Sloth-ninja puts users in charge of the AI keys

JessicaOSS now treats a signed-in user's own provider credentials as the first choice, with the shared server key waiting in reserve.

integrationworkflow

That changes the practical bargain for teams using a shared deployment. Someone who has supplied their own credentials will use them for chat and company searches, instead of quietly drawing on the organisation's default account. If their saved key cannot be used, the shared key still keeps the service running.

The account settings also stop treating a server key as a locked configuration. Users can add their own key, replace it, or remove it and return to the shared default. For Companies House searches, a user with their own key also uses their own rate-limit allowance rather than the shared bucket.

So what Legal teams offering a shared AI workspace should care if they need personal billing, clearer ownership of usage, or fewer fights over shared service limits.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

3 commits from Sloth-ninja/JessicaOSS, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`37c63d85`	User API keys always take precedence over server env keys	sloth-ninja	2026-07-20	↗ GitHub
commit body Owner decision (19/07/2026): a user's own BYO key must always take precedence over the server env key, reversing the env-first behaviour documented in the PR #25 review. - getUserApiKeys: user's decrypted key overrides the env key for every provider; env is the fallback. Decrypt failure keeps the env fallback. - getUserApiKeyStatus: source "user" whenever a user key exists (even if an env key is also set); else "env"; else unconfigured. - routes/user.ts PUT /user/api-keys/:provider: drop the hasEnvApiKey 409 block so users may always save/remove their own key; removal falls back to env (source "env"). MFA gating, try/catch, generic 500 unchanged. - Frontend api-keys page: server default is now informational, not a lock - field stays editable with copy explaining the user's key takes priority; existing Remove reverts to the server default. - Docs: CLAUDE.md env registry (provider-fallback + COMPANIES_HOUSE rows) and a BUILD_LOG entry noting the reversal + the rate-bucket consequence. - Tests: userApiKeys.test.ts covers precedence, env fallback, delete revert, decrypt-failure fallback, and status sources. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`0bf724b7`	Merge remote-tracking branch 'origin/main' into byo-key-precedence	sloth-ninja	2026-07-20	↗ GitHub
# Conflicts: # docs/BUILD_LOG.md
`050f0d72`	Merge remote-tracking branch 'origin/main' into byo-key-precedence	sloth-ninja	2026-07-20	↗ GitHub
# Conflicts: # docs/BUILD_LOG.md

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1167.md from inside the repo you want the changes in.

⬇ Download capture-thread-1167.md