feat: add API key mode for WorkBuddy international accounts - #6
Closed
leonid-dalin wants to merge 16 commits into
Closed
leonid-dalin wants to merge 16 commits into
leonid-dalin wants to merge 16 commits into
Conversation
The desktop-token path 401s for www.workbuddy.ai (Keycloak) accounts: the token does not match the backend and refresh fails with invalid_grant. Skip the desktop session entirely and call the international endpoint with a CK_* API key, which also enables headless deployment. In this mode /v1/models serves the international catalog and the desktop preflight is skipped. Closes #4 (international model list half; CN list unchanged)
Unit tests cover backend domain mapping, both model catalogs, credential loading and expiry, client authentication including the open-access mode, and the direct-key guard on the credential path. Endpoint tests exercise /health, /v1/models in both realms and the chat endpoint against a fake upstream: bearer header construction, system message handling, forced upstream streaming with non-stream aggregation, SSE passthrough and upstream connection errors. Run with: pytest
The README asked for a hand-typed pip install line, which drifts and misses test dependencies. Pin the runtime set in requirements.txt and the test set in requirements-dev.txt, and point the install and test instructions at them.
leonid-dalin
force-pushed
the
direct-key-mode
branch
from
September 13, 2026 03:23
69fd840 to
5457523
Compare
Author
|
maintaining this as a standalone fork; no longer seeking a merge |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
WorkBuddy international accounts (Keycloak realm on
www.workbuddy.ai) get 401s from the desktop-token path: the token does not match the backend the converter calls, and the refresh endpoint rejects it withinvalid_grant. The result is that international subscribers cannot use the converter at all.What this changes
New
--direct-keymode (also viaCODEBUDDY_DIRECT_KEY):CODEBUDDY_API_KEY) is sent as a plainAuthorization: Bearerheader tohttps://www.codebuddy.ai/v2/chat/completions./v1/modelsbecomes realm-aware: the desktop-token path keeps the existing China catalog unchanged; the key mode serves the international catalog.Model list (fixes the international half of #4)
All 16 ids below answered 200 on 2026-08-31 against the international endpoint:
auto,hy3,glm-5.3,glm-5.2,glm-5.1,glm-5v-turbo,minimax-m3,kimi-k3,kimi-k2.7,kimi-k2.6,deepseek-v4-pro,deepseek-v4-flash,gpt-5.6-luna,gpt-5.6-terra,gpt-5.6-sol,gemini-3.1-pro(
gpt-5.6-*andgemini-3.1-progo beyond #4's CLI list; they are part of the international subscription and work over this endpoint.)Upstream quirks documented in the README (EN + ZH)
stream: true(error 11101); the converter already streams upstream and aggregates.system(error 11128); the converter prepends one when missing.hy3works,Hy3does not.max_tokensvalues (error 11133); roughly 100 is a safe floor.Compatibility
Every new branch is gated behind
CONFIG["direct_key"]. Without the flag, credential loading, preflight, headers, and the model list behave exactly as before. Tested by starting the converter without the flag and comparing/healthand/v1/modelsoutput against upstream.Function calling (tool_calls), streaming and non-streaming aggregation were verified end to end through the proxy in key mode.
Closes #4 partially: the international model list; the maintainers may want to keep or replace the hardcoded China list separately (the issue's option two, parsing CLI --help, remains a good idea).
Docs updated in English and Chinese. No credentials are included in this PR.