mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-10 14:27:00 -04:00
2f2950a626
Some checks failed
CI / workflow-validation (push) Failing after 0s
CI / commitlint (push) Failing after 1s
CI / changes (push) Failing after 7s
Dev Containers / validate (.devcontainer/devcontainer.json, default) (push) Failing after 4s
Dev Containers / validate (.devcontainer/memory-stack/devcontainer.json, memory-stack) (push) Failing after 3s
Init Native E2E / init-native (ubuntu-latest, claude) (push) Failing after 4s
OpenCode Plugin / typecheck + build + test (push) Failing after 9s
Dev Containers / validate-worktree (push) Failing after 3s
Init E2E / docker-init-e2e (push) Failing after 3s
Init Native E2E / init-native (ubuntu-latest, codex) (push) Failing after 4s
Init Native E2E / init-native (ubuntu-latest, copilot) (push) Failing after 3s
Install Native E2E / install-native (ubuntu-latest) (push) Failing after 3s
Merge Conflicts / merge-conflicts (push) Failing after 3s
Release Please / release-please (push) Failing after 7s
rust / rust-changes (push) Failing after 7s
Wrap E2E / docker-wrap-e2e (push) Failing after 2s
Wrap Native E2E / wrap-native (ubuntu-latest) (push) Failing after 2s
Security / Dependency audit (pip-audit) (push) Failing after 3s
Security / CodeQL (javascript-typescript) (push) Failing after 2s
Security / CodeQL (python) (push) Failing after 2s
Security / Secret scan (gitleaks) (push) Failing after 2s
CI / lint (push) Failing after 0s
CI / build-wheel (push) Failing after 0s
CI / prefetch-model (push) Failing after 0s
CI / build (push) Failing after 0s
rust / simulator e2e (ubuntu-latest) (push) Failing after 0s
rust / wheels (x86_64-unknown-linux-gnu) (push) Failing after 0s
rust / audit (push) Failing after 0s
rust / parity (push) Failing after 0s
CI / docker-native-e2e (push) Failing after 0s
rust / test (ubuntu) (push) Failing after 0s
CI / test-extras (push) Failing after 0s
CI / test-agno (push) Failing after 0s
CI / test-dashboard-ui (push) Failing after 0s
CI / test (1) (push) Failing after 0s
CI / test (2) (push) Failing after 0s
CI / test (3) (push) Failing after 0s
CI / test (4) (push) Failing after 0s
CI / windows-native-wrapper (push) Has been cancelled
CI / macos-native-wrapper (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime name:]) (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime-code name:code]) (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime-code-nonroot name:code-nonroot]) (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime-code-slim name:code-slim]) (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime-code-slim-nonroot name:code-slim-nonroot]) (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime-nonroot name:nonroot]) (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime-slim name:slim]) (push) Has been cancelled
Docker / docker-build (map[name:amd64 platform:linux/amd64 runs_on:ubuntu-24.04], map[bake_target:runtime-slim-nonroot name:slim-nonroot]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime name:]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime-code name:code]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime-code-nonroot name:code-nonroot]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime-code-slim name:code-slim]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime-code-slim-nonroot name:code-slim-nonroot]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime-nonroot name:nonroot]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime-slim name:slim]) (push) Has been cancelled
Docker / docker-build (map[name:arm64 platform:linux/arm64 runs_on:ubuntu-24.04-arm], map[bake_target:runtime-slim-nonroot name:slim-nonroot]) (push) Has been cancelled
Init Native E2E / init-native (macos-latest, claude) (push) Has been cancelled
Init Native E2E / init-native (macos-latest, codex) (push) Has been cancelled
Init Native E2E / init-native (macos-latest, copilot) (push) Has been cancelled
rust / simulator e2e (macos-latest) (push) Has been cancelled
Install Native E2E / install-native (macos-latest) (push) Has been cancelled
Wrap Native E2E / wrap-native (macos-latest) (push) Has been cancelled
CI / build-wheel-windows (push) Has been cancelled
rust / simulator e2e (windows-latest) (push) Has been cancelled
rust / wheels (aarch64-apple-darwin) (push) Has been cancelled
