⚖MikeWatch Forks of the Mike legal-AI codebase, distilled for legal-tech readers
Home · Sloth-ninja/JessicaOSS · this thread

Sloth-ninja puts client API keys ahead of the house account

A small policy change gives users clearer control over whose account pays for AI usage.

multi-tenantsecurity

Sloth-ninja's JessicaOSS fork now gives a user's saved AI service key priority over a key supplied by the organisation running the system.

That matters in any bring-your-own-key setup. Someone who has entered their own credentials should use their own account, rather than quietly drawing on the firm's shared account and its spending limits. The change is backed by extensive tests, making the billing and access rule explicit rather than accidental.

So what Legal-tech teams offering client or matter-level AI access should care because clear key precedence avoids surprise costs, rate-limit conflicts, and muddled responsibility.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

4 commits from Sloth-ninja/JessicaOSS, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date
37c63d85 User API keys always take precedence over server env keys sloth-ninja 2026-07-20 ↗ GitHub
commit body 
Owner decision (19/07/2026): a user's own BYO key must always take
precedence over the server env key, reversing the env-first behaviour
documented in the PR #25 review.

- getUserApiKeys: user's decrypted key overrides the env key for every
  provider; env is the fallback. Decrypt failure keeps the env fallback.
- getUserApiKeyStatus: source "user" whenever a user key exists (even if
  an env key is also set); else "env"; else unconfigured.
- routes/user.ts PUT /user/api-keys/:provider: drop the hasEnvApiKey 409
  block so users may always save/remove their own key; removal falls back
  to env (source "env"). MFA gating, try/catch, generic 500 unchanged.
- Frontend api-keys page: server default is now informational, not a lock
  - field stays editable with copy explaining the user's key takes
  priority; existing Remove reverts to the server default.
- Docs: CLAUDE.md env registry (provider-fallback + COMPANIES_HOUSE rows)
  and a BUILD_LOG entry noting the reversal + the rate-bucket consequence.
- Tests: userApiKeys.test.ts covers precedence, env fallback, delete
  revert, decrypt-failure fallback, and status sources.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
0bf724b7 Merge remote-tracking branch 'origin/main' into byo-key-precedence sloth-ninja 2026-07-20 ↗ GitHub 
# Conflicts:
#	docs/BUILD_LOG.md
050f0d72 Merge remote-tracking branch 'origin/main' into byo-key-precedence sloth-ninja 2026-07-20 ↗ GitHub 
# Conflicts:
#	docs/BUILD_LOG.md
df11d28c Merge pull request #27 from Sloth-ninja/byo-key-precedence Ezana.H 2026-07-20 ↗ GitHub 
User API keys always take precedence over server env keys

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-860.md from inside the repo you want the changes in.

⬇ Download capture-thread-860.md