Fix: propagate session-only API key to background worker threads (proposal/analysis generation)

app/config.py

@@ -8,6 +8,7 @@ never printed, logged, or included in `repr()`.
 from __future__ import annotations
 
 import os
+import threading
 from dataclasses import dataclass, field
 from pathlib import Path
 
@@ -260,6 +261,15 @@ def _model_supports_vision(model: str | None) -> bool:
 
 _SESSION_ENV_KEY = "_session_env"
 
+# Background-worker fallback. A worker thread (see
+# :mod:`app.services.background_tasks`) has NO Streamlit script-run context, so
+# ``st.session_state`` — and therefore the session-only API key — is invisible
+# to it. Before launching a worker, the main thread snapshots the session
+# overrides and the worker installs them here, in its OWN thread-local. Because
+# the store is per-thread, one visitor's key can never leak into another
+# visitor's concurrent worker. Outside a worker this is simply unset.
+_thread_local = threading.local()
+
 
 def _has_streamlit_ctx() -> bool:
     """True only inside an active Streamlit script run.
@@ -278,15 +288,50 @@ def _has_streamlit_ctx() -> bool:
 
 
 def _session_store() -> dict | None:
-    """Return the live per-session override dict, or ``None`` when headless."""
-    if not _has_streamlit_ctx():
-        return None
-    try:
-        import streamlit as st
+    """Return the active per-session override dict, or ``None`` when absent.
 
-        return st.session_state.setdefault(_SESSION_ENV_KEY, {})
-    except Exception:  # pragma: no cover - defensive
-        return None
+    Resolution order:
+
+    1. Inside a Streamlit script run → the live ``st.session_state`` store.
+    2. Inside a background worker that had overrides installed → its
+       thread-local store (see :func:`install_thread_overrides`).
+    3. Otherwise (tests / bare mode) → ``None``.
+    """
+    if _has_streamlit_ctx():
+        try:
+            import streamlit as st
+
+            return st.session_state.setdefault(_SESSION_ENV_KEY, {})
+        except Exception:  # pragma: no cover - defensive
+            return None
+    return getattr(_thread_local, "store", None)
+
+
+def export_session_overrides() -> dict:
+    """Snapshot the current session's overrides (call on the main thread).
+
+    Returns a plain copy — including any API key — so a background worker can
+    carry the launching session's config across the thread boundary. Never log
+    the result.
+    """
+    store = _session_store()
+    return dict(store) if store else {}
+
+
+def install_thread_overrides(overrides: dict) -> None:
+    """Install ``overrides`` for the CURRENT thread (call inside the worker).
+
+    Stored in a thread-local so concurrent workers stay isolated. Also drops any
+    stale per-thread Settings cache so the next :func:`get_settings` rebuilds
+    from the freshly installed values.
+    """
+    store = dict(overrides or {})
+    _thread_local.store = store
+
+
+def clear_thread_overrides() -> None:
+    """Remove this thread's installed overrides (call in the worker's finally)."""
+    _thread_local.store = None
 
 
 def _env(name: str, default: str | None = None) -> str | None:

app/services/background_tasks.py

@@ -10,9 +10,16 @@ keeps going and the result is waiting when they return.
 
 IMPORTANT: the worker function must not touch ``st.session_state`` (Streamlit
 calls from a thread with no script-run context fail). Pass everything it needs
-as arguments and read the result back on the main thread. ``get_settings()`` is
-safe (it only reads a cached ``.env``); the LLM client's usage logging is
-already guarded against a missing session.
+as arguments and read the result back on the main thread.
+
+API-key propagation: the API key now lives only in the per-session store
+(``st.session_state``), which a worker thread cannot see. So before spawning the
+worker we snapshot the launching session's config overrides on the MAIN thread
+and re-install them into the worker's own thread-local (see
+``app.config.export_session_overrides`` / ``install_thread_overrides``). This
+makes ``get_settings()`` inside the worker resolve the same key/provider/model
+the user configured — without leaking it to any other visitor's worker. The LLM
+client's usage logging is already guarded against a missing session.
 """
 
 from __future__ import annotations
@@ -20,6 +27,8 @@ from __future__ import annotations
 import threading
 from typing import Any, Callable
 
+from app import config
+
 _lock = threading.Lock()
 _tasks: dict[str, dict[str, Any]] = {}
 
@@ -50,7 +59,15 @@ def start(task_id: str, fn: Callable[..., Any], *args: Any, **kwargs: Any) -> bo
             return False
         _tasks[task_id] = {"status": "running", "result": None, "error": None}
 
+    # Snapshot the launching session's config (incl. the session-only API key)
+    # HERE, on the main thread, while st.session_state is reachable. The worker
+    # re-installs it into its own thread-local so get_settings() resolves the
+    # right key. Empty when no session (tests / bare mode).
+    session_overrides = config.export_session_overrides()
+
     def _run() -> None:
+        if session_overrides:
+            config.install_thread_overrides(session_overrides)
         try:
             res = fn(*args, **kwargs)
             with _lock:
@@ -58,6 +75,9 @@ def start(task_id: str, fn: Callable[..., Any], *args: Any, **kwargs: Any) -> bo
         except Exception as exc:  # noqa: BLE001 - surface as a clean error status
             with _lock:
                 _tasks[task_id] = {"status": "error", "result": None, "error": str(exc)}
+        finally:
+            if session_overrides:
+                config.clear_thread_overrides()
 
     if _has_streamlit_runtime():
         threading.Thread(target=_run, daemon=True).start()