fix(desktop): give goose the OpenAI key under the env name it reads - #3398
Open
filipkujawa wants to merge 1 commit into
Open
fix(desktop): give goose the OpenAI key under the env name it reads#3398filipkujawa wants to merge 1 commit into
filipkujawa wants to merge 1 commit into
Conversation
filipkujawa
marked this pull request as draft
July 28, 2026 21:07
Buzz stores a user-typed OpenAI key as `OPENAI_COMPAT_API_KEY`, buzz-agent's canonical name, reused as the one secret field for every runtime. goose's openai provider reads `OPENAI_API_KEY`, and nothing translated between them, so a goose agent on provider `openai` called the API unauthenticated and 401'd every turn while readiness reported it Ready. Export the canonical value under `OPENAI_API_KEY` at spawn when a goose child's effective provider is `openai`. Written after the layered user env, and skipped when the agent already carries a native key, so it never clobbers an explicit value. The provider is resolved as layered env, then Buzz's structured field, then goose's `config.yaml`, since a later env layer can override `GOOSE_PROVIDER` in either direction. `openai-compat` is not aliased: goose reaches those endpoints through `openai` plus `OPENAI_HOST`/`OPENAI_BASE_PATH`, which needs `OPENAI_COMPAT_BASE_URL` split into an origin and a path. Signed-off-by: Filip Kujawa <fkujawa@squareup.com>
filipkujawa
force-pushed
the
fix/goose-openai-credential-alias
branch
from
July 28, 2026 21:11
2c90404 to
8e90d85
Compare
filipkujawa
marked this pull request as ready for review
July 28, 2026 21:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3395
Bug: Buzz stores the OpenAI key as
OPENAI_COMPAT_API_KEY(buzz-agent's env contract, reused as the one secret field for every runtime); goose's openai provider readsOPENAI_API_KEY.Nothing translates between them, so a goose agent on provider
openaicalls the API unauthenticated and 401s every turn while readiness reports it Ready.Confirmed on a live spawned child:
GOOSE_PROVIDER=openaiwithOPENAI_COMPAT_API_KEYpresent andOPENAI_API_KEYabsent.Fix: At spawn, export the canonical value under
OPENAI_API_KEYtoo when a goose child's effective provider isopenai.Written after the layered user env, and skipped when the agent already carries a native key, so it never clobbers an explicit value.
Scoped to goose (buzz-agent defines the canonical names; claude and codex use CLI login).
Provider resolution: layered env, then Buzz's structured field, then goose's
config.yaml, since a later env layer can overrideGOOSE_PROVIDERin either direction and a config-file-only provider bypasses the field entirely.Out of scope:
openai-compat(goose has no such provider; needsOPENAI_COMPAT_BASE_URLsplit intoOPENAI_HOST+OPENAI_BASE_PATH).Accepting a user-typed
OPENAI_API_KEYin readiness, which has to land together with the config dialogs or the two disagree.Testing: fmt, clippy, full Tauri lib suite (1816 passed).
New tests cover the alias (mapping, not clobbering an explicit native key, runtime/provider scoping, blank key) and the provider resolution.