Skip to content

feat: manage provider custom headers via PATCH and ocx provider edit --headers #961

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Yuxin-Qiao wants to merge 2 commits into from
Closed

feat: manage provider custom headers via PATCH and ocx provider edit --headers #961

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2f2eb0f
feat: manage provider headers via PATCH and ocx provider edit --headers
Yuxin-Qiao Aug 3, 2026
2a295b4
fix(provider): address headers PATCH review threads
Yuxin-Qiao Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ description: プロバイダー構成、資格情報、クォータ、および
| --- | --- | --- |
| `list` | `--json` |構成されたプロバイダーと残りのレジストリ エントリを一覧表示します。 |
| `add <name>` | `--adapter <adapter>`、`--base-url <url>`、`--api-key <key>`、`--default-model <model>`、`--set-default`、`--force`、`--json`、`--sync` |レジストリ/カスタムプロバイダーを追加します。 `--force` は上書きします。 `--sync` は、実行中のプロキシを人間出力モードで更新します。 |
| `edit <name>` |プロバイダーフィールドフラグ、`--json` |キー プールを置き換えずに、検証済みのライブ プロバイダー フィールドを編集します。 |
| `edit <name>` |プロバイダーフィールドフラグ、`--headers <json>`、`--json` |キー プールを置き換えずに、検証済みのライブ プロバイダー フィールドを編集します。`--headers` はカスタム要求ヘッダーをマージします。`{}` または `-` を渡すとクリアします。 |
| `test <name>` | `--json` |実際の上流モデルのエンドポイントを調査します。 |
| `show <name>` | `--json` | API キーをマスクして設定を表示します。 |
| `remove <name>` | `--json` |デフォルト以外のプロバイダーを削除します。最後のプロバイダーは削除できません。 |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/ja/reference/management-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ Authorization: Bearer <admin-token>
| --- | --- | --- |
| `GET /api/providers` |編集されたプロバイダー設定と検出状態をリストする | — |
| `POST /api/providers` |検証済みプロバイダーを 1 つ追加または置換し、必要に応じてそれをデフォルトにします。 400 無効または危険な宛先または構成。 409 名前空間の衝突 |
| `PATCH /api/providers?name=...` |許可されたプロバイダー フィールド、有効/デフォルト状態、または OpenAI アカウント モードを更新します。 400 無効なフィールドまたは遷移。 404 不明なプロバイダ |
| `PATCH /api/providers?name=...` |許可されたプロバイダー フィールド（マージされる `headers` ブロックを含む）、有効/デフォルト状態、または OpenAI アカウント モードを更新します。 400 無効なフィールドまたは遷移。 404 不明なプロバイダ |

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Restore the missing Markdown table delimiter.

Line 169 lacks the | separator before 400. The error text joins the purpose cell, so the row has two cells instead of the required three.

-| `PATCH /api/providers?name=...` | 許可されたプロバイダー フィールド（マージされる `headers` ブロックを含む）、有効/デフォルト状態、または OpenAI アカウント モードを更新します。 400 無効なフィールドまたは遷移。 404 不明なプロバイダ |
+| `PATCH /api/providers?name=...` | 許可されたプロバイダー フィールド（マージされる `headers` ブロックを含む）、有効/デフォルト状態、または OpenAI アカウント モードを更新します。 | 400 無効なフィールドまたは遷移。 404 不明なプロバイダ |

As per path instructions, docs-site/** changes must preserve readable user-facing documentation.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
| `PATCH /api/providers?name=...` |許可されたプロバイダー フィールド（マージされる `headers` ブロックを含む）、有効/デフォルト状態、または OpenAI アカウント モードを更新します。 400 無効なフィールドまたは遷移。 404 不明なプロバイダ |
| `PATCH /api/providers?name=...` |許可されたプロバイダー フィールド（マージされる `headers` ブロックを含む）、有効/デフォルト状態、または OpenAI アカウント モードを更新します。 | 400 無効なフィールドまたは遷移。 404 不明なプロバイダ |
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)

[warning] 169-169: Table column count
Expected: 3; Actual: 2; Too few cells, row will be missing data

(MD056, table-column-count)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs-site/src/content/docs/ja/reference/management-api.md` at line 169,
Update the Markdown table row for PATCH /api/providers in the management API
reference by inserting the missing cell delimiter before the “400” response
description, restoring three properly separated cells while preserving the
existing Japanese documentation text.

