feat(core): vendor-neutral model-gateway config (ELIZA_MODEL_GATEWAY_URL/TOKEN) with fail-closed strict mode (#11536 E1) - #11660
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…URL/TOKEN) with fail-closed strict mode (#11536 E1) Add a vendor-neutral credential-broker gateway layer so a single OpenAI-compatible gateway can front all model traffic without raw provider keys ever reaching the model client. - New packages/core/src/model-gateway.ts: resolveModelGateway() / applyModelGateway(). ELIZA_MODEL_GATEWAY_URL takes precedence as the effective base URL and ELIZA_MODEL_GATEWAY_TOKEN as the effective api key at the same resolution layer that consumes OPENAI_BASE_URL / OPENAI_API_KEY, so every OpenAI-compatible client inherits gateway mode. Vendor-neutral: the gateway only needs to be OpenAI-compatible. - Scrubber: when gateway mode is on, the raw provider key is dropped from the resolved OpenAI-compatible config so it never travels with the gateway request. - Fail-closed strict mode (ELIZA_MODEL_GATEWAY_STRICT=1): if a raw provider key is present while gateway mode is on, throw ModelGatewayStrictError naming the offending var. Non-strict: gateway silently wins. - Wire choke points: features/documents/config.ts (feeds llm.ts embed + text createOpenAI baseURL/apiKey) and testing/inference-provider.ts openai endpoint detection. - Export from both node + browser barrels (pure string logic, no Node deps). - Tests next to the module: URL/token precedence, strict fail-closed names the offending var, resolved config carries no raw key material when gateway mode on, canonical env-var-name contract. Sibling layer: PR #11651 (E2, merged) covers the spawned sub-agent env path in plugins/plugin-agent-orchestrator. It defines the canonical env-var-name contract (ELIZA_MODEL_GATEWAY_URL / _TOKEN). This module mirrors those constant names (MODEL_GATEWAY_URL_KEY / _TOKEN_KEY) for cross-layer greppability but DUPLICATES rather than imports them, since packages/core must not depend on a plugin. Core runtime only; does not touch packages/cloud. Co-authored-by: wakesync <shadow@shad0w.xyz>
864ea9d to
2c18fa4
Compare
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
lalalune
left a comment
lalalune
left a comment
There was a problem hiding this comment.
Reviewed #11660 against #11536 E1 and the merged sibling lanes (#11528 cloud hosted-agent wiring, #11651 spawned sub-agent gateway env).
Verdict: approve. This is correctly scoped to the core OpenAI-compatible model-client config layer: gateway URL/token take precedence at the same documents config resolution point as OPENAI_BASE_URL/OPENAI_API_KEY, raw OpenAI key material is scrubbed before the createOpenAI call sites receive config, and strict mode fails closed when raw provider keys coexist with gateway mode. The duplicated canonical env-var names are intentional because packages/core must not depend on the orchestrator plugin.
Change I added: sorted the new model-gateway barrel export in index.browser.ts and index.node.ts so Biome passes.
Local verification on da275c6802:
bun run --cwd packages/core test -- src/model-gateway.test.ts src/__tests__/inference-timing.test.ts src/testing/live-provider.test.ts-> 3 files / 37 tests passedPATH="$PWD/node_modules/.bin:$PATH" bun run --cwd packages/core typecheck-> passedbunx @biomejs/biome check packages/core/src/model-gateway.ts packages/core/src/model-gateway.test.ts packages/core/src/features/documents/config.ts packages/core/src/testing/inference-provider.ts packages/core/src/index.browser.ts packages/core/src/index.node.ts-> passedgit diff --check origin/develop...HEADandgit diff --check-> passed
#11536 remains open for later phases; this only resolves E1.
3 participants
What
Implements phase E1 of #11536: a vendor-neutral model-gateway config layer so a single OpenAI-compatible gateway (credential broker) can front all model traffic, and raw provider keys never reach the model client.
Sibling layer (E2)
PR #11651 (merged) landed the E2 slice under
plugins/plugin-agent-orchestrator/src/services/model-gateway.ts— the spawned sub-agent env path (rewrites a child process env so Codex/Claude-Code point at the gateway). This PR is the complementary core-runtime resolution layer (documents config →llm.ts, inference-provider) — the paths #11651 leaves untouched.The two layers share the canonical env-var-name contract (
ELIZA_MODEL_GATEWAY_URL/ELIZA_MODEL_GATEWAY_TOKEN). This module mirrors #11651's exported constant names (MODEL_GATEWAY_URL_KEY/MODEL_GATEWAY_TOKEN_KEY) for cross-layer greppability but duplicates rather than imports them —packages/coremust not depend on a plugin (dependency direction). A test pins the shared strings so the contract can't drift.How
New
packages/core/src/model-gateway.ts:ELIZA_MODEL_GATEWAY_URLtakes precedence as the effective base URL andELIZA_MODEL_GATEWAY_TOKENas the effective api key at the exact resolution point that consumesOPENAI_BASE_URL/OPENAI_API_KEY. Every OpenAI-compatible client inherits gateway mode automatically. Vendor-neutral: the gateway only has to be OpenAI-compatible.ELIZA_MODEL_GATEWAY_STRICT=1+ a raw provider key present while gateway mode is on → hard error (ModelGatewayStrictError) naming the offending variable. Non-strict: gateway silently wins.Choke points wired
packages/core/src/features/documents/config.ts— applies gateway resolution to the resolvedModelConfig(OPENAI_BASE_URL/OPENAI_API_KEY), which feeds bothcreateOpenAIcall sites inllm.ts(text generation + embeddings). Strict-mode throw propagates through the existing error handling.packages/core/src/testing/inference-provider.ts— openai provider endpoint detection uses the gateway URL when gateway mode is on (defensive: a strict-mode misconfig does not crash detection; authoritative enforcement lives in the runtime config layer).Tests
packages/core/src/model-gateway.test.ts(17 tests) next to the module per repo convention:OPENAI_BASE_URL/OPENAI_API_KEY, whitespace trimming, no-token case)Targeted suites green: 37 passing (model-gateway 17, inference-timing 12, live-provider 8), zero new failures. Pre-existing failures in
features/documents/*are an unrelated missing optional dep (mammoth) in the worktree, confirmed on the clean baseline. Biome clean on all touched files. Rebased on latestdevelop(includes #11651).Scope
Core runtime only. Does not touch
packages/cloud/**(PR #11528's lane),packages/app,packages/ui, binaries, or lockfiles.Part of #11536. Sibling: #11651.
[sol-forge] — [sol-orch]