ZacharyZhang-NY/Kigi-CLI
1
0
Fork 0
Code Issues Pull Requests Actions 13 Packages Projects Releases Wiki Activity

Add OpenRouter platform: wire-served metadata (provider 8)

Browse Source 
The 11th registry row and the first THIRD-PARTY wire_serves_metadata=true
provider: id "openrouter", OPENROUTER_API_KEY > auth.json "openrouter"
scope, https://openrouter.ai/api/v1 (note /api/v1) with
KIGI_OPENROUTER_BASE_URL override, Bearer, OpenAI listing +
ChatCompletions + Passthrough.

OpenRouter's public /models serves context_length for every model
(verified live: 340/340), so it needs NO enrichment: models_dev_id=None,
wire_serves_metadata=true, restrict_to_enriched=false. An OpenRouter-only
user makes zero models.dev calls; context comes straight from the listing.
Slashed ids (anthropic/claude-opus-4.8) round-trip through the managed key
via the first-slash split; the native id rides the wire. The e2e pins all
of this with the models.dev refresh disabled.

Review-confirmed defect fixed (and independently re-verified with live
curls): OpenRouter's /models is PUBLIC — GET /models returns 200 for ANY
key — so login key-validation would false-accept a bad key, deferring the
failure to the first chat 401. New spec field key_validation_path lets a
public-listing platform validate against an auth-requiring endpoint;
OpenRouter uses /key (401s for bad keys). Reusable for Vercel (also
public). Tests pin the /key validation and no regression to the default
/models path.

