirect_uri":  redirectURI,
+			"code_verifier": p.verifier,
+		})
+		tok, err := postClaudeToken(ctx, &http.Client{Timeout: 30 * time.Second}, body)
+		if err != nil {
+			return err
+		}
+		if err := saveClaudeToken(tok); err != nil {
+			return err
+		}
+		_ = saveProviderConfig(providerConfig{Provider: "anthropic", Method: "oauth"})
+		fmt.Fprintln(os.Stderr, "Signed in to Claude.")
+		return nil
 	}
-	fmt.Fprintln(os.Stderr, "Signed in to Claude. `latere topos --local` will use this token.")
-	return nil
 }
 
 // claudeOAuthBearer returns a usable Claude OAuth access token from the stored

internal/commands/topos_claude_auth_test.go

@@ -12,7 +12,6 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"path/filepath"
 	"testing"
 	"time"
@@ -32,33 +31,8 @@ func TestPKCEChallengeMatchesVerifier(t *testing.T) {
 	}
 }
 
-func TestBuildClaudeAuthorizeURL(t *testing.T) {
-	p := pkce{verifier: "ver", challenge: "chal"}
-	u, err := url.Parse(buildClaudeAuthorizeURL(p))
-	if err != nil {
-		t.Fatalf("parse: %v", err)
-	}
-	q := u.Query()
-	checks := map[string]string{
-		"client_id":             claudeOAuthClientID,
-		"response_type":         "code",
-		"code_challenge":        "chal",
-		"code_challenge_method": "S256",
-		"state":                 "ver",
-		"redirect_uri":          claudeRedirectURI,
-	}
-	for k, want := range checks {
-		if q.Get(k) != want {
-			t.Errorf("authorize URL %s = %q, want %q", k, q.Get(k), want)
-		}
-	}
-}
-
-func TestExchangeAndStoreClaudeToken(t *testing.T) {
-	var gotBody map[string]string
+func TestPostAndStoreClaudeToken(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		b, _ := io.ReadAll(r.Body)
-		_ = json.Unmarshal(b, &gotBody)
 		_ = json.NewEncoder(w).Encode(map[string]any{
 			"access_token": "sk-ant-oat-new", "refresh_token": "rt-1", "expires_in": 3600,
 		})
@@ -69,23 +43,17 @@ func TestExchangeAndStoreClaudeToken(t *testing.T) {
 	defer func() { claudeTokenURL = old }()
 	t.Setenv("LATERE_CLAUDE_TOKEN_FILE", filepath.Join(t.TempDir(), "claude.json"))
 
-	tok, err := exchangeClaudeCode(context.Background(), srv.Client(), "AUTHCODE#STATEXYZ", pkce{verifier: "ver"})
+	tok, err := postClaudeToken(context.Background(), srv.Client(), []byte(`{"grant_type":"authorization_code"}`))
 	if err != nil {
-		t.Fatalf("exchange: %v", err)
-	}
-	// The pasted "code#state" is split correctly and the verifier is sent.
-	if gotBody["code"] != "AUTHCODE" || gotBody["state"] != "STATEXYZ" || gotBody["code_verifier"] != "ver" {
-		t.Fatalf("token request body = %v", gotBody)
+		t.Fatalf("postClaudeToken: %v", err)
 	}
 	if tok.AccessToken != "sk-ant-oat-new" || tok.RefreshToken != "rt-1" || tok.ExpiresAt.IsZero() {
 		t.Fatalf("token = %+v", tok)
 	}
-
 	if err := saveClaudeToken(tok); err != nil {
 		t.Fatalf("save: %v", err)
 	}
-	got, err := loadClaudeToken()
-	if err != nil || got.AccessToken != "sk-ant-oat-new" {
+	if got, err := loadClaudeToken(); err != nil || got.AccessToken != "sk-ant-oat-new" {
 		t.Fatalf("load = (%+v, %v)", got, err)
 	}
 }
@@ -131,6 +99,7 @@ func TestBuildLocalModelUsesStoredClaudeLogin(t *testing.T) {
 	t.Setenv("CLAUDE_CODE_OAUTH_TOKEN", "")
 	t.Setenv("CLAUDE_CODE_OAUTH_TOKEN_AUTO", "")
 	t.Setenv("LATERE_CLAUDE_TOKEN_FILE", filepath.Join(t.TempDir(), "claude.json"))
+	t.Setenv("LATERE_TOPOS_PROVIDER_FILE", filepath.Join(t.TempDir(), "provider.json"))
 	// A valid stored login (far-future expiry) → buildLocalModel returns a model.
 	_ = saveClaudeToken(claudeToken{AccessToken: "sk-ant-oat-stored", ExpiresAt: time.Now().Add(time.Hour)})
 	m, err := buildLocalModel(context.Background(), "")