Repository navigation
opencode-route-proxy: opendesign leaves sit in pools but the provider's credential is inactive — walks burn attempts and surface a misleading auth error #3228
Description
Finding (2026-10-31, from the route_attempt ledger in opencode.db)
The opendesign provider has a credential row in the OpenCode credential store, but the row is not active (SELECT integration_id, COUNT(*), SUM(active) FROM credential GROUP BY 1 → opendesign: 1 row, SUM(active) = NULL). The route proxy's credential lookup requires active = 1 (bin/opencode-route-proxy.mjs, credentialKey()), so every pool walk that reaches an opendesign leaf records:
provider_id=opendesign, outcome=failure, error_tag=Authentication— "no credential for provider opendesign"
The proxy's own header contract says "disabled providers skipped" — but a provider whose credential is merely inactive is not skipped: it burns one of the walk's MAX_ATTEMPTS with a guaranteed failure, and when it is the last candidate tried, its Authentication error is the one surfaced to the caller. Observed live 2026-10-31 ~16:00 CDT: a workhorse completion walked quota-dead deepseek leaves (opencode-go.personal / opencode-go.lab 429 "Go usage limit exceeded", cline-pass 429 monthly limit), a commandcode timeout, and terminated on the opendesign credential error; OpenClaw's gateway then classified the whole run as an auth failure ("Couldn't sign in to opencode-route. Your saved login looks expired") — a misleading surface for what is a dead-credential leaf inside the pool.
Ask
Pick one, per the owner's intent for this provider:
- If opendesign should be usable: activate its credential row (after verifying the stored key is still valid), or
- If it should not: mark the provider disabled in the OpenCode config so
resolveRouteskips its leaves entirely, or remove the opendesign leaves from the pools that contain them (e.g. the deepseek pool containingopendesign/deepseek-v4.1-flash).
Also worth considering in the proxy: a leaf whose credential lookup comes back empty could be treated as a skip (like a disabled provider) rather than an attempt — the credential store's active flag already carries the intent.
Context
Found while closing out the OpenClaw route-only deploy (#3061): the deploy itself is verified working (gateway up on the new system generation, route-only config live, runs walk workhorse → specialist → speed as configured). The runs currently fail on leaf health — chiefly quota exhaustion across the deepseek doors on 2026-10-31 — of which this inactive-credential leaf is the one permanent, non-quota defect.
Acceptance criteria
- A pool walk never spends one of its attempts on a provider whose credential row is inactive: inactive-credential providers are skipped like disabled providers (or the credential is activated / the provider disabled, per the owner's recorded intent — see the Ask in the original body).
- When every candidate in a walk fails, the error surfaced to the caller is not a misleading Authentication error produced by an inactive-credential leaf.
- A test or probe pins the behaviour: a pool containing an inactive-credential leaf and one healthy leaf completes via the healthy leaf with no attempt recorded against the inactive provider.
- The chosen resolution (activate / disable / skip-inactive) is recorded on this issue.
Activity
dezren39 commentedon Oct 31, 2026
Intake review
Related: #3225 (same
app/opencode-route-proxysurface, filed the same evening); the misleading-surface failure was observed live 2026-10-31 ~16:00 CDT per the issue body.Notes: The defect is verified in the body with the route_attempt ledger evidence:
credentialKey()requiresactive = 1, butresolveRoutedoes not skip providers whose only credential is inactive, so the walk burns attempts and can surface the dead leaf's Authentication error as the run's failure. The fix direction (skip-inactive in the walk) is mechanical; the choice among the issue's three options is not — options 1 and 2 change the owner's provider setup.Risks: Low code risk for the skip-inactive change. The larger risk is leaving the surfaced-error behaviour as-is: downstream classifiers (OpenClaw gateway in the observed case) read it as an expired login and misdirect recovery.
Suggested approach: Implement skip-inactive in
resolveRoute/credentialKeyso the walk treats an inactive credential like a disabled provider, pin it with the acceptance-criteria probe, and record the owner's intent for opendesign itself underuser/review(Muse review lane) rather than guessing it in a lane.— fleet monitor intake, 2026-10-31 fleet-monitor run (17:12 CDT)
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
6 remaining items
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: done (queue task 8206 triaged)
triage closed: issue still live, fix scoped as task 8762 (queued, queue/queued). owner's opendesign credential intent left open under user/review for the review lane.
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
Merge pull request #5156 from developing-today/queue/8762-3228-skip-i…
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done
fix(route-proxy): Codex round on #5295 — credential-aware gate fallba…