@billjr99/pi-openai-compat 1.1.32 → 1.1.33

package/README.md

@@ -88,7 +88,12 @@ If pi is already running when you install, type `/reload` first.
 > 2. **Built-in fallback list** when no working catalog endpoint exists. Used
 >    when discovery fails or when the upstream simply has no `/models` at all
 >    (e.g. **Hugging Face** returns HTML, **Cloudflare AI Gateway** has no
->    catalog endpoint).
+>    catalog endpoint, **Unbiased AI** has no such route).
+>
+> A fallback list stands in for a missing endpoint, never for a rejected
+> credential: a catalog fetch that fails with 401 or 403 aborts the login
+> instead, so a mistyped key cannot be saved as a provider that looks healthy
+> in `/model` and then fails on every completion.
 >
 > | Provider | Default `/models` symptom | Handling |
 > |---|---|---|
@@ -96,6 +101,7 @@ If pi is already running when you install, type `/reload` first.
 > | **Cloudflare Workers AI** | HTTP 405 (no `GET /v1/models`; real catalog at `/ai/models/search`, id field is `name`, mixed task types) | Live discovery — `modelsUrl: …/ai/models/search`, `modelsIdField: name`, `modelsKeepTask: "Text Generation"` |
 > | **Cloudflare AI Gateway** | HTTP 401 (token missing `AI Gateway: Run`) or HTTP 400 *"Please configure AI Gateway"* (gateway slug doesn't exist, or the upstream isn't configured on it) | Built-in fallback list |
 > | **Hugging Face** | Returns HTML rather than JSON | Built-in fallback list |
+> | **Unbiased AI** | HTTP 404 `unknown_url` with a valid key (no `/v1/models` at all; an *invalid* key returns 401 on every path, including ones that do not exist, so a 401 here proves nothing) | Built-in fallback list |
 >
 > **Auto-heal for older configs:** if you logged in before live discovery
 > existed, your saved provider is missing these `modelsUrl`/`modelsIdField`/

package/add-provider.sh

@@ -465,6 +465,17 @@ fi
 MODEL_COUNT=0
 [ -n "$MODELS_JSON" ] && MODEL_COUNT="$(printf '%s' "$MODELS_JSON" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(String(JSON.parse(s).length)))')"
 
+# Mirrors isAuthFailure() in index.ts: a fallback list stands in for an endpoint
+# that is not there, never for a credential that was refused. Falling back on a
+# 401/403 would write a provider that looks healthy in /model and fails on every
+# completion, which is worse than saying the key was rejected.
+if [ "$MODEL_COUNT" = "0" ] && { [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ]; }; then
+  echo "  The provider rejected the API key (HTTP $HTTP_CODE)."
+  echo "  Not using the built-in model list: that would save a provider whose"
+  echo "  every request fails. Re-run with a valid key."
+  exit 1
+fi
+
 if [ "$MODEL_COUNT" = "0" ]; then
   if [ -n "$FALLBACK_MODELS" ]; then
     echo "  Using this template's built-in model list instead."

package/index.ts

@@ -413,9 +413,21 @@ export const TEMPLATES: Record<string, {
     // answers both /v1/chat/completions and Anthropic's /v1/messages and takes
     // either Authorization: Bearer or x-api-key; pi is registered with the
     // OpenAI pair, which is what registerProvider and fetchModels already send.
-    // GET /v1/models is registered and key-gated (a well-formed sk_ key gets
-    // "Invalid API key" rather than a format complaint), so no modelsUrl or
-    // fallbackModels override is needed.
+    //
+    // GET /v1/models does NOT exist: with a valid key it returns 404
+    // "unknown_url". An earlier note here claimed the endpoint was registered
+    // and key-gated, reasoning from a well-formed but invalid key getting
+    // "Invalid API key" rather than a 404. That inference was wrong. The
+    // gateway authenticates before it routes, so a path that certainly does
+    // not exist returns the same 401: GET /v1/definitely-not-a-real-endpoint
+    // answers "Invalid API key" with a bad key and "Missing API key" without
+    // one, exactly as /v1/models does. A 401 here says nothing about routing.
+    //
+    // Discovery therefore finds nothing, which is what fallbackModels is for.
+    // It is safe here because the catch that consumes it now refuses to fall
+    // back on a 401/403 (see isAuthFailure), so a mistyped key still fails the
+    // login instead of being saved as a provider that fails every completion.
+    fallbackModels: ["pareto"],
     keyHint: "platform.unbiased.ai (signup is reviewed by hand; keys look like sk_...)",
   },
   kilo: {
@@ -656,6 +668,24 @@ export function isLocalUrl(url: string): boolean {
 /** Cap on how much of an upstream error body is surfaced to the user. */
 export const MAX_ERROR_BODY = 500;
 
+/** An Error from fetchModels carrying the upstream HTTP status, when it had one. */
+export type CatalogError = Error & { status?: number };
+
+/**
+ * True when a catalog fetch failed because the credential was rejected.
+ *
+ * This is the distinction that makes fallbackModels safe to use. A fallback
+ * list exists for endpoints that publish no catalog, so it should stand in for
+ * a missing endpoint and never for a bad key: falling back on a 401 would save
+ * a provider that looks healthy in /model and fails on every completion, which
+ * is worse than refusing the login. A network error (no status) is treated as
+ * non-auth, so an offline or unreachable host still gets the fallback.
+ */
+export function isAuthFailure(err: unknown): boolean {
+  const status = (err as CatalogError | null)?.status;
+  return status === 401 || status === 403;
+}
+
 /** Optional per-provider overrides controlling how /models is fetched. */
 interface FetchOverrides {
   /** Full URL to fetch instead of `<baseUrl>/models`. */
@@ -692,7 +722,12 @@ export async function fetchModels(
     const snippet = body.length > MAX_ERROR_BODY
       ? `${body.slice(0, MAX_ERROR_BODY)}… (truncated)`
       : body;
-    throw new Error(`HTTP ${resp.status} from ${url}: ${snippet}`);
+    // Carry the status on the error. Callers need to tell "this endpoint is
+    // not there" from "your key is wrong", and parsing it back out of the
+    // message would break the moment the wording changes.
+    const err = new Error(`HTTP ${resp.status} from ${url}: ${snippet}`) as CatalogError;
+    err.status = resp.status;
+    throw err;
   }
 
   // Normalize the various shapes /models can return:
@@ -1032,7 +1067,7 @@ export default async function (pi: ExtensionAPI) {
           keepTask: tpl.modelsKeepTask,
         });
       } catch (err) {
-        if (tpl.fallbackModels && tpl.fallbackModels.length > 0) {
+        if (tpl.fallbackModels && tpl.fallbackModels.length > 0 && !isAuthFailure(err)) {
           ctx.ui.notify(
             `Could not fetch model list from ${tpl.displayName} (${err}).\nUsing built-in model list instead.`,
             "warning"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@billjr99/pi-openai-compat",
-  "version": "1.1.32",
+  "version": "1.1.33",
   "description": "pi-coding-agent extension: OpenAI-compatible endpoint support (OpenRouter, NVIDIA NIM, Nous Portal, Ollama, custom)",
   "author": "Bill Mongan <https://github.com/BillJr99>",
   "license": "MIT",