[Phase 3] Add browser-native BYOK LLM agents #51

New issue

Closed

opened 2026-07-26 00:51:20 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-26 00:51:20 +00:00

(Migrated from github.com)

Parent: #2
Depends on: #18, #19, #20, #21, #33

Goal

Run LLM-backed investigation agents entirely from the browser with user-supplied API keys and no Quasar-owned proxy or backend.

Providers

OpenAI
Anthropic Claude
OpenRouter

Scope

Define a provider-neutral LLM adapter for model discovery, chat/completions, streaming, cancellation, structured output, usage, and normalized errors.
Implement provider adapters for OpenAI, Anthropic Claude, and OpenRouter.
Add a browser agent registry whose manifests declare provider/model requirements, input schema, prompt/template, tool capabilities, output graph-batch schema, and limits.
Execute agents through the existing action/worker lifecycle where browser and provider APIs allow it.
Route accepted agent output through graph-batch validation so every mutation is atomic, traceable, cancellable, and undoable.
Add a BYOK settings UI with masked input, explicit persistence controls, per-provider connection tests, model selection, and key removal.
Keep keys out of graph documents, exports, action logs, diagnostics, URLs, analytics, and error payloads.
Support session-only keys by default; persistent storage must be an explicit opt-in and use the safest browser storage available.
Add configurable API base URLs only where needed for OpenAI-compatible endpoints, with origin validation.
Document browser CORS limitations and provider-specific setup.

Acceptance criteria

A user can configure any of the three providers and run a sample agent without a Quasar backend.
Streaming tokens, cancellation, rate limits, authentication failures, unsupported models, and provider outages have distinct UI states.
Agent results cannot mutate the graph until they pass the canonical graph-batch validator.
Keys never appear in exported workspaces, traces, logs, diagnostics, or test snapshots.
Provider contract tests use mocked HTTP streams; browser tests verify one end-to-end mocked agent run per provider.
CSP/connect-src and endpoint allowlists cover only explicitly enabled providers.
Disabling or deleting a provider removes its in-memory credentials and prevents future calls.
The base app remains fully usable without any API key.

Parent: #2 Depends on: #18, #19, #20, #21, #33 ## Goal Run LLM-backed investigation agents entirely from the browser with user-supplied API keys and no Quasar-owned proxy or backend. ## Providers - OpenAI - Anthropic Claude - OpenRouter ## Scope - Define a provider-neutral LLM adapter for model discovery, chat/completions, streaming, cancellation, structured output, usage, and normalized errors. - Implement provider adapters for OpenAI, Anthropic Claude, and OpenRouter. - Add a browser agent registry whose manifests declare provider/model requirements, input schema, prompt/template, tool capabilities, output graph-batch schema, and limits. - Execute agents through the existing action/worker lifecycle where browser and provider APIs allow it. - Route accepted agent output through graph-batch validation so every mutation is atomic, traceable, cancellable, and undoable. - Add a BYOK settings UI with masked input, explicit persistence controls, per-provider connection tests, model selection, and key removal. - Keep keys out of graph documents, exports, action logs, diagnostics, URLs, analytics, and error payloads. - Support session-only keys by default; persistent storage must be an explicit opt-in and use the safest browser storage available. - Add configurable API base URLs only where needed for OpenAI-compatible endpoints, with origin validation. - Document browser CORS limitations and provider-specific setup. ## Acceptance criteria - A user can configure any of the three providers and run a sample agent without a Quasar backend. - Streaming tokens, cancellation, rate limits, authentication failures, unsupported models, and provider outages have distinct UI states. - Agent results cannot mutate the graph until they pass the canonical graph-batch validator. - Keys never appear in exported workspaces, traces, logs, diagnostics, or test snapshots. - Provider contract tests use mocked HTTP streams; browser tests verify one end-to-end mocked agent run per provider. - CSP/connect-src and endpoint allowlists cover only explicitly enabled providers. - Disabling or deleting a provider removes its in-memory credentials and prevents future calls. - The base app remains fully usable without any API key.