Repository navigation
feat(run): BYOK runs with your own provider key (0.1.32) - #52
Merged
Merged
Conversation
nan run --byok-secret NAME --model ID runs the agent on a provider key
secret (inference {source: byok}) instead of NaN inference. The flag names
the secret, never the key: a value that looks like a key is refused
without being echoed, with a hint to revoke it. Ad-hoc BYOK runs use the
nan auth login session only; NAN_TOKEN, --token-file, a saved token or an
API key are refused before anything is sent (the platform answers 403
session_required to them). BYOK refusals (unknown secret, not a provider
key, model, not available, no workspace) say what to do.
runs show, runs ls and automations show render the inference choice;
automations show warns when a webhook feeds a BYOK automation; secrets ls
shows kind, provider and base URL. Goldens rendered by cloud-api's own
handlers (internal/api/testdata/phase3) and text goldens for the views.
Spec: devops AGENT-AUTOMATIONS-PHASE3-BYOK.md; cloud-api #347.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A --model that starts like a provider key is refused before anything is sent, without echoing it. The "did you mean" suggestion only for short names. Tests: long model ids, secrets ls without base URLs, the webhook note only for enabled webhooks, a corrupt session file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sre-helmcode
pushed a commit
that referenced
this pull request
Oct 20, 2026
Brings #50, #51, #52, #53, #54, #56 and #57 onto the new structure: - mimo-v2.6-flash, qwen3.8-flash at 1M, and the Codex model catalogue: the writer changes go to internal/tools, the catalogue and its embedded prompt to internal/tools/codexprompt. - BYOK runs, secrets and automation writes, and notifications: the commands go to internal/cli and hang off NewRootCmd; their goldens to internal/cli/testdata. - The --json contract test counts the commands with a --json of their own, not the one every command inherits from the root. - The embedded Codex prompt is Apache-2.0: its NOTICE and licence are now in THIRD-PARTY-NOTICES.txt. - Messages without em dashes, and the new code lint-clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
BYOK (bring your own key) in the CLI, for cloud-api #347 (0.8.260) and devops
AGENT-AUTOMATIONS-PHASE3-BYOK.md.nan run --byok-secret NAME --model IDsendsinference: {"source":"byok","secret":NAME,"model":ID}and no top-levelmodel(the platform 400s it with BYOK).nan auth loginsession only (spec §4.3).NAN_TOKEN/--token-fileare refused before anything is sent (exit 65) with the reason and the alternative (nan automations run); a saved platform token or API key is skipped for the session. A server403 session_requiredmaps to the same message.404 inference.secret(no such secret, not "workspace not found"),400 inference.secret(not a provider key),400 inference.model,400 inference(not available),tier_restricted(BYOK: needs an active workspace; NaN run: hints at--byok-secret).nan runs show/automations show:inferencerow (NaN, oryour key NAME (Provider): billed by your provider, not metered by NaN); BYOK token counts are labelled as agent-reported.nan runs ls: INFERENCE column.automations showwarns when an enabled webhook triggers a BYOK automation (untrusted input to an agent holding your key).nan secrets ls: KIND, PROVIDER, and a BASE URL column when any key has one.--modelthat starts like a provider key is refused without echoing it (BYOK runs).tier_restrictedonnan runnow also points at--byok-secret(a member without an inference plan but with a workspace can run on their own key).Why
--byok-secret NAME(and not--key/--inference byok:NAME)--keyinvites pasting the key itself into the shell history; the flag also refuses anything that is not a secret name without echoing it, and warns to revoke it when it looks like a key (sk-,AIza, ... or 32+ chars).--modelis discoverable in--helpand shell completion; abyok:NAMEmini-syntax is not, and there is only one non-default source.Tests
cmd/byok_test.go: request shape, flag mistakes (no model, lower-case name with suggestion, pasted key never echoed), credential rules (NAN_TOKEN, --token-file, saved token/key only, none, saved token + session -> session), every BYOK refusal with exit code and message, label helpers (sanitised), help text.cmd/testdata/byok/*.golden(runs show, runs ls, automations show, secrets ls;go test ./cmd -run BYOKGoldenViews -update).internal/api/testdata/phase3/*.jsonare rendered by cloud-api origin/main's own handlers (renderRun,renderAutomation, the secrets API) at 4c69270, not hand-written;TestGoldenBYOKdecodes them.go build ./... && go vet ./... && go test ./...green.Deploy notes
Merging the version bump publishes 0.1.32. Needs cloud-api 0.8.260 with
BYOK_ENABLED=truefor the member (otherwise the platform answers400 inference, shown as "not available for your account").🤖 Generated with Claude Code