feat: AI Selector Widget by olexii4 · Pull Request #1505 · eclipse-che/che-dashboard

olexii4 · 2026-03-30T00:58:50Z

What does this PR do?

Adds an AI Selector widget to the Create Workspace page and integrates AI tool management across the dashboard, allowing users to pick an AI tool (e.g. Gemini CLI, Claude Code, OpenCode), save their API key, and have the tool automatically injected into workspaces.

Type Definitions

Two separate types model the AI feature:

AiProviderDefinition — provider metadata (id, name, publisher, description, icon, docs URL). Icons and descriptions live on the provider, not on individual tools.
AiToolDefinition — injection details (providerId as FK to provider, tag, binary, pattern, injectorImage, envVarName). The providerId follows vendor/product convention (e.g. anthropic/claude, google/gemini).

Create Workspace — AI Provider Selector

Accordion-based UI ("Use a Default AI Provider" / "Choose an AI Provider") rendered on the Create Workspace page between Editor Selector and Import form.
Link to "Manage API keys in User Preferences" for quick navigation.

User Preferences — AI Providers Keys

New "AI Providers Keys" tab in User Preferences with a table listing configured API keys per tool.
Add/Edit modal with provider dropdown and masked API key input;
Delete confirmation modal.

Workspace Details — Overview Tab

AiToolFormGroup section displaying the currently injected AI tool (or "None").
Edit mode opens a radio-button modal listing all available tools with descriptions from the provider definition.
Info modal explaining the injection mechanism and listing available tools with provider descriptions.

Workspaces List — AI Provider Column

New "AI Provider" column in the Workspaces List table.

AI Tool Injection into DevWorkspace

addAiToolToWorkspace() creates an init container from the tool's injectorImage, a shared injected-tools volume, and DevWorkspace lifecycle commands:
- preStart: apply command runs the injector init container.
- postStart: exec command symlinks the binary into PATH and optionally runs setupCommand.
Two injection patterns: init (single binary copy) and bundle (full runtime directory with symlink).

Screenshot/screencast of this PR

What issues does this PR fix or reference?

fixes eclipse-che/che#23796

Is it tested? How?

Setting up the AI Tool Registry

The dashboard reads AI tool definitions from a Kubernetes ConfigMap at runtime. To enable the AI widgets you need to create this ConfigMap:

# Clone the AI tool images repository
git clone https://github.com/olexii4/che-ai-tool-images.git
cd che-ai-tool-images

# Set your Che namespace
NS="${CHE_NAMESPACE:-eclipse-che}"

# Create the AI tool registry ConfigMap
oc create configmap ai-tool-registry \
  --from-file=registry.json=registry.json \
  -n "$NS" \
  --dry-run=client -o yaml | \
  oc label --local -f - \
    app.kubernetes.io/component=ai-tool-registry \
    app.kubernetes.io/part-of=che.eclipse.org \
    -o yaml | \
  oc apply -f -

When no ConfigMap is found, the dashboard returns an empty registry and all AI-related UI elements are hidden automatically. To remove all AI tools:

oc delete configmap ai-tool-registry -n "${CHE_NAMESPACE:-eclipse-che}"

Manual testing steps

Deploy Eclipse Che with the dashboard image from this PR.
Create Workspace page: verify the AI Provider Selector accordion renders below the Editor Selector. Expand "Choose an AI Provider" — cards should show provider icons, names, and descriptions sorted alphabetically, navigable with arrow keys. Selecting a card and creating a workspace should inject the tool's init container, shared volume, and lifecycle commands into the DevWorkspace spec.
Default provider message: if the admin configures defaultAiProvider in the CheCluster CR, the "Use a Default AI Provider" panel should display the resolved provider name (e.g. "The default AI provider "Gemini" configured by your administrator will be used.").
User Preferences → AI Providers Keys tab: add an API key for a tool — verify the secret is created in the user namespace with correct labels (che.eclipse.org/ai-provider-id, controller.devfile.io/mount-to-devworkspace, controller.devfile.io/watch-secret) and annotation (controller.devfile.io/mount-as: env). Update and delete the key. Verify the "Key configured" badge updates on the Create Workspace gallery cards.
Workspaces List: verify the "AI Provider" column shows the injected tool icon and name for workspaces that have an AI tool, and "-" for those without.
Workspace Details → Overview tab: verify the AI Tool section shows the current tool or "None". Click the info icon — verify the modal shows tools with provider descriptions. Click edit, select a different tool, save — verify the DevWorkspace spec is updated. When no tools are configured, verify the empty-state message is shown.
Workspace runtime: start a workspace with an injected tool (e.g. Gemini CLI). Open a terminal in the editor container and verify the tool binary is available in PATH (e.g. which gemini). Verify the API key env var is set (e.g. echo $GEMINI_API_KEY).
Empty registry: delete the ai-tool-registry ConfigMap and verify that the AI Provider Selector on the Create Workspace page, the AI Provider(s) column in the Workspaces List, and the AI Providers Keys tab in User Preferences are all hidden.
AI tool injection (Gemini CLI): on the Create Workspace page, select "Gemini CLI" as the AI Provider. Create a new workspace from any sample (e.g. Go). Wait for the workspace to start and the IDE to load. Open a terminal in the IDE and run gemini — verify the Gemini CLI starts (or prints its help/version output), confirming the AI tool binary was injected into PATH.
AI tool injection (Claude Code): repeat step 9 but select "Claude Code" as the AI Provider. In the terminal, run claude — verify the Claude Code CLI is available.
Multiple AI tools: on the Create Workspace page, expand "Choose an AI Provider" and select multiple providers (e.g. both Gemini CLI and Claude Code). Create a workspace, open a terminal, and verify both gemini and claude commands are available. Check the Workspaces List — the "AI Provider(s)" column should show icons for both tools.