Sources: Path instructions, Linters/SAST tools

| `DELETE /api/providers?name=...` |プロバイダーを削除し、可能な場合はデフォルトを再割り当てします。 404 不明なプロバイダー。 409 `last_provider`; 409 `provider_has_dependent_combos` |
| `POST /api/providers/test?name=...` |制限されたライブプロバイダー接続/モデル検出プローブを実行する | 404 不明なプロバイダー。障害は通常、`ok: false` の証拠として返されます。
| `GET /api/provider-quotas` |プロバイダー クォータ レポートを読む。 `refresh=1` 強制更新 | — |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ description: 제공자 설정, 자격 증명, 할당량, 모델 카탈로그 명
| --- | --- | --- |
| `list` | `--json` | 설정된 제공자와 남아 있는 레지스트리 항목을 나열합니다. |
| `add <name>` | `--adapter <adapter>`, `--base-url <url>`, `--api-key <key>`, `--default-model <model>`, `--set-default`, `--force`, `--json`, `--sync` | 레지스트리/사용자 지정 제공자를 추가합니다. `--force`는 덮어쓰고, `--sync`는 사람이 읽는 출력 모드에서 실행 중인 프록시를 새로 고칩니다. |
| `edit <name>` | 제공자 필드 플래그, `--json` | 키 풀을 바꾸지 않고 검증된 실시간 제공자 필드를 수정합니다. |
| `edit <name>` | 제공자 필드 플래그, `--headers <json>`, `--json` | 키 풀을 바꾸지 않고 검증된 실시간 제공자 필드를 수정합니다. `--headers`는 사용자 지정 요청 헤더를 병합하며, `{}` 또는 `-`로 지울 수 있습니다. |
| `test <name>` | `--json` | 실제 상위 모델 엔드포인트를 확인합니다. |
| `show <name>` | `--json` | API 키를 마스킹한 설정을 보여줍니다. |
| `remove <name>` | `--json` | 기본값이 아닌 제공자를 제거합니다. 마지막 제공자는 제거할 수 없습니다. |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/ko/reference/management-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ Authorization: Bearer <admin-token>
| --- | --- | --- |
| `GET /api/providers` | redacted된 provider 구성과 discovery 상태를 나열합니다 | — |
| `POST /api/providers` | 검증된 provider 하나를 추가하거나 교체하고, 선택적으로 기본 provider로 설정합니다 | 400 잘못되었거나 위험한 대상 또는 구성; 409 namespace 충돌 |
| `PATCH /api/providers?name=...` | 허용된 provider 필드, enabled/default 상태, 또는 OpenAI account mode를 업데이트합니다 | 400 잘못된 필드 또는 전환; 404 알 수 없는 provider |
| `PATCH /api/providers?name=...` | 허용된 provider 필드(병합되는 `headers` 블록 포함), enabled/default 상태, 또는 OpenAI account mode를 업데이트합니다 | 400 잘못된 필드 또는 전환; 404 알 수 없는 provider |
| `DELETE /api/providers?name=...` | provider를 삭제하고, 가능하면 기본 provider를 재지정합니다 | 404 알 수 없는 provider; 409 `last_provider`; 409 `provider_has_dependent_combos` |
| `POST /api/providers/test?name=...` | 제한된 live provider connectivity/model-discovery 탐색을 수행합니다 | 404 알 수 없는 provider; 실패는 보통 `ok: false` 증거로 반환됩니다 |
| `GET /api/provider-quotas` | provider quota 보고서를 읽습니다. `refresh=1`은 새로 고침을 강제합니다 | — |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/reference/cli/providers-accounts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ both `--adapter` and `--base-url`.
| --- | --- | --- |
| `list` | `--json` | List configured providers and the remaining registry entries. |
| `add <name>` | `--adapter <adapter>`, `--base-url <url>`, `--api-key <key>`, `--default-model <model>`, `--set-default`, `--force`, `--json`, `--sync` | Add a registry/custom provider. `--force` overwrites; `--sync` refreshes a running proxy in human-output mode. |
| `edit <name>` | provider field flags, `--json` | Edit validated live provider fields without replacing key pools. |
| `edit <name>` | provider field flags, `--headers <json>`, `--json` | Edit validated live provider fields without replacing key pools. `--headers` merges custom request headers; pass `{}` or `-` to clear them. |

