The second note split out of #59.
sandboxes/llm_local's mock rejects a request without Authorization: Bearer sk-mock-key, even though the backend is local and nothing is being paid for. Read out of app/mocks/openai.py.
The value is not hard to find once you know to look, but nothing in the sandbox's README says a key is needed at all — and since the whole point of a local mock is that it needs no credential, the natural first attempt omits the header and gets a 401. For a teaching sandbox aimed at people learning to red-team these systems, that is a wrong first impression of why the request failed.
Enforcing it is a reasonable choice: it keeps the sandbox honest about the auth path a real provider has. The fix is one line in sandboxes/llm_local/README.md naming the key, beside the base URL a user is already copying.
Happy to send that PR.
The second note split out of #59.
sandboxes/llm_local's mock rejects a request withoutAuthorization: Bearer sk-mock-key, even though the backend is local and nothing is being paid for. Read out ofapp/mocks/openai.py.The value is not hard to find once you know to look, but nothing in the sandbox's README says a key is needed at all — and since the whole point of a local mock is that it needs no credential, the natural first attempt omits the header and gets a 401. For a teaching sandbox aimed at people learning to red-team these systems, that is a wrong first impression of why the request failed.
Enforcing it is a reasonable choice: it keeps the sandbox honest about the auth path a real provider has. The fix is one line in
sandboxes/llm_local/README.mdnaming the key, beside the base URL a user is already copying.Happy to send that PR.