fix: require user-provided API key for relabel endpoint

- Add webEnv export that omits CODEBUFF_API_KEY (type-level protection)
- Add ESLint rule to catch direct process.env.CODEBUFF_API_KEY in web
- Relabel endpoint extracts API key from Authorization header
- Web imports webEnv to get TypeScript error if accessing CODEBUFF_API_KEY
- Update agent-runtime README paths

Author: brandonkachen

.env.example

@@ -22,11 +22,6 @@ STRIPE_TEAM_FEE_PRICE_ID=price_dummy_team_fee_id
 LINKUP_API_KEY=dummy_linkup_key
 LOOPS_API_KEY=dummy_loops_key
 
-# Admin/Internal Tools
-# Required for admin relabeling operations (POST /api/admin/relabel-for-user)
-# Visit /usage in the web app to create a new API key
-CODEBUFF_API_KEY=dummy_codebuff_api_key
-
 # Discord Integration
 DISCORD_PUBLIC_KEY=dummy_discord_public_key
 DISCORD_BOT_TOKEN=dummy_discord_bot_token

packages/agent-runtime/src/templates/README.md

@@ -139,10 +139,9 @@ The path is resolved relative to the override file's directory.
 
 ## Implementation Details
 
-- Override processing happens in `backend/src/templates/agent-overrides.ts`
-- Integration points are in `backend/src/run-agent-step.ts`
+- Override processing happens in `packages/agent-runtime/src/templates/agent-overrides.ts`
 - Files are loaded into `ProjectFileContext.agentTemplates` (separate from knowledge files)
-- Agent template files are loaded in `npm-app/src/project-files.ts`
+- Agent template files are loaded in `cli/src/project-files.ts`
 - Path resolution uses `path.posix.join()` for cross-platform compatibility
 - Errors are logged but don't break agent execution (graceful fallback to base template)
 

packages/internal/src/env-schema.ts

@@ -2,8 +2,11 @@ import { clientEnvSchema, clientProcessEnv } from '@codebuff/common/env-schema'
 import z from 'zod/v4'
 
 export const serverEnvSchema = clientEnvSchema.extend({
-  // Backend variables
+  // Codebuff API key - used by CLI/SDK for authentication
+  // NOTE: Web should NOT use this directly - users must provide their own key
+  // See web/.eslintrc.cjs for enforcement
   CODEBUFF_API_KEY: z.string().optional(),
+  // LLM API keys
   OPEN_ROUTER_API_KEY: z.string().min(1),
   OPENAI_API_KEY: z.string().min(1),
   LINKUP_API_KEY: z.string().min(1),
@@ -33,12 +36,18 @@ export type ServerInput = {
 }
 export type ServerEnv = z.infer<typeof serverEnvSchema>
 
+// Web-specific schema that omits CODEBUFF_API_KEY
+// Web should never use this key - users must provide their own via Authorization header
+export const webEnvSchema = serverEnvSchema.omit({ CODEBUFF_API_KEY: true })
+export type WebEnv = z.infer<typeof webEnvSchema>
+
 // Bun will inject all these values, so we need to reference them individually (no for-loops)
 export const serverProcessEnv: ServerInput = {
   ...clientProcessEnv,
 
-  // Backend variables
+  // Codebuff API key
   CODEBUFF_API_KEY: process.env.CODEBUFF_API_KEY,
+  // LLM API keys
   OPEN_ROUTER_API_KEY: process.env.OPEN_ROUTER_API_KEY,
   OPENAI_API_KEY: process.env.OPENAI_API_KEY,
   LINKUP_API_KEY: process.env.LINKUP_API_KEY,

packages/internal/src/env.ts

@@ -1,4 +1,4 @@
-import { serverEnvSchema, serverProcessEnv } from './env-schema'
+import { serverEnvSchema, serverProcessEnv, webEnvSchema } from './env-schema'
 
 // Provide safe defaults for local/test runs to avoid schema failures
 const ensureEnvDefault = (key: string, value: string) => {
@@ -29,4 +29,9 @@ if (process.env.NEXT_PUBLIC_CB_ENVIRONMENT !== 'prod') {
   console.log('Using environment:', process.env.NEXT_PUBLIC_CB_ENVIRONMENT)
 }
 
+// Full env for SDK/CLI - includes CODEBUFF_API_KEY
 export const env = serverEnvSchema.parse(serverProcessEnv)
+
+// Web-specific env - CODEBUFF_API_KEY does NOT exist on this type
+// Use this in web package to get type-level protection against using CODEBUFF_API_KEY
+export const webEnv = webEnvSchema.parse(serverProcessEnv)

web/.eslintrc.cjs

@@ -22,6 +22,15 @@ module.exports = {
     '@typescript-eslint/no-explicit-any': 'off',
     '@typescript-eslint/no-unused-vars': 'off',
     'react/no-unescaped-entities': 'off',
+    // Prevent using CODEBUFF_API_KEY in web - users must provide their own API key
+    // This prevents accidentally using Codebuff's credits for user operations
+    'no-restricted-syntax': [
+      'error',
+      {
+        selector: "MemberExpression[property.name='CODEBUFF_API_KEY']",
+        message: 'CODEBUFF_API_KEY is not allowed in web package. Users must provide their own API key via Authorization header.',
+      },
+    ],
   },
   settings: {
     tailwindcss: {

web/src/app/api/admin/relabel-for-user/route.ts

@@ -19,7 +19,6 @@ import {
 import { userMessage } from '@codebuff/common/util/messages'
 import { generateCompactId } from '@codebuff/common/util/string'
 import { closeXml } from '@codebuff/common/util/xml'
-import { env } from '@codebuff/internal/env'
 import { promptAiSdk } from '@codebuff/sdk'
 import { NextResponse } from 'next/server'
 
@@ -112,15 +111,16 @@ export async function POST(req: NextRequest) {
       ? requestedLimit
       : DEFAULT_RELABEL_LIMIT
 
-  const apiKey = env.CODEBUFF_API_KEY
+  // Require API key from Authorization header - user must provide their own key
+  const apiKey = getApiKeyFromRequest(req)
   if (!apiKey) {
     return NextResponse.json(
       { 
-        error: 'CODEBUFF_API_KEY is not configured',
-        details: 'This endpoint now calls LLMs directly (backend was removed) and requires CODEBUFF_API_KEY to be set.',
-        hint: 'Add CODEBUFF_API_KEY to your environment variables. See .env.example for reference.',
+        error: 'API key required',
+        details: 'Provide your API key via Authorization header (Bearer token).',
+        hint: 'Visit /usage in the web app to create an API key.',
       },
-      { status: 500 },
+      { status: 401 },
     )
   }
 
@@ -535,6 +535,18 @@ function buildPromptContext(apiKey: string) {
   }
 }
 
+/**
+ * Extract API key from Authorization header (Bearer token)
+ */
+function getApiKeyFromRequest(req: NextRequest): string | null {
+  const authHeader = req.headers.get('Authorization')
+  if (!authHeader?.startsWith('Bearer ')) {
+    return null
+  }
+  const token = authHeader.slice(7).trim()
+  return token || null
+}
+
 async function ensureBigQuery() {
   if (!bigqueryReady) {
     bigqueryReady = setupBigQuery({ logger })