fix(auth): always show the OAuth wizard on first launch

Env-var auto-detect would silently skip the wizard when stray API
keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, …) were set in the user's
shell or a cwd .env file — even for a brand-new install where the
user almost certainly wants the in-house default with free credits
rather than spending their own provider budget.

Now: only honor the legacy env-var auto-detect when ~/.codebase/
credentials.json exists (the wizard creates it on first sign-in).
For first launches, env vars stay set for the user but don't
short-circuit the OAuth offer. After they sign in once, the file
exists and env-var fallback resumes as a power-user escape hatch.

Author: halfaipg

src/agent/config.ts

@@ -116,17 +116,31 @@ export function resolveConfig(envOrOpts: NodeJS.ProcessEnv | ResolveConfigOption
 		return { model, apiKey, source: "explicit" };
 	}
 
-	for (const provider of AUTO_DETECT_ORDER) {
-		const apiKey = getEnvApiKey(provider);
-		if (!apiKey) continue;
-
-		const modelId = DEFAULT_MODELS[provider];
-		if (!modelId) continue;
-
-		const model = getModel(provider, modelId as never);
-		if (!model) continue;
-
-		return { model, apiKey, source: "auto" };
+	// Env-var auto-detect is the legacy power-user path. We only honor it
+	// for users who have already onboarded — otherwise a stray
+	// ANTHROPIC_API_KEY or OPENAI_API_KEY in the shell would silently
+	// skip the OAuth wizard the first time a new user runs `codebase`,
+	// even though they almost certainly want the in-house default model
+	// with free credits rather than spending their own API key budget.
+	//
+	// "Already onboarded" = credentials.json exists on disk, even if it's
+	// now expired or empty. The wizard creates that file on first
+	// sign-in, so its presence is a reliable "this user knows what
+	// they're doing" signal.
+	const hasOnboarded = credentials.exists();
+	if (hasOnboarded) {
+		for (const provider of AUTO_DETECT_ORDER) {
+			const apiKey = getEnvApiKey(provider);
+			if (!apiKey) continue;
+
+			const modelId = DEFAULT_MODELS[provider];
+			if (!modelId) continue;
+
+			const model = getModel(provider, modelId as never);
+			if (!model) continue;
+
+			return { model, apiKey, source: "auto" };
+		}
 	}
 
 	throw new ConfigError(

src/auth/credentials.ts

@@ -57,6 +57,17 @@ export class CredentialsStore {
 		return this.path;
 	}
 
+	/**
+	 * True iff a credentials file exists on disk, regardless of whether
+	 * it parses or whether the token is still valid. Used to detect
+	 * "user has gone through the first-run wizard at least once" so we
+	 * don't silently skip the OAuth offer for a brand-new install just
+	 * because some stray API key happens to be in the shell env.
+	 */
+	exists(): boolean {
+		return existsSync(this.path);
+	}
+
 	load(): Credentials | null {
 		if (!existsSync(this.path)) return null;
 		let raw: string;