fix(cli): recognize OAuth credentials in startup gate

[shixi-li]

Summary

• Make the interactive startup gate validate credentials for the provider that actually owns the configured model, using one config snapshot for routing and inline credentials.
• Reuse oauth-cli-kit's Codex storage contract, including its existing Codex CLI credential import, and require every field Raven needs to send a request.
• Recognize LiteLLM's cached GitHub Copilot credentials without starting a device flow or refreshing at startup.
• Bind raven agent --config readiness checks to the same config file used by the runtime.
• Fail closed for missing, malformed, expired, or unrelated credentials while preserving API-key behavior.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• Relevant tests pass locally
• Relevant lint / type checks pass locally
• User-facing docs or screenshots are updated when needed

Commands run:

uv run --no-project --python 3.12 --with pytest==9.0.3 --with pytest-asyncio==1.3.0 --with typer==0.23.1 --with click==8.1.8 --with rich==14.3.4 --with 'pydantic>=2.12,<3' --with 'pydantic-settings>=2.14,<3' --with 'httpx>=0.28,<1' --with 'loguru>=0.7,<1' --with 'platformdirs>=4,<5' --with 'tiktoken>=0.7,<1' --with 'pyyaml>=6' --with 'croniter>=6,<7' --with 'tomli-w>=1.2' --with 'questionary>=2,<3' --with 'watchfiles>=0.21,<2' --with 'portalocker>=3.2' --with 'orjson>=3.11,<4' --with oauth-cli-kit==0.1.6 --with litellm==1.85.0 pytest tests/test_cli_onboard_commands.py tests/test_config_update_providers.py tests/test_cli_provider_commands.py tests/test_tui_rpc_model.py -q
uv run --no-project --python 3.12 --with ruff==0.15.11 ruff check raven/cli/agent_commands.py raven/cli/onboard_commands.py raven/config/update_providers.py tests/test_cli_onboard_commands.py tests/test_config_update_providers.py tests/test_tui_rpc_model.py
uv run --no-project --python 3.12 --with ruff==0.15.11 ruff format --check raven/cli/agent_commands.py raven/cli/onboard_commands.py raven/config/update_providers.py tests/test_cli_onboard_commands.py tests/test_config_update_providers.py tests/test_tui_rpc_model.py
uv build --no-sources

The full frozen environment could not be materialized on the macOS x86_64 host because lancedb==0.33.0 has no compatible wheel. The focused tests ran in an isolated uv environment with the locked OAuth, CLI, and test tool versions, and the package build completed separately. The checkout did not contain the prebuilt ui-tui/dist/entry.js, so the local wheel build succeeded without the bundled TUI asset; this existing release-asset condition is outside the Python startup-gate diff.

Risk

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Credential checks are local and offline and return only a boolean status; token fields are never returned or logged. Routing and API-key/local status derive from a single raw config snapshot, while OAuth reads only the separate credential stores. Codex delegates loading and legacy import to oauth-cli-kit, requires the account id Raven sends as a header, and treats an expired access token with a refresh token as refresh-capable. Copilot mirrors the locked LiteLLM access-token and API-key cache paths and environment overrides without instantiating its directory-writing authenticator. Tests cover malformed and missing fields, expiry types, expired caches, secret non-disclosure, single-read behavior, selected and forced routing, API-key setups, both agent --config directions, TUI/agent entry points, provider commands, and the TUI RPC consumer.

Related Issues

Closes #218

[shixi-li]

Rebased this branch onto the latest main (16719d0) and resolved the only conflict in tests/test_tui_rpc_model.py by preserving both the upstream process-wide config-path cleanup and this PR's OAuth/Copilot credential isolation.

Post-rebase validation:

• Focused Python 3.12 suite: 210 passed
• Ruff check and format check: passed
• Pre-commit on the full PR diff: passed
• Commit-message and PR-title checks: passed
• uv build --no-sources: passed

The PR is mergeable now. The new CI and Commit lint runs are both waiting for approval (action_required). Could a maintainer approve those workflows and review the updated branch when convenient?

For completeness, the full locked environment still cannot be installed on this Intel macOS host because boxlite==0.9.5 has no macOS x86_64 distribution, so the focused tests used the isolated Python 3.12 dependency set already documented in the PR.

[shixi-li]

Rebased this branch from e132b31 onto the current main (a24762c); the new head is 84cc51a.

Conflict resolution preserved both sides of the provider refactor:

• The startup gate still routes against one raw config snapshot and requires usable credentials for the provider selected by the configured model.
• The upstream dynamic provider list, renamed-section handling, MiniMax OAuth support, and LiteLLM passthrough discovery remain intact.
• When list_providers receives the startup snapshot, it now builds the same complete provider view without rereading the config file.

Post-rebase verification:

• Focused provider, onboarding, CLI, TUI RPC, passthrough, and routing suite: 452 passed, 30 skipped.
• Ruff check and format check: passed.
• Pre-commit on the full PR diff: passed.
• Python and Commitlint commit-message checks: passed.
• uv build --no-sources: passed for both sdist and wheel.
• git merge-tree and git diff --check: passed.

The full locked environment still cannot be installed on this Intel macOS host because lancedb==0.33.0 has no compatible macOS x86_64 artifact. The isolated Python 3.12 verification used the locked versions already documented in the PR plus the current locked json-repair==0.59.5 dependency.

Could a maintainer approve the refreshed workflows and review the rebased branch when convenient?