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Document the header scope and authentication restriction.

The descriptions say that --headers merges custom request headers. They do not state that these headers apply only to custom/OpenAI-compatible upstream endpoints. They also do not state that sensitive authentication headers cannot be set or overridden.

  • docs-site/src/content/docs/reference/cli/providers-accounts.md#L19-L19: Add both restrictions to the English description.
  • docs-site/src/content/docs/ja/reference/cli/providers-accounts.md#L18-L18: Translate the same restrictions.
  • docs-site/src/content/docs/ko/reference/cli/providers-accounts.md#L18-L18: Translate the same restrictions.
  • docs-site/src/content/docs/ru/reference/cli/providers-accounts.md#L20-L20: Translate the same restrictions.

As per path instructions, custom-header documentation must distinguish custom upstream headers from forwarded credentials and must not imply that sensitive authentication headers are overridable.

📍 Affects 4 files
  • docs-site/src/content/docs/reference/cli/providers-accounts.md#L19-L19 (this comment)
  • docs-site/src/content/docs/ja/reference/cli/providers-accounts.md#L18-L18
  • docs-site/src/content/docs/ko/reference/cli/providers-accounts.md#L18-L18
  • docs-site/src/content/docs/ru/reference/cli/providers-accounts.md#L20-L20
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs-site/src/content/docs/reference/cli/providers-accounts.md` at line 19,
Update the `edit <name>` provider-field description to state that `--headers`
applies only to custom/OpenAI-compatible upstream endpoints and cannot set or
override sensitive authentication headers; retain the existing merge and clear
behavior. Apply the same restriction wording in English at
docs-site/src/content/docs/reference/cli/providers-accounts.md:19-19, and
translate it for
docs-site/src/content/docs/ja/reference/cli/providers-accounts.md:18-18,
docs-site/src/content/docs/ko/reference/cli/providers-accounts.md:18-18, and
docs-site/src/content/docs/ru/reference/cli/providers-accounts.md:20-20.

Source: Path instructions

| `test <name>` | `--json` | Probe the real upstream model endpoint. |
| `show <name>` | `--json` | Show config with API keys masked. |
| `remove <name>` | `--json` | Remove a non-default provider; the last provider cannot be removed. |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/reference/management-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ keys are not returned to dashboard clients.
| --- | --- | --- |
| `GET /api/providers` | List redacted provider configuration and discovery state | — |
| `POST /api/providers` | Add or replace one validated provider and optionally make it default | 400 invalid/dangerous destination or config; 409 namespace collision |
| `PATCH /api/providers?name=...` | Update allowed provider fields, enabled/default state, or OpenAI account mode | 400 invalid field or transition; 404 unknown provider |
| `PATCH /api/providers?name=...` | Update allowed provider fields (including a merged `headers` block), enabled/default state, or OpenAI account mode | 400 invalid field or transition; 404 unknown provider |

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Keep the provider headers contract complete in English and every locale.

