fix(auth): unblock [M] manual-fallback API key path + suppress misleading "Claude model unavailable" error

[bird-m]

Summary

Two regressions, both reported in #npx-amplitude-wizard:

1. "When I manually paste in my API key from my account, nothing happens."
2. "Then I asked the Wizard if something broke, and I got a Claude error in return." (There's an issue with the selected model (anthropic/claude-sonnet-4-6). It may not exist or you may not have access to it. Run --model to pick a different model.)

Both surfaced after the browser sign-in returned 400 Bad Request — Request Header Or Cookie Too Large from auth.amplitude.com (Colin's workaround: clear AMP_*** cookies — pre-existing cookies push the PKCE-laden URL past nginx's large_client_header_buffers budget). With OAuth blocked, the user pressed [M] to enter their API key directly — and ran straight into the two regressions below.

Symptom 1 — silent manual-fallback submission

AuthScreen.tsx's handleApiKeySubmit set credentials and persisted the key, but:

• manualFallbackOpen stayed true, so the screen kept rendering the same Enter your project API key headline + an empty TextInput.
• The savedKeySource ✓ row only renders in Step 5 (api_key_notice path), not in the [M] view.

Net effect: the user saw zero acknowledgement of their action and reasonably assumed the wizard was hung.

Fix: after a successful submit, close the fallback form (setManualFallbackOpen(false)) and surface a green checkmark line in the OAuth-waiting view above the login URL:

✓ API key saved — finish browser sign-in to continue.

Note: the [M] path can't on its own satisfy Auth.isComplete (that gate also needs a resolved org/project, which only browser OAuth supplies). So we can't advance the flow on the strength of the key alone — but we can give the user a visible "received" signal and tell them what they still need to do.

Symptom 2 — Tab/Ask routes to a confusing "Claude model unavailable" error

resolveConsoleCredentials in src/lib/console-query.ts returned kind: 'gateway' as long as the session had a projectApiKey + host, even when credentials.accessToken === '' (the [M] path has no OAuth bearer yet). queryConsole then routed through queryConsoleWithClaudeAgentSdk → initializeAgent, which falls through to the local-claude CLI path:

const useLocalClaude = !config.amplitudeBearerToken && !useDirectApiKey;

The Claude Code SDK then surfaced the misleading There's an issue with the selected model (anthropic/claude-sonnet-4-6)... error — totally orthogonal to what was actually wrong (the user wasn't authenticated).

Fix: require a non-empty credentials.accessToken for the gateway branch. When that's missing, fall through to kind: 'none' so queryConsole's existing early-exit surfaces the friendly:

Claude is not available yet — complete authentication first.

Test plan

• New focused tests:
  • src/lib/__tests__/console-query.test.ts — two regression cases pinning the accessToken-empty path to kind: 'none' and the populated path to kind: 'gateway'.
  • src/ui/tui/screens/__tests__/AuthScreen.manual-fallback.test.tsx — drives the full keystroke path (M → 32-char hex key → Enter) and asserts both the credential mutation and the acknowledgement copy.
• Ran related Vitest paths in stable forks pool (per CLAUDE.md):

pnpm exec vitest run --pool=forks --maxWorkers=1 \
  src/ui/tui/screens/__tests__/AuthScreen.region-host.test.tsx \
  src/ui/tui/screens/__tests__/AuthScreen.snap.test.tsx \
  src/ui/tui/screens/__tests__/AuthScreen.coaching.test.tsx \
  src/ui/tui/screens/__tests__/AuthScreen.manual-fallback.test.tsx \
  src/lib/__tests__/console-query.test.ts \
  src/ui/tui/__tests__/router.test.ts \
  src/ui/tui/__tests__/flow-invariants.test.ts
# → Test Files  7 passed (7)
# → Tests       178 passed (178)

• pnpm exec prettier --check and pnpm exec eslint clean on all four touched files; lint-staged hooks ran on each commit.

Out of scope / follow-ups

• The underlying 400 Request Header Or Cookie Too Large from auth.amplitude.com is a server-side nginx / cookie-budget issue, not a wizard bug. Not addressed here.
• The [M] fallback still can't, by design, complete a full wizard run without OAuth (no org/project resolution). The acknowledgement copy now tells the user that explicitly. A bigger product decision to allow API-key-only runs would touch Auth.isComplete, several downstream screens, and analytics scoping — tracked separately.

Checklist

• Opened PR via the cloud-agent PR tool after push.
• pnpm exec prettier --check and pnpm exec eslint pass on all changed files; targeted Vitest runs green (see above).
• TUI / router / flows.ts / store.ts navigation: ran the focused Vitest commands from CLAUDE.md on router.test.ts + flow-invariants.test.ts + the relevant screens/__tests__/ files.
• No /reflect checklist needed — narrow surgical bug fix, no architectural drift.
• No LLM call-site IDs added, removed, or changed — queryConsole semantics (gateway / direct / none) are preserved; only the gating predicate was tightened.

Slack Thread