rust / wheels (x86_64-apple-darwin) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime name:]) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime-code name:code]) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime-code-nonroot name:code-nonroot]) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime-code-slim name:code-slim]) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime-code-slim-nonroot name:code-slim-nonroot]) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime-nonroot name:nonroot]) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime-slim name:slim]) (push) Has been cancelled
Docker / docker-manifest (map[bake_target:runtime-slim-nonroot name:slim-nonroot]) (push) Has been cancelled
Docker / promote-latest (push) Has been cancelled
Split out of #2852 at review request: that PR is bounded upstream calls plus measured hot-path costs, and this is an authentication/routing change that belongs on its own scope. #2852 now carries only the timeout work. ## The bug A routing extension can rewrite the model across families mid-request (`claude-opus-5` → `gpt-5-mini`). The caller's key does not travel with that rewrite, so the proxy forwards `sk-ant-...` to OpenAI and earns a guaranteed 401. Downstream that is indistinguishable from *"the cheap model failed the task"* — it scores as a quality regression against the router, not as a bug. Dropping the `api_key` kwarg instead lets litellm fall back to the target provider's own env credential, which is the only key that can work. ## Why this cut is different from the one that was rejected The first version returned `not provider.startswith("anthropic")`, so **any** non-`sk-ant-` credential was dropped against an Anthropic-class target — a plain Bearer token against an Anthropic-compatible or custom gateway lost its key and fell back to an env credential that may not exist. That direction is the dangerous one. A false refusal breaks a deployment that was working; a missed refusal just leaves today's 401. So this refuses on **positive evidence only**: | credential | target | forwarded? | |---|---|---| | `sk-ant-…` | `openai` / `azure` / `gemini` | **no** — cannot possibly authenticate | | `sk-ant-…` | anthropic | yes | | `sk-ant-…` | unrecognised / unclassifiable model | yes — pass-through | | anything else | anything | yes — pass-through, unchanged | `sk-ant-` is Anthropic's documented vendor-specific prefix, which is what makes it classifiable. `sk-` is not: a dozen vendors mint that shape. Everything the string cannot settle keeps main's behaviour. The reject list is explicit rather than inverted (`not anthropic`) because an unrecognised provider is usually a compatible or self-hosted gateway. Marked in the code as a hand-kept tuple with the registry-lookup upgrade path noted. Bedrock / Vertex / SageMaker are unaffected — all four dispatch sites already skip credential forwarding for them entirely (env-based auth). ## Verification `tests/test_litellm_caller_key.py`, 12 cases — the refusal, the Anthropic target, the unknown provider, `get_llm_provider` raising, and each unclassifiable credential shape asserted against **both** target families. Those last ones fail against the rejected version. Applied at all four dispatch sites (Anthropic non-stream/stream, OpenAI non-stream/stream). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| audit | ||
| backends | ||
| cache | ||
| capture | ||
| ccr | ||
| cli | ||
| compression | ||
| dashboard | ||
| evals | ||
| graph | ||
| image | ||
| install | ||
| integrations | ||
| learn | ||
| mcp_registry | ||
| memory | ||
| models | ||
| observability | ||
| perf | ||
| pricing | ||
| providers | ||
| proxy | ||
| relevance | ||
| reporting | ||
| storage | ||
| subscription | ||
| telemetry | ||
| testing | ||
| tokenizers | ||
| transforms | ||
| __init__.py | ||
| _ort.py | ||
| _subprocess.py | ||
| _version.py | ||
| agent_savings.py | ||
| binaries.py | ||
| cli.py | ||
| client.py | ||
| compress.py | ||
| config.py | ||
| context_tool_cleanup.py | ||
| copilot_auth.py | ||
| copilot_linux_secret.py | ||
| copilot_macos_keychain.py | ||
| exceptions.py | ||
| fsutil.py | ||
| hooks.py | ||
| offline.py | ||
| onnx_runtime.py | ||
| parser.py | ||
| paths.py | ||
| pipeline.py | ||
| py.typed | ||
| release_version.py | ||
| savings_ledger.py | ||
| settings_store.py | ||
| shared_context.py | ||
| tokenizer.py | ||
| tools.json | ||
| update_check.py | ||
| utils.py | ||