[OPIK-5496][OPIK-5498] [SDK] configure(force=True) still prompts interactively for workspace

[yaricom]

Details

Source: Claude session 2, issue #2

Even with force=True, configure() prompts "Do you want to use 'lothiraldan' workspace? (Y/n)" which causes EOFError in non-interactive (piped) execution. Had to discover and add both workspace= and automatic_approvals=True to suppress it.
force=True should imply non-interactive mode and skip all interactive prompts.

Steps to reproduce:

1. opik.configure(api_key=..., url=..., force=True) in a script run without a TTY
2. Get EOFError

Severity:

Major

---

Source: Claude session 2, issue #4

An existing ~/.opik.config had a different API key. Without force=True, configure() silently used the old key, then traces failed with: Unauthorized message type 'CreateTraceBatchMessage' processing request: {'code': 401, 'message': 'User not allowed to access workspace!'}.

The 401 error gave no hint that the wrong API key was being used or that the config file was overriding the programmatic key.

Steps to reproduce:

1. Have a stale ~/.opik.config with a different API key
2. Call opik.configure(api_key=NEW_KEY) without force=True
3. Traces fail with 401

Expected:

Either warn that a config file is overriding the programmatic key, or the programmatic key should take precedence.

Severity:

Major

---

Summary

This branch improves the OpikConfigurator behaviour around the force flag, adds a user-facing warning when a provided API key is silently ignored, and tightens the _update_config signature to prevent accidental silent no-ops.

Changes

sdks/python/src/opik/configurator/configure.py

1. _update_config — save_to_file is now required

The save_to_file parameter no longer has a default value (True → no default). Every call site must now explicitly pass save_to_file=True or save_to_file=False, making the intent visible at the call site and preventing accidental file writes.

2. Warning when a provided API key is not persisted

When the caller provides an api_key but force=False and an API key already exists in the configuration file, a LOGGER.warning is now emitted:

"You already have an API key set in the configuration file. If you want to change it, please use the --force flag or force=True when calling the configure() method. Otherwise, the configuration file will not be updated but the session will use the new API key."

Previously no feedback was given in this case, leaving users confused about why their new key was not saved.

3. force bypasses workspace approval prompt

_set_workspace now treats force=True the same as automatic_approvals=True when deciding whether to prompt the user to confirm the default workspace. This avoids an interactive prompt in automated/forced flows.

---

sdks/python/tests/unit/configurator/test_configure.py

Updated existing tests

All _update_config() call sites in tests were updated to pass the now-required save_to_file=True keyword argument explicitly, keeping them aligned with the new signature.

New test: warning when API key already set in config

TestGetApiKey::test_set_api_key__provided_api_key__another_key_already_set_in_config__not_forced__warning_is_shown

Verifies that LOGGER.warning is called with the correct message when:

• A new API key is passed to OpikConfigurator
• An API key already exists in the current config (current_config.api_key is not None)
• force=False

Also asserts that needs_update is False (the config file is not overwritten).

New test: force skips workspace approval

TestGetWorkspace::test_get_workspace_accept_default__force_enabled__no_approval_questions_asked

Verifies that when force=True the default workspace is accepted automatically and ask_user_for_approval is never called, even when automatic_approvals=False.

Change checklist

• User facing
• Documentation update

Issues

• Resolves #
• OPIK-5496

AI-WATERMARK

AI-WATERMARK: yes

• If yes:
  • Tools: Claude Code v2.1.81
  • Model(s): Sonnet 4.6
  • Scope: Unit tests
  • Human verification: Done

Testing

Created related unit tests

Documentation

No changes

[baz-reviewer]

This test calls the private helper OpikConfigurator._update_config(save_to_file=True) directly; should we rework it and other direct _update_config calls in this file to exercise the public OpikConfigurator.configure() with the needed flags/mocks?

_{Finding type: AI Coding Guidelines | Severity: 🟢 Low}

---

Want Baz to fix this for you? Activate Fixer

Other fix methods

Prompt for AI Agents:

Before applying, verify this suggestion against the current code. In
sdks/python/tests/unit/configurator/test_configure.py around lines 150 to 150, the test
directly calls the private helper OpikConfigurator._update_config(save_to_file=True).
Replace this with a call to the public entrypoint OpikConfigurator.configure(...) so the
test exercises the public API; invoke configure() with the same context (e.g. set any
flags like force or automatic_approvals, and ensure mocks are arranged so configure()
will perform the same save_to_file behavior). Also review and replace other direct
_update_config calls in this file around lines ~182, ~204, ~1254, ~1281, and ~1332 to
use OpikConfigurator.configure(...) instead, keeping assertions and mocks
(mock_opik_config, mock_update_session_config, mock_config_instance.save_to_file, etc.)
unchanged so the tests still assert the same outcomes.