fix(onboarding): let a blank LLM key defer setup instead of blocking the wizard

[YauhenBichel]

Problem. The LLM credential prompt was the one onboarding step with no "later". Its outcomes were repick, cancel, save_anyway and continue_unsaved — so a user without a key to hand could only go back to the provider menu or abandon setup.

It was worse than a missing option. _prompt_value is while True and returns only on non-empty input, so a blank answer loops forever. The regression test written for this didn't fail — it hung for 600 seconds and had to be killed. In a terminal you experience it as a wizard that won't move on until you Ctrl-C.

Change. A blank answer now returns DEFERRED: onboarding completes, nothing is validated or persisted, and the summary tells you how to finish:

not set yet — run opensre auth login openai when you have a key
Everything downstream already supported this — resolve_for_request raises an actionable MissingLLMCredentialError, and the REPL never gated startup on an LLM key. So a deferred key lands the user in a working shell that names what's missing, instead of a dead end.

The prompt label now says — leave blank to set up later, and allow_empty is off for host credentials, where a bare Enter would accept the pre-filled default.

Also: credential_kind string literals → WizardCredentialKind. 17 comparisons across 6 files. The enum already existed and the field was already typed as it; the literals bypassed it, which is how a typo becomes a silent no-match rather than an error.

[github-actions]

Greptile code review

This repo uses Greptile for automated review. Before merge, aim for Confidence Score: 5/5 with zero unresolved review threads — see CONTRIBUTING.md.

Run a review — add a PR comment with:

@greptile review

Give it ~5-10 minutes (sometimes longer) for results, then fix feedback and re-trigger until you reach Confidence Score: 5/5.

Optional: automate with the greploop skill.

[YauhenBichel]

@greptile review

[greptile-apps]

Greptile Summary

The PR lets users leave an API-key credential blank during onboarding, skips validation and persistence, and reports the deferred setup accurately.

• Adds DEFERRED to the credential outcome and summary-state contracts.
• Propagates deferred state through both newly selected and retained-provider paths.
• Replaces credential-kind string comparisons with WizardCredentialKind.
• Adds regression coverage for blank credentials and the previously reported retained-provider summary path.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported retained-provider path now records DEFERRED and passes it unchanged to the summary renderer.

Important Files Changed

Filename	Overview
surfaces/cli/wizard/flow.py	Propagates the deferred credential outcome through both provider-selection branches into the completion summary.
surfaces/cli/wizard/llm_credential.py	Accepts blank API-key input as deferred, avoids validation and persistence, and renders actionable setup guidance.
tests/cli/wizard/test_flow.py	Covers blank-input deferral and verifies that retaining a provider no longer produces a false keychain claim.
surfaces/cli/llm_auth/providers.py	Replaces API-key credential-kind literals with the existing typed enum.
surfaces/cli/llm_auth/service.py	Uses typed credential-kind comparisons for API-key and CLI subscription setup.
surfaces/cli/wizard/_ui.py	Uses typed credential kinds while deriving saved CLI and host defaults.
surfaces/cli/wizard/env_sync.py	Uses the typed host credential kind when retaining non-secret provider configuration.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Prompt for LLM credential] --> B{Input blank?}
    B -->|No| C[Validate and persist credential]
    B -->|Yes| D[Return DEFERRED]
    D --> E[Preserve deferred state in wizard flow]
    E --> F[Complete onboarding]
    F --> G[Summary: not set yet and auth login guidance]

Loading

_{Reviews (3): Last reviewed commit: "fixed issues" | Re-trigger Greptile}

[YauhenBichel]

@greptile review

[github-actions]

🍵 @YauhenBichel made tea, opened a PR, and merged before it cooled. No notes. ☕

---

👋 Join us on Discord - OpenSRE : hang out, contribute, or hunt for features and issues. Everyone's welcome.