Repository navigation
Ask Thalamus routing for every vault API-key request - #15
Merged
Merged
Conversation
Adopt common-auth 0.47 opt-in routing refusals for API-key attempts on all hosts, preserving the plugin's usual OAuth subscription path. Refusals and missing answers stop paid requests; qualifying balance refusals report the selected vault identities. Carry OC1 host session ids through a private stripped header. Avoid consumer.send's internal paid-key 401 resend without routing admission. Add filtered unit and real-host no-send regressions; preserve xAI OAuth billing expectations. Pi real-host assertions include its existing SDK 400 JSON envelope around the fixed text.
Use consumer.send for routed core attempts, validating credential identity inside dispatch so a newer version of the same credential can retry a 401 without another routing call. Preserve the host-owned OpenCode2 send path and explain its cooldown bypass flag. Same-origin redirects belong to one admitted request, so replace the prior redirect re-selection test with one-key/one-routing-call coverage. Replace the no-rotation claim with regressions for same-credential version rotation on OC1 and Pi. DeepSeek balance reports always use http_402, including bodies with generic request error codes.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Replace the billing helper's module-level afterEach with per-test routing-accessor restoration, and restore only the original vault relay/host marker after nested installations. Restore direct accessor removals and Pi profile environment changes per test as well. Handle Pi contexts without sessionManager: API-key routing sees no session and stops without sending, while non-routed serving remains unchanged. Add a two-file Bun subprocess regression for cached helpers and a Pi missing-session regression. Authorized CI diagnosis: root bun test went from 482 pass/79 fail/83 skip to 562 pass/0 fail/83 skip; the full Pi CI command went from 38 pass/22 fail/2 skip to 61 pass/0 fail/2 skip under Bun 1.4.4 and Node 24.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When Thalamus started the host, every request that would use a vault API key first asks Thalamus routing which key to use, and sends only on routing's pick.
credential_refused.Moves to common-auth 0.47.0.
Summary by cubic
Makes every vault API-key attempt ask Thalamus routing which key to send, and sends only on routing's pick. A routing refusal, or no answer within 1.5 s (including an unreachable router), stops the request before anything is sent; both cases show a fixed message. Pi requests with no session id also stop with the no-answer message. Subscription (OAuth) rows are not routed yet and keep today's selection, and nothing changes outside Thalamus.
Routing
credential_refused; user-set spending caps are not.Adoption
@cortexkit/common-authis bumped to 0.47.0 across thecore,opencode, andpipackages.Written for commit c7fe6f6. Summary will update on new commits.