feat(server,app): gateway-style server-side provider sync on the local server

[benjaminshafii]

What

Rebuilt on dev after #3525 merged — single commit on top of it. #3525 removed the Import concept but kept materialization in the renderer; this PR moves it server-side for local workspaces, the same way gateway/cloud instances work: the server materializes, the client displays.

Server (apps/server)

• New cloud-provider-sync.ts — local sibling of den-api's cloud worker materializer (ported pure logic; never imports ee/**):
  • Minimal Den client (GET /v1/llm-providers, GET /v1/llm-providers/:id/connect; Bearer + org header; bounded fetches).
  • Materializes providers engine-global (the feat: make cloud LLM providers engine-global so they actually reach opencode #3255 layer), upserts env, one engine reload per changed pass, credential delivery via syncManagedProviderAuth.
  • den-api's owp:v1: fingerprint noop-cache; serialized passes; 5-min interval (env-overridable) + run-now.
  • Takeover cleanup: renderer-era per-workspace lpr_* rows and openwork.cloudImports.providers baselines are cleared so they can't shadow the fresh global layer.
  • Sign-out sweep removes everything it materialized (global rows, owned env keys, auth withdrawal).
• Routes: PUT/DELETE /den-session (host-token; body carries the resolved Den API base), POST /cloud-provider-sync/run (host-token), GET /cloud-provider-sync/status (client). GET /capabilities advertises providerSync: true.
• Den session is held in memory only — nothing persisted; the app re-pushes on connect/sign-in/org switch and any trigger self-heals via no_session (push + one retry).

App (apps/app) — minimal delta on #3525's merged store

• When the connected server advertises providerSync and the app holds its host token: sync triggers ping run-now and return the same handled_server_side outcome gateway mode uses; refreshImportedCloudProviders reads the status endpoint, feeding feat(app): auto-import granted cloud providers — remove the Import button, status-only settings #3525's status-only rows ("Connected") with zero view changes.
• feat(app): auto-import granted cloud providers — remove the Import button, status-only settings #3525's renderer materialization, per-provider lastSyncError, and conflict terminality are untouched and remain the fallback for servers without the capability. Gateway short-circuit unchanged.

Evidence

• Live e2e: dev's merged spec evals/specs/cloud-provider-auto-import.slow.test.ts (feat(app): auto-import granted cloud providers — remove the Import button, status-only settings #3525's own demo — member sees Connected, no Import button, models in the picker) passes unchanged on this branch against a cold local Den + Electron (tape published below).
• Live activation of the server path was proven during development by a red/green pair on the pre-rebase branch: the settings UI displayed den_request_failed_404 — an error string that exists only in the new server module — confirming capability → session push → run-now → server Den client end-to-end; the only change before green was fixing the pushed base URL to the resolved /api/den API base (that fix ships here, with a unit test pinning the pushed URL).
• Server: cloud-provider-sync.e2e.test.ts (real startServer, fake Den): apply/noop fingerprint, drift rewrite, upstream removal, per-workspace takeover cleanup, sign-out sweep, no_session, Den-failure reporting, status shape.
• App: capability-mode tests — run-now POSTed with zero renderer Den fetches, no_session push-retry with the /api/den base asserted, failure mapping, status→importedCloudProviders mapping; all feat(app): auto-import granted cloud providers — remove the Import button, status-only settings #3525 tests pass unchanged.

Tests run

• apps/server: bun test src/ — 629 pass, 2 skip, 0 fail · pnpm typecheck pass
• apps/app: bun test --isolate (sync-gateway, sync-triggers, reimport, credentials, cloud-providers-view, composer-model-controls) — 34 pass, 0 fail · pnpm typecheck pass
• OPENWORK_EVAL_APP_SPECS=1 vitest --project stack specs/cloud-provider-auto-import.slow.test.ts — passed (96s, cold local server() + Docker MySQL)

Notes for review

• Engine-global write scope is deliberate (matches cloud semantics from feat: make cloud LLM providers engine-global so they actually reach opencode #3255): org providers are org-level — one definition per engine, one auth delivery path.
• In server mode feat(app): auto-import granted cloud providers — remove the Import button, status-only settings #3525's per-provider lastSyncError stays empty; a persistent server-side Den failure is visible via the status endpoint's lastRun and surfaces as providerAuthError on settings open — richer per-provider mapping is a natural follow-up.
• The renderer's desktop-policy pre-import guard doesn't run on the server path; Den's per-member provider assignment (fetched with the member's own token) is the access control.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview	Aug 5, 2026 11:15am
openwork-den	Ready	Preview	Aug 5, 2026 11:15am
openwork-den-worker-proxy	Ready	Preview	Aug 5, 2026 11:15am
openwork-landing	Ready	Preview, v0	Aug 5, 2026 11:15am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openwork-diagnostics	Skipped		Aug 5, 2026 11:15am

[benjaminshafii]

Photo roll — granted-cloud-providers-appear-automatically-in-settings-and-the-model-picker — 2/2 frames passed · 2 facts

✅ 2/2 frames passed · 2 facts · 8 expectations passed · 0 failed

ℹ️ FACT — 1. The granted provider connected without an import action

Settings state: {"connected":true,"importButton":false}

• ✅ PASS The granted provider connected without an import action — Settings state: {"connected":true,"importButton":false}

✅ PASS — 2. The Cloud providers page shows Automatic Team Models as Connected

• ✅ PASS The Cloud providers page shows Automatic Team Models as Connected — “Automatic Team Models” is shown with a green “Connected” badge.
• ✅ PASS The page is status-only with Sync now and no Import provider action — A “Sync now” button is visible, and no “Import provider” action appears anywhere on the page.
• ✅ PASS No error or crash message is visible — The page renders normally with provider status information and no visible error or crash message.

ℹ️ FACT — 3. The automatically imported provider contributes its model

Selectable models: [{"id":"automatic-proof-model","name":"Automatic Proof Model","providerName":"Automatic Team Models","selected":false,"selectable":true}]

• ✅ PASS The automatically imported provider contributes its model — Selectable models: [{"id":"automatic-proof-model","name":"Automatic Proof Model","providerName":"Automatic Team Models","selected":false,"selectable":true}]

✅ PASS — 4. The open Models picker shows automatic-proof-model from the organization provider

• ✅ PASS The open Models picker shows automatic-proof-model from the organization provider — The expanded “Automatic Team Models” provider section visibly lists “Automatic Proof Model” with ID “automatic-proof-model” and an “LP” organization-style icon.
• ✅ PASS The organization model is visibly selectable without a provider connection prompt — “Automatic Proof Model” appears as a model option under an enabled provider; no connection prompt is visible.
• ✅ PASS No error or crash message is visible — The Models modal and surrounding app render normally with no visible error, crash, or failure message.

---

Roll created 2026-08-05T10:56:06.301Z · Source: evals/results/rolls/2026-08-05T10-56-06-301Z-granted-cloud-providers-appear-automatically-in-settings-and-the-model-picker/roll.json · Repro: pnpm fraimz:publish -- --pr 3526 --roll 2026-08-05T10-56-06-301Z-granted-cloud-providers-appear-automatically-in-settings-and-the-model-picker

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (c9187aa48ac31d68f18ee431fc7bd38ed0fe7a79). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run