fix: avoid runtime makedirs in read-only install locations (Windows Program Files)

- Replace runtime hook with build-time inclusion of fakeredis/model/__init__.py
- Ensures model/ directory exists in bundle without needing write access at runtime
- Fixes PermissionError on Windows when installed to Program Files via MSI

Author: zqbake

.claude/worktrees/browser-use-implementation

@@ -0,0 +1 @@
+Subproject commit 82ccabdd2928761d0ad226a0cd42ef767564f830

MANIFEST.in

@@ -1,5 +1,5 @@
 # Include package data
-recursive-include pantheon/factory/templates *.md *.json
+recursive-include pantheon/factory/templates *.md *.json *.example
 recursive-include pantheon/toolsets/database_api/schemas *.json
 
 # Include documentation

build_backend.spec

@@ -3,7 +3,7 @@
 block_cipher = None
 
 from PyInstaller.utils.hooks import copy_metadata, collect_data_files
-import os, sys, tempfile
+import os, sys
 
 datas = [
     ('pantheon/factory/templates', 'pantheon/factory/templates'),
@@ -15,17 +15,14 @@ datas += copy_metadata('fastmcp')
 datas += collect_data_files('litellm', includes=['**/*.json'])
 # fakeredis: model/_command_info.py loads os.path.join(dirname(__file__), '..', 'commands.json')
 # PyInstaller must include the JSON so the relative path resolves at runtime.
+# Also include model/__init__.py so the model/ directory exists in the bundle
+# (avoids runtime os.makedirs in read-only install locations like Program Files).
 datas += collect_data_files('fakeredis', includes=['commands.json'])
-
-# Runtime hook: ensure fakeredis/model/ dir exists so ../commands.json resolves.
-_rthook = tempfile.NamedTemporaryFile('w', suffix='.py', delete=False)
-_rthook.write(
-    "import sys, os\n"
-    "d = getattr(sys, '_MEIPASS', None)\n"
-    "if d:\n"
-    "    os.makedirs(os.path.join(d, 'fakeredis', 'model'), exist_ok=True)\n"
-)
-_rthook.close()
+import fakeredis
+_fakeredis_dir = os.path.dirname(fakeredis.__file__)
+_model_init = os.path.join(_fakeredis_dir, 'model', '__init__.py')
+if os.path.exists(_model_init):
+    datas.append((_model_init, 'fakeredis/model'))
 
 a = Analysis(
     ['pantheon/chatroom/__main__.py'],
@@ -65,7 +62,7 @@ a = Analysis(
     ],
     hookspath=[],
     hooksconfig={},
-    runtime_hooks=[_rthook.name],
+    runtime_hooks=[],
     excludes=[
         # ── Knowledge / vector DB (lancedb only used in RAG toolset, lazy import) ──
         'lancedb', 'lance', 'pyarrow', 'llama_index', 'qdrant_client',

pantheon/chatroom/room.py

@@ -2033,3 +2033,35 @@ async def reload_settings(self) -> dict:
                 "success": False,
                 "message": f"Failed to reload settings: {str(e)}"
             }
+
+    @tool(exclude=True)
+    async def check_api_keys(self) -> dict:
+        """Check the configuration status of LLM API keys.
+
+        Returns a dict with each key's status (configured, source, masked value)
+        and whether any key is configured at all.
+        """
+        import os
+        from pantheon.settings import get_settings
+
+        settings = get_settings()
+        key_names = [
+            "OPENAI_API_KEY",
+            "ANTHROPIC_API_KEY",
+            "GEMINI_API_KEY",
+            "DEEPSEEK_API_KEY",
+        ]
+
+        keys = {}
+        for key in key_names:
+            value = settings.get_api_key(key)
+            if value:
+                # Determine source
+                source = "env" if os.environ.get(key) else "settings"
+                masked = value[:6] + "***" if len(value) > 6 else "***"
+                keys[key] = {"configured": True, "source": source, "masked": masked}
+            else:
+                keys[key] = {"configured": False, "source": None, "masked": None}
+
+        has_any_key = any(v["configured"] for v in keys.values())
+        return {"keys": keys, "has_any_key": has_any_key}

pantheon/chatroom/start.py

@@ -1,5 +1,6 @@
 import asyncio
 import os
+import shutil
 import sys
 import uuid
 from pathlib import Path
@@ -547,6 +548,16 @@ async def cleanup_zombie_nats(work_dir: Path):
     memory_dir = str(Path(memory_dir).resolve())
     workspace_path = str(Path(workspace_path).resolve())
 
+    # ===== Ensure .env exists (create from template if missing) =====
+    env_file = Path(workspace_path) / ".env"
+    if not env_file.exists():
+        env_template = Path(__file__).resolve().parent.parent / "factory" / "templates" / ".env.example"
+        if env_template.exists():
+            shutil.copy2(str(env_template), str(env_file))
+            logger.info(f"[STARTUP] Created .env template at {env_file}")
+        else:
+            logger.warning(f"[STARTUP] .env.example template not found at {env_template}")
+
     # ===== Step 1: Start or connect Endpoint =====
     endpoint = None
     final_endpoint_service_id = endpoint_service_id

pantheon/factory/templates/.env.example

@@ -0,0 +1,32 @@
+# ========================================
+# Pantheon API Keys Configuration
+# ========================================
+#
+# After editing this file, use "Reload Settings" in the UI
+# or restart the service to apply changes.
+#
+# Priority: Environment Variables > .env > settings.json
+#
+# ========================================
+
+# OpenAI API Key (GPT-4, GPT-3.5, etc.)
+#OPENAI_API_KEY=sk-your-openai-key-here
+
+# Anthropic API Key (Claude models)
+#ANTHROPIC_API_KEY=sk-ant-your-anthropic-key-here
+
+# Google Gemini API Key
+#GEMINI_API_KEY=your-gemini-key-here
+
+# DeepSeek API Key
+#DEEPSEEK_API_KEY=your-deepseek-key-here
+
+# ========================================
+# Advanced Configuration (Optional)
+# ========================================
+
+# Custom LiteLLM endpoint
+#LITELLM_BASE_URL=https://your-litellm-proxy.com
+
+# Debug mode
+#DEBUG=false