fix(eyrie): stop falling back to OPENAI base URL for other providers#69
Merged
Conversation
…cumented Also fixed a stale ID: the Z.AI row listed z-ai, which doesn't exist in the registry (the real IDs are zai_coding and zai_payg, two separate providers). Rewrote the full table from catalog/registry/providers.go directly — deepseek, the zai/minimax split, azure, bedrock, vertex, poolside, groq, and clinepass were all missing.
A stray OPENAI_BASE_URL / OPENAI_API_BASE in the host environment would send a non-OpenAI provider's API key to whatever host that var points at, because 17 providers and 16 runtime profiles ended their BaseURLEnv lookup chain on the OpenAI vars. Trim OPENAI_BASE_URL and OPENAI_API_BASE out of every non-OpenAI provider's BaseURLEnv slice in catalog/registry/providers.go and every non-OpenAI runtime profile in config/profiles.go. A provider's base URL must come only from its own env vars. Added a regression test asserting anthropic no longer resolves through the OpenAI vars.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes OPENAI_BASE_URL / OPENAI_API_BASE from the BaseURLEnv fallback chain of every non-OpenAI provider. A stray OPENAI env var was redirecting other providers credentialed API key traffic to whatever host it pointed at. Found and fixed two independent copies of the bug: catalog/registry/providers.go (~17 providers) and config/profiles.go (~16 runtime profiles).
Why
Credential hijack vector from a whitelisted-but-mismatched env var. Audit finding.
Verification