fix: keep local api serve unauthenticated

maintainer edit: Align OpenAI-compatible API auth with the WebSocket channel boundary: loopback serve remains usable without a key, while wildcard binds still fail before agent initialization unless api.api_key is configured.

tests/cli/test_commands.py

@@ -2890,7 +2890,7 @@ def test_serve_cli_options_override_api_config(monkeypatch, tmp_path: Path) -> N
     assert seen["api_key"] == "secret"
 
 
-def test_serve_rejects_loopback_without_api_key(monkeypatch, tmp_path: Path) -> None:
+def test_serve_allows_loopback_without_api_key(monkeypatch, tmp_path: Path) -> None:
     config_file = _write_instance_config(tmp_path)
     config = Config()
     seen: dict[str, object] = {}
@@ -2899,10 +2899,9 @@ def test_serve_rejects_loopback_without_api_key(monkeypatch, tmp_path: Path) ->
 
     result = runner.invoke(app, ["serve", "--config", str(config_file)])
 
-    assert result.exit_code == 1
-    assert "api_key is not set" in result.stdout
-    assert "workspace" not in seen
-    assert "api_app" not in seen
+    assert result.exit_code == 0
+    assert seen["host"] == "127.0.0.1"
+    assert seen["api_key"] == ""
 
 
 def test_serve_passes_configured_api_key(monkeypatch, tmp_path: Path) -> None:

tests/test_openai_api.py

@@ -132,7 +132,7 @@ async def test_api_key_protects_api_routes_but_not_health(aiohttp_client, mock_a
 
 @pytest.mark.skipif(not HAS_AIOHTTP, reason="aiohttp not installed")
 @pytest.mark.asyncio
-async def test_api_routes_fail_closed_without_configured_api_key(aiohttp_client, mock_agent) -> None:
+async def test_api_routes_allow_requests_without_configured_api_key(aiohttp_client, mock_agent) -> None:
     app = create_app(mock_agent, model_name="test-model")
     client = await aiohttp_client(app)
 
@@ -144,10 +144,9 @@ async def test_api_routes_fail_closed_without_configured_api_key(aiohttp_client,
     )
 
     assert health.status == 200
-    assert models.status == 401
-    assert chat.status == 401
-    assert (await models.json())["error"]["message"] == "API key is not configured"
-    mock_agent.process_direct.assert_not_called()
+    assert models.status == 200
+    assert chat.status == 200
+    mock_agent.process_direct.assert_called_once()
 
 
 @pytest.mark.skipif(not HAS_AIOHTTP, reason="aiohttp not installed")