[Crash] OmnigentError: Authentication required (#93)

[jan21deepak]

Opened automatically by Cursor Forge as a same-repo PR on jan21deepak/omnigent
after the Cloud Agent pushed cursor/fix-auth-required-crash-7401 (not against an upstream parent).

Fixes #93.

Cursor agent: bc-2eebff7d-25d4-41ae-8881-c129ad617401

---

Note

Low Risk
CLI-only auth UX and error mapping in the daemon chat path; no server auth logic changes. Regression coverage added in tests/cli/test_chat.py.

Overview
Fixes #93 by replacing raw OmnigentError: Authentication required with guided CLI failures when accounts mode is on but the CLI has no session JWT.

Accounts startup (_await_accounts_first_run_setup): If /v1/info shows accounts enabled, admin already exists (needs_setup false), and there is no stored token, the CLI now runs interactive omnigent login on a TTY or raises click.ClickException with the login command on non-interactive stdin—instead of proceeding and 401-ing on the first API call.

Session prep (_prepare_chat_session_via_daemon): Session create/fork/resume wraps ClientOmnigentError for 401/403 and re-raises _auth_required_click_exception pointing at omnigent login <url>.

New helpers _accounts_login_or_fail and _auth_required_click_exception centralize messaging. Tests cover login prompt, headless failure, and 401 → ClickException.

^{Reviewed by Cursor Bugbot for commit 089a704. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jan21deepak]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Ignores env bearer token
  • Early-return in _await_accounts_first_run_setup when OMNIGENT_REMOTE_AUTH_TOKEN is set, matching _remote_headers so env auth skips the login-or-fail path.

Or push these changes by commenting:

@cursor push 607a273145

Preview (607a273145)

diff --git a/omnigent/chat.py b/omnigent/chat.py
--- a/omnigent/chat.py
+++ b/omnigent/chat.py
@@ -1398,8 +1398,9 @@
     failed, ``auth_tokens.json`` was cleared, or the token expired), prompt for
     ``omnigent login`` on a TTY instead of 401-ing on the first session call.
 
-    No-op when the server is not in accounts mode, or when this CLI already
-    holds a token for *base_url*.
+    No-op when the server is not in accounts mode, when
+    ``OMNIGENT_REMOTE_AUTH_TOKEN`` is set, or when this CLI already holds a
+    token for *base_url*.
 
     :param base_url: Resolved local Omnigent server URL, e.g.
         ``"http://127.0.0.1:6767"``.
@@ -1412,8 +1413,10 @@
     """
     from omnigent import cli_auth
 
-    # Already authenticated to this server — nothing to wait for.
-    if cli_auth.load_token(base_url) is not None:
+    # Already authenticated — env bearer (same precedence as `_remote_headers`)
+    # or a stored JWT. Later headers/auth will attach it.
+    env_token = (os.environ.get(_REMOTE_AUTH_TOKEN_ENV) or "").strip()
+    if env_token or cli_auth.load_token(base_url) is not None:
         return
     try:
         info = httpx.get(f"{base_url}/v1/info", timeout=5.0).json()

diff --git a/tests/cli/test_chat.py b/tests/cli/test_chat.py
--- a/tests/cli/test_chat.py
+++ b/tests/cli/test_chat.py
@@ -3036,6 +3036,21 @@
     chat_module._await_accounts_first_run_setup("http://127.0.0.1:8000")
 
 
+def test_await_accounts_setup_noop_when_env_bearer_present(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """``OMNIGENT_REMOTE_AUTH_TOKEN`` authenticates without a stored JWT."""
+    monkeypatch.setenv(chat_module._REMOTE_AUTH_TOKEN_ENV, "env-token")
+    monkeypatch.setattr("omnigent.cli_auth.load_token", lambda _url: None)
+
+    def _must_not_probe(*_a: object, **_k: object) -> object:
+        raise AssertionError("must not call /v1/info when env bearer is set")
+
+    monkeypatch.setattr("omnigent.chat.httpx.get", _must_not_probe)
+
+    chat_module._await_accounts_first_run_setup("http://127.0.0.1:8000")
+
+
 def test_await_accounts_setup_noop_for_header_mode(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -3106,6 +3121,7 @@
     """When setup is done but the CLI token is missing, sign in instead of 401."""
     login_calls: list[str] = []
 
+    monkeypatch.delenv(chat_module._REMOTE_AUTH_TOKEN_ENV, raising=False)
     monkeypatch.setattr("omnigent.cli_auth.load_token", lambda _url: None)
     monkeypatch.setattr(
         "omnigent.chat.httpx.get",
@@ -3126,6 +3142,7 @@
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     """Headless invocations get the login command instead of an auth traceback."""
+    monkeypatch.delenv(chat_module._REMOTE_AUTH_TOKEN_ENV, raising=False)
     monkeypatch.setattr("omnigent.cli_auth.load_token", lambda _url: None)
     monkeypatch.setattr(
         "omnigent.chat.httpx.get",

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 089a704. Configure here.}

[cursor]

Ignores env bearer token

Medium Severity

When accounts mode is on and setup is complete, _await_accounts_first_run_setup treats missing stored JWT as “must sign in” and calls _accounts_login_or_fail, even if OMNIGENT_REMOTE_AUTH_TOKEN would supply auth via _remote_headers. Headless runs fail with a login hint; TTY runs get an unnecessary interactive login.

Additional Locations (1)

• omnigent/chat.py#L1415-L1417

 

^{Reviewed by Cursor Bugbot for commit 089a704. Configure here.}