Repository navigation
Say at boot when the key cannot call the configured model - #782
Merged
Merged
Conversation
A project key without access to the tenant package's default_model passed every start-up check and failed at the first message, as "The model `...` does not exist or you do not have access to it", in front of whoever sent it. Found deploying on EKS with a key whose project did not allow gpt-5.6-terra. The server now reads the provider's single-model endpoint once at boot, with the key resolveModelApiKey would hand a Bot, and logs model-unavailable (404) with the model and the fix, model-credential-rejected (401/403), or model-check-unreadable. It does not ask an OPENAI_BASE_URL or ANTHROPIC_BASE_URL endpoint, where a single-model lookup often does not exist and a 404 would mean nothing, says nothing while no key is configured, never logs the key, and never delays start-up.
guidovizoso
requested review from
MikeRyanDev,
davidmckayv,
mxmzb and
tylerslaton
as code owners
October 13, 2026 12:33
…-model # Conflicts: # CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A key without access to the tenant package's
default_model(gpt-5.6-terra) passes every start-up check. The first time anyone finds out is when a Bot runs and the person who sent the message sees:We hit this deploying on EKS: the OpenAI key was a project key whose project didn't allow that model.
Fix
At start-up the server reads the provider's single-model endpoint once, with the same key
resolveModelApiKeywould give a Bot (the stored credential, elseOPENAI_API_KEY/ANTHROPIC_API_KEY):model-unavailable: model + fix (key access, ordefault_modelinmodel.yaml)model-credential-rejectedmodel-check-unreadableWhat it deliberately leaves alone:
OPENAI_BASE_URL/ANTHROPIC_BASE_URL. OpenAI-compatible servers often have no single-model lookup, so a 404 there would mean nothing.It never logs the key and never delays start-up (5 s timeout, fire-and-forget).
Tests
model-availability-check.test.ts, 11 tests:tscand biome are clean.Not run against the live API from this branch. I couldn't reach the stored key when I tried. The 404-for-no-access behaviour matches what we saw from OpenAI with that key (the model was absent from
/v1/models, and calls to it returned the "does not exist or you do not have access" error), but a reviewer with an OpenAI key could confirm it with onecurl /v1/models/<id>.