feat(opencode): native OpenAI and Anthropic passthroughs for Cloudflare AI Gateway - #42634
Merged
Conversation
#32052 fixed #32051 (Workers AI 401s) by passing apiKey to createUnified, but applied it to every model — so the Cloudflare API token was sent as the upstream Authorization header for third-party providers (OpenAI, Anthropic), causing them to 401 with "Invalid API Key". Scope token forwarding to be model-aware: attach the Cloudflare token only for first-party Workers AI models, whose upstream is Cloudflare itself. The Unified API addresses Workers AI both as "workers-ai/..." and as bare "@cf/..." ids, so match both; "@cf/" is Cloudflare's reserved namespace, so this never matches a third-party model. Other providers receive no upstream Authorization and fall back to the gateway's stored/BYOK keys. Applied in both the v1 provider (provider.ts) and v2 plugin (core/.../cloudflare-ai-gateway.ts) paths. Tests assert both directions, including that third-party sub-requests carry no upstream authorization header. Reapplies and extends the approach from #33407.
…ls through native passthroughs Co-authored-by: Keefe Tang <keefe@pentagram.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cloudflare AI Gateway models currently all ride the unified OpenAI-compatible `/compat` endpoint. That breaks new OpenAI models (gpt-5.5+/pro reject `tools` + `reasoning_effort` on chat completions and require the Responses API) and squeezes Claude through an OpenAI-shaped body (no native thinking blocks, no `cache_control`, reasoning efforts silently dropped or mistranslated).
This PR routes gateway models through the provider-native passthroughs that `ai-gateway-provider` 3.2 ships:
The passthrough wrappers inject a `CF_TEMP_TOKEN` sentinel the gateway strips before dispatch, so upstream billing stays on the gateway (Unified Billing / stored BYOK) and the Cloudflare token never reaches a third-party provider.
Changes
Live verification
Tested against a real gateway with Unified Billing: OpenAI models with tools + reasoning efforts (the previously failing case), Claude models, and `workers-ai/@cf/moonshotai/kimi-k2.6` (compat regression). Also live-verified the gateway's boundaries, which shaped this scope: under Unified Billing the legacy endpoint serves exactly `openai/`, `anthropic/`, and `workers-ai/` — Google/xAI fail spend-limit resolution (catalog slug ≠ route prefix) and DeepSeek gets no managed credentials. The models.dev catalog was aligned accordingly (models.dev#4674, #4676, #4693, #4715). Other providers arrive with the REST (`/ai/v1`) transport in V2.
Supersedes #33597 — its token-scoping fix is included here with commit authorship preserved and co-author credit.
Fixes: #40344