Release Notes

Docs PR

eclipse-che/che-docs#3062

che-bot · 2026-03-30T00:58:58Z

Click here to review and test in web IDE:

github-actions · 2026-04-01T02:26:20Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1505 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1505", name: che-dashboard}]}}]"

github-actions · 2026-04-01T03:03:47Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1505 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1505", name: che-dashboard}]}}]"

github-actions · 2026-04-01T03:16:37Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1505 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1505", name: che-dashboard}]}}]"

Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…al render Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

The setupCommand (e.g. creating ~/.gemini config dir) was joined with && to the critical symlink/PATH commands. When $HOME is read-only (e.g. Go toolset container), the setup failure prevented the symlink from being created, leaving the AI tool binary missing from PATH. Wrap setupCommand in a best-effort block so symlink and PATH setup always execute regardless of setup failures. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…and test cleanup - Guard fetchAiProviderKeyStatus to skip when no AI providers/tools exist - Implement updateOutdatedAiTools() to auto-update stale AI tool injectors before workspace start (tag priority: next > latest > semver) - Fix bulk delete of AI provider keys (modal now accepts array of providers) - Replace personal image references with dummy names in tests - Add unit tests for updateOutdatedAiTools and prepareDevfile AI injection Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…cleanup commands Init containers now clean their own files before copying, handling image updates naturally. removeAiToolFromWorkspace no longer adds postStart cleanup commands. sanitizeStaleAiTools now also removes orphaned tool commands (install/symlink/run/cleanup) whose injector component no longer exists in the spec. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

…Line Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

The frontend no longer base64-encodes the API key via btoa() before posting it to the backend. The backend is responsible for encoding when creating the Kubernetes Secret. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Kubernetes Secret `data` expects base64-encoded values, but the API key now arrives as plain text after removing frontend btoa() encoding. Switch to `stringData` so Kubernetes handles base64 encoding automatically. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

The onSelect callback was called inside the setState() updater function and read this.state.expandedId instead of prevState. Move the side effect to the setState callback to ensure it runs after state is committed and reads the correct values. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

When removing an AI tool, a cleanup postStart command is added to remove stale binaries from the shared PVC on the next workspace start. sanitizeStaleAiTools now preserves cleanup commands (they must run at least once) while still removing orphaned install/symlink/run commands. Also adds missing ai-registry mock in workspaceCreationTimeCheck to fix CI failure. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Wrap cleanup commands in `nohup sh -c '...' &` so they never block or freeze workspace startup. Each tool's cleanup runs independently and in parallel. If removal fails the command retries on next start. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Since cleanup postStart commands run in the background, by the next workspace start they have already executed. sanitizeStaleAiTools now removes orphaned cleanup-* commands automatically, so they do not accumulate in the spec even if the tool is never re-added. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

- Restrict toolId schema to K8s-label-safe characters (remove : and @) - Sanitize all non-label-safe chars in toSanitizedProviderId - Fix stuck isLoading when tools array is empty in refreshKeyStatus - Combine sanitize + update AI tools into a single PATCH on start - Batch double setState in AiSelector.handleToggle - Use providerId comparison instead of reference equality in List - Add onError fallback to provider icon <img> tags - Avoid redundant getProvider() calls in Gallery render Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Replace all occurrences of the specific AI agent name in code comments with a generic "AI Assistant" identifier. Assisted-by: AI Assistant Signed-off-by: Oleksii Orel <oorel@redhat.com>

When sanitizeStaleAiTools removes the injected-tools volume (because no recognized injectors remain), also remove the injected-tools volume mount and PATH env override from editor containers. Without this, the DevWorkspace operator rejects the spec with "unable to find volume mount injected-tools in devfile volume components". Assisted-by: AI Assistant Signed-off-by: Oleksii Orel <oorel@redhat.com>

