ton/pi_harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ai): fall back to ambient Cloudflare account id for key-only credentials (#6292)

Browse Source 
Cloudflare Workers AI / AI Gateway resolved provider config from the
credential only, never consulting ambient env for a field the credential
omitted. The coding-agent /login flow stores just the API key, so
CLOUDFLARE_ACCOUNT_ID lives only in the environment; the key-only credential
short-circuited the env lookup, the account id stayed unresolved, and requests
hit the literal {CLOUDFLARE_ACCOUNT_ID} base URL -> 404.

resolveValue now merges per field: prefer the credential value, fall back to
ctx.env(name).

closes #6021

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>
Co-authored-by: Mario Zechner <badlogicgames@gmail.com>
This commit is contained in:
Mark Phelps
2026-07-11 08:30:40 -04:00
committed by GitHub
parent 850c210b77
commit bdd5c53bcd
3 changed files with 30 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ai/test/providers.test.ts
+20
View File
@@ -99,6 +99,26 @@ describe("builtin providers", () => {
expect(result?.env).toEqual({ CLOUDFLARE_ACCOUNT_ID: "account-id" });
});
// Regression for #6021: a credential carrying only the API key (as stored
// by `/login`) must still resolve CLOUDFLARE_ACCOUNT_ID from ambient env.
it("falls back to ambient CLOUDFLARE_ACCOUNT_ID when the credential carries only the API key", async () => {
const provider = cloudflareWorkersAIProvider();
const model = builtinModels().getModels("cloudflare-workers-ai")[0];
const auth = provider.auth.apiKey;
if (!auth) throw new Error("expected api-key auth");
const result = await auth.resolve({
model,
ctx: fakeAuthContext({ CLOUDFLARE_ACCOUNT_ID: "account-id" }),
credential: { type: "api_key", key: "cf-key" },
});
expect(result?.auth).toEqual({
apiKey: "cf-key",
baseUrl: "https://api.cloudflare.com/client/v4/accounts/account-id/ai/v1",
});
expect(result?.env).toEqual({ CLOUDFLARE_ACCOUNT_ID: "account-id" });
});
it("requires Cloudflare AI Gateway account and gateway config and returns scoped env headers", async () => {
const missingGateway = createModels({
authContext: fakeAuthContext({ CLOUDFLARE_API_KEY: "cf-key", CLOUDFLARE_ACCOUNT_ID: "account-id" }),