The endpoint does more than merge headers. A non-empty object is shallow-merged; null or {} clears the block; sensitive authentication headers, invalid names, non-string values, and CRLF are rejected with HTTP 400. The documentation must also distinguish configurable custom adapter headers from forwarded caller credentials.

  • docs-site/src/content/docs/reference/management-api.md#L186-L186: update the English endpoint row with the complete clear, validation, and header-scope semantics.
  • docs-site/src/content/docs/ja/reference/management-api.md#L169-L169: translate the same semantics.
  • docs-site/src/content/docs/ko/reference/management-api.md#L169-L169: translate the same semantics.
  • docs-site/src/content/docs/ru/reference/management-api.md#L188-L188: translate the same semantics.
  • docs-site/src/content/docs/zh-cn/reference/management-api.md#L169-L169: translate the same semantics.
Suggested English row wording 
-| `PATCH /api/providers?name=...` | Update allowed provider fields (including a merged `headers` block), enabled/default state, or OpenAI account mode | 400 invalid field or transition; 404 unknown provider |
+| `PATCH /api/providers?name=...` | Update allowed provider fields. A non-empty `headers` object is shallow-merged; `null` or `{}` clears it. These are custom adapter headers, not forwarded caller credentials. | 400 invalid field, header name/value, or transition; 404 unknown provider |

As per path instructions, docs-site/** documentation must stay in sync with actual CLI/API behavior and translated locale pages must not contradict the English source.

📍 Affects 5 files
  • docs-site/src/content/docs/reference/management-api.md#L186-L186 (this comment)
  • docs-site/src/content/docs/ja/reference/management-api.md#L169-L169
  • docs-site/src/content/docs/ko/reference/management-api.md#L169-L169
  • docs-site/src/content/docs/ru/reference/management-api.md#L188-L188
  • docs-site/src/content/docs/zh-cn/reference/management-api.md#L169-L169
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs-site/src/content/docs/reference/management-api.md` at line 186, Update
the PATCH /api/providers endpoint row in
docs-site/src/content/docs/reference/management-api.md:186-186 to document
shallow merging of non-empty headers, clearing with null or {}, rejection of
sensitive authentication headers, invalid names, non-string values, and CRLF
with HTTP 400, and the distinction between configurable custom-adapter headers
and forwarded caller credentials. Translate and apply the same semantics in
docs-site/src/content/docs/ja/reference/management-api.md:169-169,
docs-site/src/content/docs/ko/reference/management-api.md:169-169,
docs-site/src/content/docs/ru/reference/management-api.md:188-188, and
docs-site/src/content/docs/zh-cn/reference/management-api.md:169-169.