Gate caught a fixture regression: the kimi_import test used openrouter.ai
to represent a CUSTOM provider, which now correctly dedupes to the builtin
OpenRouter — moved the fixture to a reserved llm.example.test host that no
future platform can shadow.
This commit is contained in:
ZacharyZhang-NY
2026-07-21 12:41:14 -04:00
parent 7a2cd8a726
commit e7dbb98207
5 changed files with 257 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/codegen/kigi-shell/src/agent/auth_method.rs
+72 -5
View File
@@ -394,7 +394,11 @@ pub(crate) async fn authenticate_platform_api_key(
let Some(key) = key else {
return Err(auth_err(missing_platform_key_error(platform)));
};
let url = format!("{}/models", platform.base_url().trim_end_matches('/'));
let url = format!(
"{}{}",
platform.base_url().trim_end_matches('/'),
platform.key_validation_path()
);
let request = match platform.key_header() {
kigi_models::PlatformKeyHeader::Bearer => crate::http::shared_client()
.get(&url)
@@ -598,7 +602,8 @@ mod tests {
"groq",
"mistral",
"fireworks",
"google"
"google",
"openrouter"
]
);
assert_eq!(default_id(&built), Some(XAI_API_KEY_METHOD_ID));
@@ -631,7 +636,8 @@ mod tests {
"groq",
"mistral",
"fireworks",
"google"
"google",
"openrouter"
]
);
assert_eq!(default_id(&built), Some(CACHED_TOKEN_AUTH_METHOD_ID));
@@ -657,7 +663,8 @@ mod tests {
"groq",
"mistral",
"fireworks",
"google"
"google",
"openrouter"
]
);
assert_eq!(default_id(&built), Some(CACHED_TOKEN_AUTH_METHOD_ID));
@@ -686,7 +693,8 @@ mod tests {
"groq",
"mistral",
"fireworks",
"google"
"google",
"openrouter"
]
);
assert_eq!(default_id(&built), None);
@@ -816,4 +824,63 @@ mod tests {
"the key must never leak into errors"
);
}
/// OpenRouter's `/models` is PUBLIC (200 for any key), so validation must
/// hit its auth-requiring `/key` endpoint instead — otherwise a bad key
/// false-accepts at login. The mock serves `/models` 200 always; a bad
/// key must still be rejected (proving `/models` is NOT what's validated).
#[tokio::test]
#[serial]
async fn openrouter_validates_against_key_endpoint_not_public_models() {
use wiremock::matchers::{method, path};
let server = wiremock::MockServer::start().await;
// Public listing: 200 for anyone. If validation used this, a bad key
// would pass.
wiremock::Mock::given(method("GET"))
.and(path("/models"))
.respond_with(
wiremock::ResponseTemplate::new(200)
.set_body_json(serde_json::json!({ "data": [] })),
)
.mount(&server)
.await;
// Auth-required key endpoint: 401 for a bad key.
wiremock::Mock::given(method("GET"))
.and(path("/key"))
.respond_with(wiremock::ResponseTemplate::new(401))
.expect(1)
.mount(&server)
.await;
let _base = EnvGuard::set(kigi_models::OPENROUTER_BASE_URL_ENV, &server.uri());
let err =
authenticate_platform_api_key(kigi_models::PlatformId::OpenRouter, Some("sk-or-bad"))
.await
.expect_err("a bad key must be rejected via /key, not accepted via /models");
assert_eq!(
err.message,
"Invalid API key for openrouter \u{2014} check your key on openrouter.ai"
);
}
/// A valid OpenRouter key: `/key` returns 200 → accepted.
#[tokio::test]
#[serial]
async fn openrouter_valid_key_succeeds_via_key_endpoint() {
use wiremock::matchers::{header, method, path};
let server = wiremock::MockServer::start().await;
wiremock::Mock::given(method("GET"))
.and(path("/key"))
.and(header("Authorization", "Bearer sk-or-good"))
.respond_with(
wiremock::ResponseTemplate::new(200)
.set_body_json(serde_json::json!({ "data": { "label": "k" } })),
)
.expect(1)
.mount(&server)
.await;
let _base = EnvGuard::set(kigi_models::OPENROUTER_BASE_URL_ENV, &server.uri());
authenticate_platform_api_key(kigi_models::PlatformId::OpenRouter, Some("sk-or-good"))
.await
.expect("200 from /key must validate the key");
}
}
crates/codegen/kigi-shell/src/agent/models_fetch.rs
+92
View File
@@ -1505,6 +1505,98 @@ mod tests {
);
}
/// OpenRouter-cycle e2e: wire_serves_metadata=true — the listing itself
/// carries `context_length`, so context comes from the WIRE with NO
/// enrichment fetch and NO restriction (all models kept). The models.dev
/// refresh is disabled to prove it is never consulted. Slashed ids
/// round-trip; Passthrough dialect.
#[tokio::test(flavor = "multi_thread")]
#[serial_test::serial]
async fn openrouter_wire_metadata_needs_no_enrichment_and_keeps_all() {
let platform_server = wiremock::MockServer::start().await;
wiremock::Mock::given(wiremock::matchers::method("GET"))
.and(wiremock::matchers::path("/models"))
.and(wiremock::matchers::header("Authorization", "Bearer or-1"))
.respond_with(wiremock::ResponseTemplate::new(200).set_body_json(
serde_json::json!({ "data": [
{ "id": "anthropic/claude-opus-4.8", "context_length": 1000000,
"supported_parameters": ["reasoning_effort", "tools"] },
{ "id": "openai/gpt-5.5", "context_length": 400000,
"supported_parameters": ["tools"] }
]}),
))
.expect(1)
.mount(&platform_server)
.await;
let cache_dir = tempfile::tempdir().unwrap();
let _base = kigi_test_support::EnvGuard::set(
kigi_models::OPENROUTER_BASE_URL_ENV,
platform_server.uri(),
);
// Kill switch: proves enrichment is never fetched for a wire-served
// platform (any attempt would need this URL).
let _mdev = kigi_test_support::EnvGuard::set(
crate::agent::enrichment_fetch::MODELS_DEV_URL_ENV,
"0",
);
let _mdev_cache = kigi_test_support::EnvGuard::set(
crate::agent::enrichment_fetch::MODELS_DEV_CACHE_DIR_ENV,
cache_dir.path(),
);
let endpoints = crate::agent::config::EndpointsConfig::default();
let keys = crate::agent::models::PlatformApiKeys::test_single(
kigi_models::PlatformId::OpenRouter,
"or-1",
);
let result = tokio::task::spawn_blocking(move || {
fetch_platform_models_blocking(&endpoints, None, &keys)
})
.await
.unwrap()
.expect("fetch must succeed");
assert_eq!(
result
.models
.iter()
.map(|m| m.id.as_deref().unwrap_or_default())
.collect::<Vec<_>>(),
vec![
"openrouter/anthropic/claude-opus-4.8",
"openrouter/openai/gpt-5.5"
],
"no restriction — all listed models kept; slashed ids in the key"
);
let opus = &result.models[0];
assert_eq!(
opus.context_window.get(),
1_000_000,
"context window comes from the wire listing, not enrichment"
);
assert_eq!(
opus.model, "anthropic/claude-opus-4.8",
"the native slashed id rides the wire"
);
assert_eq!(
kigi_models::parse_managed_model_key(opus.id.as_deref().unwrap()),
Some((
kigi_models::PlatformId::OpenRouter,
"anthropic/claude-opus-4.8"
))
);
let model_entry = crate::agent::config::ModelEntry::from_config_entry(opus);
let creds = crate::agent::config::ResolvedCredentials {
api_key: Some("or-1".into()),
base_url: opus.base_url.clone(),
auth_type: kigi_chat_state::AuthType::ApiKey,
auth_scheme: Default::default(),
};
let cfg = crate::agent::config::sampling_config_for_model(&model_entry, creds, None);
assert_eq!(
cfg.chat_compat,
kigi_sampling_types::ChatCompat::Passthrough
);
}
#[test]
fn get_env_keys_parses_strings_and_rejects_non_strings() {
use crate::agent::config::EnvKeys;
crates/codegen/kigi-shell/src/kimi_import.rs
+5 -5
View File
@@ -611,7 +611,7 @@ model = "kimi-for-coding"
max_context_size = 262144
[models.my-openai]
provider = "openrouter"
provider = "customllm"
model = "gpt-x"
max_context_size = 128000
@@ -620,9 +620,9 @@ type = "kimi"
base_url = "https://api.kimi.com/coding/v1"
api_key = "sk-kimi-secret"
[providers.openrouter]
[providers.customllm]
type = "openai_legacy"
base_url = "https://openrouter.ai/api/v1"
base_url = "https://llm.example.test/v1"
api_key = "sk-or-secret"
"#,
)
@@ -711,7 +711,7 @@ api_key = "sk-or-secret"
let m = &plan.custom_models[0];
assert_eq!(m.alias, "my-openai");
assert_eq!(m.model, "gpt-x");
assert_eq!(m.base_url, "https://openrouter.ai/api/v1");
assert_eq!(m.base_url, "https://llm.example.test/v1");
assert_eq!(m.api_key.as_deref(), Some("sk-or-secret"));
assert_eq!(m.context_window, Some(128_000));
@@ -850,7 +850,7 @@ api_key = "sk-ms"
assert_eq!(model["model"].as_str().unwrap(), "gpt-x");
assert_eq!(
model["base_url"].as_str().unwrap(),
"https://openrouter.ai/api/v1"
"https://llm.example.test/v1"
);
assert_eq!(model["api_key"].as_str().unwrap(), "sk-or-secret");
assert_eq!(model["context_window"].as_integer().unwrap(), 128_000);