Add PAIR_API_KEY shortcut for OpenGovSG PAIR provider - #1
Open
adriangohjw wants to merge 7 commits into
Open
Conversation
Expands a single PAIR_API_KEY env var into ANTHROPIC_AUTH_TOKEN + ANTHROPIC_BASE_URL=https://engine.pair.gov.sg/ at CLI startup. Runs before applyAiGatewayDefaults so PAIR routes Claude traffic while the gateway fallback handles the OpenAI side. Existing ANTHROPIC_* values still win. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a fork-clone path that pre-wires PAIR_API_KEY for the Claude Agent SDK, and updates the AI provider section to list PAIR alongside the existing AI Gateway shortcut. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Namespaces the env var so it doesn't collide with other tools or shell profiles that may already use PAIR_API_KEY. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Clone the monorepo without renaming to `.deepsec/` (avoids the confusing `.deepsec/.deepsec/` nesting from the self-scan workspace) - Separate the TypeScript config edit from the .env.local creation - Show the actual file edit explicitly instead of cramming it into a shell comment - Drop .env.local into `.deepsec/` (where the CLI reads it) rather than monorepo root Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds resolveModel() in agent-defaults.ts. When the PAIR env var is in play, every claude-family run is pinned to claude-opus-4-6-v1:rsn — the only model id PAIR serves today — and an explicit --model is ignored with a warning. Codex (different endpoint) is unaffected. Wired into process, revalidate, triage, sandbox-process, sandbox-all plus README + configuration.md updates noting that --model is no longer needed under PAIR. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The original comment read as if sonnet might be used for PAIR. It can't — the two branches are mutually exclusive on isPairActive(). Rewrites the comment to spell out which path each user lands on. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PAIR_API_KEYenv var expands at CLI startup intoANTHROPIC_AUTH_TOKEN+ANTHROPIC_BASE_URL=https://engine.pair.gov.sg/, mirroring howAI_GATEWAY_API_KEYworks today.applyAiGatewayDefaultsso when both keys are set, PAIR wins for Claude traffic and the gateway only fills in the OpenAI side. ExplicitANTHROPIC_*values still take precedence over both.docs/configuration.mdupdated to mention the new shortcut.Usage
Test plan
pnpm -r build— typecheck cleanpnpm test:unit— 2095 tests passing, including 6 new cases forapplyPairDefaults+ 1 updated assertion inassertAgentCredentialprocessrun against PAIR with the key setpnpm deepsec sandbox process) — not exercised; the firewall should deriveengine.pair.gov.sgfrom the populatedANTHROPIC_UPSTREAM_BASE_URL, but worth verifying before relying on it🤖 Generated with Claude Code