Source: Path instructions

| `DELETE /api/providers?name=...` | Delete a provider, reassigning the default when possible | 404 unknown provider; 409 `last_provider`; 409 `provider_has_dependent_combos` |
| `POST /api/providers/test?name=...` | Perform a bounded live provider connectivity/model-discovery probe | 404 unknown provider; failures are normally returned as `ok: false` evidence |
| `GET /api/provider-quotas` | Read provider quota reports; `refresh=1` forces refresh | — |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ pool'ами и контролируют каталог моделей, кото
| --- | --- | --- |
| `list` | `--json` | Показать настроенных провайдеров и оставшиеся записи registry. |
| `add <name>` | `--adapter <adapter>`, `--base-url <url>`, `--api-key <key>`, `--default-model <model>`, `--set-default`, `--force`, `--json`, `--sync` | Добавить registry/custom-провайдера. `--force` перезаписывает; `--sync` обновляет живой прокси в human-output mode. |
| `edit <name>` | provider field flags, `--json` | Изменить валидированные live-поля провайдера, не заменяя key-pool'ы. |
| `edit <name>` | provider field flags, `--headers <json>`, `--json` | Изменить валидированные live-поля провайдера, не заменяя key-pool'ы. `--headers` объединяет пользовательские request-header'ы; передайте `{}` или `-`, чтобы очистить их. |
| `test <name>` | `--json` | Пробный запрос к реальному upstream model-endpoint'у. |
| `show <name>` | `--json` | Показать конфиг с замаскированными API-key'ами. |
| `remove <name>` | `--json` | Удалить не-default-провайдера; последний провайдер удалить нельзя. |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/ru/reference/management-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,7 @@ Endpoint'ы storage cleanup могут перемещать или навсег
| --- | --- | --- |
| `GET /api/providers` | Список redacted provider config'ов и состояния discovery | — |
| `POST /api/providers` | Добавить или заменить одного валидированного провайдера и при желании сделать его default | 400 invalid/dangerous destination or config; 409 namespace collision |
| `PATCH /api/providers?name=...` | Обновить допустимые поля провайдера, enabled/default state или OpenAI account mode | 400 invalid field or transition; 404 unknown provider |
| `PATCH /api/providers?name=...` | Обновить допустимые поля провайдера (включая объединяемый блок `headers`), enabled/default state или OpenAI account mode | 400 invalid field or transition; 404 unknown provider |
| `DELETE /api/providers?name=...` | Удалить провайдера, при возможности переназначив default | 404 unknown provider; 409 `last_provider`; 409 `provider_has_dependent_combos` |
| `POST /api/providers/test?name=...` | Выполнить ограниченный live-probe connectivity/model-discovery для провайдера | 404 unknown provider; сбои обычно возвращаются как evidence с `ok: false` |
| `GET /api/provider-quotas` | Прочитать отчёты по provider quota; `refresh=1` форсирует refresh | — |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ description: 提供方配置、凭据、配额，以及模型目录命令。
| --- | --- | --- |
| `list` | `--json` | 列出已配置的提供方以及剩余的注册表条目。 |
| `add <name>` | `--adapter <adapter>`, `--base-url <url>`, `--api-key <key>`, `--default-model <model>`, `--set-default`, `--force`, `--json`, `--sync` | 添加一个注册表/自定义提供方。`--force` 会覆盖；`--sync` 会在有人类输出模式运行的代理上刷新配置。 |
| `edit <name>` | 提供方字段标志，`--json` | 在不替换密钥池的情况下，编辑经过校验的在线提供方字段。 |
| `edit <name>` | 提供方字段标志，`--headers <json>`，`--json` | 在不替换密钥池的情况下，编辑经过校验的在线提供方字段。`--headers` 会合并自定义请求头；传入 `{}` 或 `-` 可清空。 |
| `test <name>` | `--json` | 探测真实的上游模型端点。 |
| `show <name>` | `--json` | 显示已屏蔽 API 密钥的配置。 |
| `remove <name>` | `--json` | 移除一个非默认提供方；最后一个提供方不能被移除。 |
Expand Down
2 changes: 1 addition & 1 deletion docs-site/src/content/docs/zh-cn/reference/management-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ Authorization: Bearer <admin-token>
| --- | --- | --- |
| `GET /api/providers` | 列出已脱敏的 provider 配置和发现状态 | — |
| `POST /api/providers` | 添加或替换一个已验证的 provider，并可选地将其设为默认 | 400 目标或配置无效/危险；409 命名空间冲突 |
| `PATCH /api/providers?name=...` | 更新允许的 provider 字段、启用/默认状态，或 OpenAI 账户模式 | 400 字段或转换无效；404 未知 provider |
| `PATCH /api/providers?name=...` | 更新允许的 provider 字段（包括合并的 `headers` 块）、启用/默认状态，或 OpenAI 账户模式 | 400 字段或转换无效；404 未知 provider |
| `DELETE /api/providers?name=...` | 删除一个 provider，并在可能时重新分配默认值 | 404 未知 provider；409 `last_provider`；409 `provider_has_dependent_combos` |
| `POST /api/providers/test?name=...` | 执行一个有上限的在线 provider 连通性/模型发现探测 | 404 未知 provider；失败通常以 `ok: false` 证据返回 |
| `GET /api/provider-quotas` | 读取 provider 配额报告；`refresh=1` 会强制刷新 | — |
Expand Down
19 changes: 18 additions & 1 deletion src/cli/provider-runtime.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ const USAGE = `Usage:
ocx provider edit <name> [--adapter <id>] [--base-url <url>] [--default-model <id|->]
[--auth-mode <key|forward|oauth|local|->] [--note <text|->]
[--api-key-transport <x-api-key|bearer|->]
[--enabled <on|off>] [--live-models <on|off>] [--allow-private-network <on|off>] [--json]
[--headers <json>] [--enabled <on|off>] [--live-models <on|off>]
[--allow-private-network <on|off>] [--json]
ocx provider test <name> [--json]
ocx provider quota [--refresh] [--json]
ocx provider presets [--json]
Expand All @@ -39,6 +40,7 @@ async function edit(argv: string[], deps: RuntimeApiDeps): Promise<void> {
const authMode = cleared(takeOption(args, "--auth-mode"));
const note = cleared(takeOption(args, "--note"));
const apiKeyTransport = cleared(takeOption(args, "--api-key-transport"));
const headers = takeOption(args, "--headers");