Cleanup commands added by removeAiToolFromWorkspace were removed by sanitizeStaleAiTools before they could execute on cold start. Add a pending-cleanup annotation so the cleanup command survives one start cycle, executes during postStart, then gets removed on the next start. Also add a comment explaining why $(PATH) substitution cannot be used in the editor container env. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

JSON.parse can return primitives or arrays, not just objects. Add a runtime type guard before casting to Record<string, unknown> to prevent potential property access on non-object values. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Add tests for AiConfig selectors, fetchAiRegistry API client, AiSelectorDocsLink component, and AiSelectorErrorBoundary component to bring global function coverage back above the 85% threshold. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

The PATCH in startWorkspace only sent /spec/template, so annotation changes from sanitizeStaleAiTools were lost. This caused cleanup commands to never be removed and stale tool binaries to persist on the shared volume across restarts. Also adds tests for AddEditModal and DeleteModal to restore function coverage above the 85% threshold. Assisted-by: Claude Sonnet 4.5 Signed-off-by: Oleksii Orel <oorel@redhat.com>

Assisted-by: Claude Sonnet 4.5 Signed-off-by: Oleksii Orel <oorel@redhat.com>

github-actions · 2026-05-07T11:28:36Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1505 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1505", name: che-dashboard}]}}]"

ibuziuk

@olexii4 let's add the Tech preview label to the widget, similar to what we have on devfile samples:

dmytro-ndp · 2026-05-07T12:17:10Z

I have a few questions:

there are also codex CLI and Copilot CLI available in the Market. Should we support them as well?
do you need AI CLI owner agreements to place their tile in the User Dashboard?
will there be team wide API keys supported which covers several accounts?

Adds tags support to AiProviderDefinition and renders a 'Tech-Preview' badge on AI provider cards in the 'Choose an AI Provider' widget, mirroring the existing badge pattern on devfile sample cards. - Add tags?: string[] to AiProviderDefinition (common package) - Pass tags from AiProviderGallery to AiProviderEntry - Render Tech-Preview badge in CardHeader.actions when tag is present - Add tests covering badge visibility with and without the tag Assisted-by: Claude Sonnet 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

github-actions · 2026-05-09T04:53:41Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1505 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1505", name: che-dashboard}]}}]"

olexii4 · 2026-05-09T16:47:10Z

I have a few questions:

There are also Codex CLI and Copilot CLI available in the market. Should we support them as well?

Do you need AI CLI owner agreements to place their tile in the User Dashboard?

Will there be team-wide API keys supported which cover several accounts?

@dmytro-ndp, here is my take on this:

Q1 — Should we support Codex CLI, Copilot CLI, or other tools?

This PR introduces only the injection mechanism — it does not ship, bundle, or endorse any specific AI CLI. The responsibility for which tools are available rests entirely with the cluster administrator who deploys the ai-tool-registry ConfigMap. The Dashboard simply reads whatever providers and tools the admin has registered and renders them.

Any CLI can be supported — Codex CLI, Copilot CLI, or anything else — as long as an admin publishes a ConfigMap with the corresponding provider/tool entry and a container image that performs the injection. The current reference registry at github.com/olexii4/che-ai-tool-images (Gemini, Claude Code, OpenCode) exists solely to validate the mechanism and is not meant to be exhaustive.

Q2 — Do we need agreements with AI CLI owners to show their tile in the Dashboard?

No formal agreement is required on Che's side, for two reasons:

Che does not distribute the AI software. The CLI binary lives in a container image the admin supplies — Che only reads metadata (name, icon URL, description) from a ConfigMap. There is no bundling, redistribution, or sublicensing of any vendor's software by Eclipse Che itself.
Icons are MIT-licensed. The current registry uses the lobehub open-source icon pack, which covers Gemini, Claude, and similar marks for product-identification purposes in developer tools — standard nominative fair use.

That said, administrators adding a specific tool to their registry take on the ToS responsibility for that tool. A couple of things worth flagging:

Anthropic — their 2025 commercial terms restrict third-party tools from spoofing the official Claude Code client to obtain more favourable API limits. Admins deploying a custom Claude image should ensure it complies. (Anthropic Commercial Terms)
GitHub Copilot CLI — governed by a non-transferable, limited licence. An org wishing to inject it would need a valid Copilot Business/Enterprise subscription and should confirm that injecting it into shared containers falls within their licence. (GitHub Copilot Policy)

Q3 — Will team-wide API keys covering several accounts be supported?

Not in this implementation — and doing it properly is non-trivial.

