use shared provider keys for agent runs

src/app/api/v2/ai/agent/api-keys/route.test.ts

@@ -84,6 +84,7 @@ function makeRequest(
 describe('API /api/v2/ai/agent/api-keys', () => {
   const originalEnableAuth = process.env.ENABLE_AUTH;
   const originalLocalDevUserId = process.env.LOCAL_DEV_USER_ID;
+  const originalAnthropicKey = process.env.ANTHROPIC_API_KEY;
 
   const restoreEnv = () => {
     if (originalEnableAuth === undefined) {
@@ -97,11 +98,18 @@ describe('API /api/v2/ai/agent/api-keys', () => {
     } else {
       process.env.LOCAL_DEV_USER_ID = originalLocalDevUserId;
     }
+
+    if (originalAnthropicKey === undefined) {
+      delete process.env.ANTHROPIC_API_KEY;
+    } else {
+      process.env.ANTHROPIC_API_KEY = originalAnthropicKey;
+    }
   };
 
   beforeEach(() => {
     jest.clearAllMocks();
     restoreEnv();
+    delete process.env.ANTHROPIC_API_KEY;
   });
 
   afterAll(() => {
@@ -147,6 +155,18 @@ describe('API /api/v2/ai/agent/api-keys', () => {
       expect(json.data.maskedKey).toBe('sk-ant...xyz9');
     });
 
+    it('returns shared key status when the provider env key is configured', async () => {
+      process.env.ANTHROPIC_API_KEY = 'shared-anthropic-key';
+      mockGetMaskedKey.mockResolvedValue(null);
+
+      const res = await GET(makeRequest(undefined, { sub: 'user-1' }));
+
+      expect(res.status).toBe(200);
+      const json = await res.json();
+      expect(json.data.hasKey).toBe(true);
+      expect(json.data.maskedKey).toBeUndefined();
+    });
+
     it('returns 400 when provider is invalid', async () => {
       const res = await GET(makeRequest(undefined, { sub: 'user-1' }, { provider: 'sample' }));
       expect(res.status).toBe(400);

src/app/api/v2/ai/agent/api-keys/route.ts

@@ -20,6 +20,7 @@ import { successResponse, errorResponse } from 'server/lib/response';
 import { getRequestUserIdentity } from 'server/lib/get-user';
 import AgentRuntimeConfigService from 'server/services/agentRuntime/config/agentRuntimeConfig';
 import UserApiKeyService from 'server/services/userApiKey';
+import AgentProviderRegistry from 'server/services/agent/ProviderRegistry';
 import {
   STORED_AGENT_PROVIDER_NAMES,
   normalizeStoredAgentProviderName,
@@ -118,6 +119,27 @@ async function buildProviderState(
   };
 }
 
+async function buildProviderStateWithSharedFallback(
+  userId: string,
+  ownerGithubUsername: string | null | undefined,
+  provider: SupportedProvider
+): Promise<ProviderKeyState> {
+  const userState = await buildProviderState(userId, ownerGithubUsername, provider);
+  if (userState.hasKey) {
+    return userState;
+  }
+
+  const sharedKey = await AgentProviderRegistry.getSharedProviderApiKey({ provider });
+  if (!sharedKey) {
+    return userState;
+  }
+
+  return {
+    provider,
+    hasKey: true,
+  };
+}
+
 /**
  * @openapi
  * /api/v2/ai/agent/api-keys:
@@ -260,7 +282,9 @@ const getHandler = async (req: NextRequest) => {
   const configuredProviders = await getConfiguredProviders();
   const providers = requestedProvider ? [requestedProvider] : configuredProviders;
   const states = await Promise.all(
-    providers.map((provider) => buildProviderState(userIdentity.userId, userIdentity.githubUsername, provider))
+    providers.map((provider) =>
+      buildProviderStateWithSharedFallback(userIdentity.userId, userIdentity.githubUsername, provider)
+    )
   );
   const primaryState = states[0] || {
     provider: configuredProviders[0],