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Redact header JSON left in CLI arguments

When a user uses the common --headers={...} spelling or repeats --headers, takeOption leaves the unconsumed token in args, and rejectArgs prints the complete JSON verbatim to stderr. Custom header values can contain tokens or account identifiers, so a syntax error can expose them in terminal or CI logs before server-side validation runs; parse this option with a secret-aware helper or explicitly redact its value from usage errors.

AGENTS.md reference: AGENTS.md:L189-L195

Useful? React with 👍 / 👎.

const enabled = takeBooleanOption(args, "--enabled");
const liveModels = takeBooleanOption(args, "--live-models");
const allowPrivateNetwork = takeBooleanOption(args, "--allow-private-network");
Expand All @@ -49,6 +51,21 @@ async function edit(argv: string[], deps: RuntimeApiDeps): Promise<void> {
if (authMode !== undefined) patch.authMode = authMode;
if (note !== undefined) patch.note = note;
if (apiKeyTransport !== undefined) patch.apiKeyTransport = apiKeyTransport;
if (headers !== undefined) {
if (headers === "-") {
patch.headers = null;
} else {
let parsed: unknown;
try { parsed = JSON.parse(headers); } catch { throw new CliUsageError("--headers must be valid JSON"); }
if (parsed === null) {
patch.headers = null;
} else if (typeof parsed !== "object" || Array.isArray(parsed)) {
throw new CliUsageError("--headers must be a JSON object like {\"X-Custom\":\"value\"}");
} else {
patch.headers = parsed;
}
}
}
if (enabled !== undefined) patch.disabled = !enabled;
if (liveModels !== undefined) patch.liveModels = liveModels;
if (allowPrivateNetwork !== undefined) patch.allowPrivateNetwork = allowPrivateNetwork;
Expand Down
7 changes: 4 additions & 3 deletions src/cli/runtime-api.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,15 +127,16 @@ export function csv(value: string | undefined): string[] | undefined {
}

/**
* Options whose VALUE is a credential, listed here so a parse error never
* prints one.
* Options whose VALUE is a credential (or can carry one), listed here so a parse
* error never prints one. `--headers` belongs on the list because custom header
* values may contain tokens or account identifiers.
*
* `takeOption` only understands `--flag value`. `--flag=value` therefore falls
* through to `rejectArgs`, which reports the offending argument verbatim — for
* `--code=https://…?code=SECRET` that writes the authorization code to stderr,
* which is the exact exposure the stdin path exists to avoid.
*/
const SECRET_OPTIONS = ["--code"];
const SECRET_OPTIONS = ["--code", "--headers"];

/**
* Replace credential values before they are reported back.
Expand Down
Loading
Loading