fix(openviking): resolve 403 with API key auth and late .env loading#21136
Open
baofuen wants to merge 1 commit into
Open
fix(openviking): resolve 403 with API key auth and late .env loading#21136baofuen wants to merge 1 commit into
baofuen wants to merge 1 commit into
Conversation
Bug 1: _headers() sent X-OpenViking-Account/User/Agent headers alongside X-API-Key, causing PERMISSION_DENIED (403) for API-key-authenticated servers. The account is embedded in the key itself — explicit tenant headers are rejected. Fix: Only send tenant headers in local-dev mode (no API key). When self._api_key is set, omit X-OpenViking-* headers. Bug 2: initialize() captured env vars once and never re-read them. /reload or late .env additions had no effect without process restart. Fix: Add _ensure_client() that re-reads os.environ on every tool call and recreates the client when API key/endpoint changes. Applied in handle_tool_call() and system_prompt_block(). Closes: NousResearch#21130
Collaborator
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two bugs in
plugins/memory/openviking/__init__.pyprevent the OpenViking memory plugin from working.Bug 1: X-OpenViking-Account header conflicts with API key auth (Blocker)
_headers()unconditionally sentX-OpenViking-Account/User/Agent headers alongsideX-API-Key. When using API key authentication, the account is embedded in the key itself — the OpenViking server rejects explicit tenant header overrides withPERMISSION_DENIED(403).Fix: Only send tenant headers in local-dev mode (no API key). When
self._api_keyis set, omitX-OpenViking-*headers.Bug 2: Env vars captured once, not re-read after /reload (Medium)
initialize()snapshotsos.environ.get("OPENVIKING_API_KEY", "")intoself._api_keyand creates_VikingClientonce./reloadupdatesos.environbut the provider is not re-initialized. Even/newdoes not callinitialize()again.Fix: Add
_ensure_client()that re-readsos.environon every tool call and recreates the client when API key/endpoint changes. Applied inhandle_tool_call()andsystem_prompt_block().How to test
memory.provider: openvikingin config.yaml.envwithOPENVIKING_ENDPOINTandOPENVIKING_API_KEYviking_browse,viking_search,viking_readshould return data instead of 403Platforms tested
Related