fix(init): wire Custom provider through OpenAI-compatible runtime path (closes #83)

[initializ-mk]

Summary

Closes #83.

The wizard's Custom provider option is documented as "point Forge at any OpenAI-compatible endpoint" (OpenRouter, litellm, vLLM, self-hosted Kimi/Llama, etc.). It collected the right inputs but wrote artifacts the runtime could not consume:

1. forge.yaml got provider: custom, which the LLM client factory rejects (forge-core/llm/providers/factory.go has no case "custom":). The runner falls back to StubExecutor and every task fails with agent execution not configured for framework "forge".
2. .env got MODEL_BASE_URL / MODEL_API_KEY, which ResolveModelConfig never reads — only per-provider names (OPENAI_BASE_URL, etc.) are consulted.
3. Even after hand-fixing (1) and (2), stored ChatGPT OAuth credentials silently override an explicit OPENAI_BASE_URL — createProviderClient replaces cfg.BaseURL with chatgpt.com/backend-api/codex. ChatGPT then 400s on the operator's model, with no signal that the endpoint was hijacked.

Fix

Wire 1+2 — forge-cli/cmd/init.go

New normalizeCustomProvider() called at the top of scaffold(). Single entry point covers both the TUI wizard and the Web UI POST. Rewrites ModelProvider=custom → openai and migrates MODEL_BASE_URL / MODEL_API_KEY → OPENAI_BASE_URL / OPENAI_API_KEY.

Handles all three shapes that may arrive:

• Legacy MODEL_* env vars (current TUI wizard, older Web UI).
• New OPENAI_* env vars written directly (post-fix Web UI).
• Non-interactive --api-key flag where opts.APIKey is set but no env var is.

buildEnvVars extended to emit OPENAI_BASE_URL when set; dead case "custom": removed.

OAuth-precedence guardrail — forge-cli/runtime/runner.go + forge-cli/cmd/ui.go

When provider == "openai" AND cfg.BaseURL != "" AND cfg.APIKey == "", refuse rather than fall through to OAuth. Error explicitly names:

• the configured base URL
• the missing env var (OPENAI_API_KEY)
• the override (chatgpt.com/backend-api/codex) that would otherwise occur silently

Applied to both the agent runtime (runner.go) and the skill builder chat handler (cmd/ui.go). Anthropic / Gemini / Ollama paths unaffected.

Web UI — forge-ui/handlers_create.go + types.go + static/app.js

Wizard metadata advertises BaseURLEnv: \"OPENAI_BASE_URL\" (was \"MODEL_BASE_URL\"); the React form binds to OPENAI_BASE_URL directly. POSTs whose ModelProvider == \"custom\" still work — they hit the same scaffold() entry point and get normalized identically.

Regression tests

10 new tests, all -race green:

forge-cli/cmd/init_custom_provider_test.go (6 tests)

• TestNormalizeCustomProvider_RewritesLegacyEnvVars — old MODEL_* shape → OPENAI_*
• TestNormalizeCustomProvider_NoOpForOtherProviders — table across openai/anthropic/gemini/ollama
• TestNormalizeCustomProvider_PreExistingOpenAIVarsPreserved — newer Web UI shape isn't clobbered
• TestNormalizeCustomProvider_APIKeyFallsBackToOptsField — non-interactive --api-key path
• TestScaffold_CustomProviderProducesOpenAIShape — end-to-end; pins forge.yaml + .env content; asserts no MODEL_* leak
• TestScaffold_CustomProviderWebUIShape — parity with Web UI POST shape

forge-cli/runtime/runner_oauth_guardrail_test.go (4 tests)

• TestCreateProviderClient_BaseURLSetWithoutAPIKey_RefusesOAuth — pins the guardrail + verifies the error message mentions OPENAI_BASE_URL, the configured URL, and OPENAI_API_KEY
• TestCreateProviderClient_BaseURLSetWithAPIKey_BypassesOAuth — happy path still works
• TestCreateProviderClient_NoBaseURL_AllowsOAuthPath — existing openai.com OAuth use unaffected
• TestCreateProviderClient_AnthropicWithBaseURL_Unaffected — guardrail scoped to openai

Gates

• go test -race -count=1 ./forge-cli/cmd/... ./forge-cli/runtime/... ./forge-ui/... — green
• golangci-lint run — 0 issues across forge-cli, forge-ui, forge-core
• gofmt -l forge-cli/ forge-ui/ forge-core/ — clean

Migration

CHANGELOG "Unreleased" section calls out the rename for users with checked-in provider: custom configs:

-provider: custom
+provider: openai

-MODEL_BASE_URL=...
-MODEL_API_KEY=...
+OPENAI_BASE_URL=...
+OPENAI_API_KEY=...

Test plan

• go test -race -count=1 ./forge-cli/cmd/... ./forge-cli/runtime/... ./forge-ui/... green
• golangci-lint run clean across the three modules
• gofmt -l clean
• Manual: TUI Custom flow writes provider: openai + OPENAI_BASE_URL/OPENAI_API_KEY (pinned by TestScaffold_CustomProviderProducesOpenAIShape)
• Manual: Web UI Custom flow writes the same shape (pinned by TestScaffold_CustomProviderWebUIShape)
• Manual: OAuth-credentials + OPENAI_BASE_URL without OPENAI_API_KEY → clear error, no silent ChatGPT redirect (pinned by TestCreateProviderClient_BaseURLSetWithoutAPIKey_RefusesOAuth)
• End-to-end smoke against a real OpenAI-compatible endpoint (operator-side; the reporter's eurl config against OpenRouter / Kimi)