The current design injects the API key as a per-workspace environment variable sourced from a per-user Kubernetes Secret. Each user manages their own key. A shared team key would require a cluster-level Secret readable across user namespaces, which creates real problems:

Any user could trivially extract it via echo $ANTHROPIC_API_KEY.
Cost and quota attribution across users becomes opaque.
One compromised workspace exposes the key for everyone.

Beyond that, AI providers issue keys at the individual or organisation level and offer no built-in per-seat partitioning, so tracking who consumed what is impossible without an intermediary.

The right path for team-wide keys would be a proxy gateway — something like LiteLLM — that holds the master key server-side, enforces per-user quotas, and hands short-lived scoped tokens to individual workspaces. That is a separate, substantial feature and out of scope for this PR.

@ibuziuk WDYT?

olexii4 · 2026-05-11T02:10:31Z

@olexii4 let's add the Tech preview label to the widget, similar to what we have on devfile samples:

@ibuziuk I have fixed it:

openshift-ci Bot added the do-not-merge/work-in-progress label Mar 30, 2026

github-advanced-security AI found potential problems Mar 30, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/routes/api/aiConfig.ts Fixed

olexii4 force-pushed the AI_widget branch 3 times, most recently from 147736e to dd23665 Compare March 30, 2026 01:15

github-advanced-security AI found potential problems Mar 30, 2026

View reviewed changes

Comment thread packages/dashboard-backend/src/routes/api/aiConfig.ts Fixed

olexii4 force-pushed the AI_widget branch 7 times, most recently from 7a2dae5 to c0f7621 Compare March 30, 2026 05:03

ibuziuk mentioned this pull request Mar 30, 2026

Dev Tools Week Q1 2026 eclipse-che/che#23749

Closed

22 tasks

olexii4 force-pushed the AI_widget branch 8 times, most recently from cb23caf to e756cf0 Compare April 1, 2026 02:13

olexii4 force-pushed the AI_widget branch 3 times, most recently from 73b403a to 183e6c5 Compare April 1, 2026 03:02

olexii4 force-pushed the AI_widget branch from 183e6c5 to b6e0ac0 Compare April 1, 2026 03:19

olexii4 added 23 commits May 7, 2026 14:12

test(ai): add unit tests for AI registry and provider components

b9b6609

Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

fix(ai): update injector image references from okurinny to oorel

d569983

Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

fix(ai): update OverviewTab snapshots after AiToolFormGroup condition…

89a9e11

…al render Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

fix(ai): add aiConfig state to startWorkspace test mock store

62b52e6

Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

docs(ai): add security note for setupCommand in buildPostStartCommand…

b35c180

…Line Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Orel <oorel@redhat.com>

chore: replace AI agent name with generic identifier

70be13b

Replace all occurrences of the specific AI agent name in code comments with a generic "AI Assistant" identifier. Assisted-by: AI Assistant Signed-off-by: Oleksii Orel <oorel@redhat.com>

test(ai): add coverage for AI tool sanitization in startWorkspace

37f5bc4

Assisted-by: Claude Sonnet 4.5 Signed-off-by: Oleksii Orel <oorel@redhat.com>

fix: close ReconnectingWebSocket in test cleanup

26b698f

Assisted-by: Claude Sonnet 4.5 Signed-off-by: Oleksii Orel <oorel@redhat.com>

ibuziuk reviewed May 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: AI Selector Widget#1505

feat: AI Selector Widget#1505
olexii4 wants to merge 31 commits into
mainfrom
AI_widget

olexii4 commented Mar 30, 2026 •

edited

Loading

Uh oh!

che-bot commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented May 7, 2026

Uh oh!

ibuziuk left a comment

Uh oh!

dmytro-ndp commented May 7, 2026

Uh oh!

github-actions Bot commented May 9, 2026

Uh oh!

olexii4 commented May 9, 2026

Uh oh!

olexii4 commented May 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

olexii4 commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Type Definitions

Create Workspace — AI Provider Selector

User Preferences — AI Providers Keys

Workspace Details — Overview Tab

Workspaces List — AI Provider Column

AI Tool Injection into DevWorkspace

Screenshot/screencast of this PR

What issues does this PR fix or reference?

Is it tested? How?

Setting up the AI Tool Registry

Manual testing steps

Release Notes

Docs PR

Uh oh!

che-bot commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

github-actions Bot commented May 7, 2026

Uh oh!

ibuziuk left a comment

Choose a reason for hiding this comment

Uh oh!

dmytro-ndp commented May 7, 2026

Uh oh!

github-actions Bot commented May 9, 2026

Uh oh!

olexii4 commented May 9, 2026

Uh oh!

olexii4 commented May 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

olexii4 commented Mar 30, 2026 •

edited

Loading