{"record":{"id":"49ab2cce8d3ed987","repo":"coleam00/Archon","slug":"unknown-credential-vendor-vendor-known","errorCode":null,"errorMessage":"Unknown credential vendor '${vendor}'. Known: ${[...KNOWN_VENDORS].sort().join(', ')}.","messagePattern":"Unknown credential vendor '(.+?)'\\. Known: (.+?)\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/credentials/delivery.ts","lineNumber":212,"sourceCode":"          // Reached only if an oauth row exists under a Pi-backend id (connect\n          // guards against this — oauth is anthropic/openai/github-copilot\n          // only). The Pi runtime consumes subscriptions via the aggregate\n          // auth.json (buildPiAuthJson), not this per-vendor env path.\n          throw new Error(\n            `Vendor '${vendor}' (Pi backend) has no env-based OAuth delivery; subscriptions reach Pi via auth.json.`\n          );\n        }\n        return { env: { [piEnvVar]: cred.apiKey } };\n      }\n      if (PI_AMBIENT_VENDORS.includes(vendor)) {\n        // Ambient-ONLY vendors (amazon-bedrock — no env var in the map):\n        // chains are detected from the environment, never stored — a stored\n        // row for one is a connect bug.\n        throw new Error(\n          `Vendor '${vendor}' uses ambient cloud credentials and has no stored-credential delivery.`\n        );\n      }\n      throw new Error(\n        `Unknown credential vendor '${vendor}'. Known: ${[...KNOWN_VENDORS].sort().join(', ')}.`\n      );\n    }\n  }\n}\n\n/**\n * A Pi `AuthStorage` `auth.json` entry (see `@earendil-works/pi-coding-agent`\n * `core/auth-storage.d.ts`): an API key or an OAuth blob, keyed by Pi provider id.\n */\ntype PiAuthCredential = { type: 'api_key'; key: string } | ({ type: 'oauth' } & OAuthCredentials);\n\n/** Relative path (under the per-run artifacts dir) for the generated Pi auth.json. */\nexport { PI_AUTH_JSON_RELATIVE_PATH };\n/** Env var the Pi provider reads to point `AuthStorage` at the per-run auth.json. */\nexport const PI_AUTH_PATH_ENV = 'ARCHON_PI_AUTH_PATH';\n\n/**","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/core/src/credentials/delivery.ts#L194-L230","documentation":"Thrown by deliverCredential when the vendor id has no delivery rule at all: it has no Pi env var, is not ambient, and is not in KNOWN_VENDORS. The error enumerates every deliverable vendor so callers can see what is accepted. Delivery can only turn stored credentials into env/files for vendors the map knows.","triggerScenarios":"deliverCredential(vendor, cred) with an id absent from PI_PROVIDER_ENV_KEYS-derived KNOWN_VENDORS — a typo'd vendor, a legacy alias outside {claude, codex, copilot} (only those three normalize), an unregistered community vendor, or a stored row whose vendor id predates a rename.","commonSituations":"Rows stored by an older binary under a vendor id a newer map no longer contains; callers passing agent ids instead of vendor ids (only claude/codex/copilot are aliased); plugin providers registering vendors with no delivery rule (see error 191).","solutions":["Use a vendor listed in the error message (the sorted KNOWN_VENDORS set).","Normalize the id with normalizeCredentialVendor if it might be a legacy agent-keyed id.","Migrate or delete stale stored rows whose vendor ids no longer exist in the map.","For a genuinely new vendor, add its env-var entry to PI_PROVIDER_ENV_VARS so KNOWN_VENDORS includes it."],"exampleFix":"// before\ndeliverCredential('claude-code', cred);\n// after\nimport { normalizeCredentialVendor } from './delivery';\ndeliverCredential(normalizeCredentialVendor('claude'), cred); // 'anthropic'","handlingStrategy":"validation","validationCode":"import { KNOWN_VENDORS, normalizeCredentialVendor } from './delivery';\nfunction isDeliverable(vendor: string): boolean {\n  return KNOWN_VENDORS.has(normalizeCredentialVendor(vendor));\n}","typeGuard":null,"tryCatchPattern":"try {\n  const r = deliverCredential(vendor, cred);\n} catch (e) {\n  if ((e as Error).message.startsWith('Unknown credential vendor')) {\n    // treat as data/config error: list KNOWN_VENDORS, skip or reconnect\n  } else throw e;\n}","preventionTips":["Only write credential rows with ids from KNOWN_VENDORS (after normalizeCredentialVendor).","Migrate stale rows after vendor renames/upgrades.","Validate vendor ids at every boundary (CLI, API, scripts) against the known set.","Register new vendors' env-var rules in PI_PROVIDER_ENV_VARS before storing their keys."],"tags":["credentials","delivery","unknown-vendor"],"backgroundTag":"unknown-credential-vendor","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}