{"record":{"id":"c06b5830fc00cd89","repo":"can1357/oh-my-pi","slug":"omp-auth-gateway-check-requires-omp-auth-broker","errorCode":null,"errorMessage":"`omp auth-gateway check` requires OMP_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). It probes the same credentials the gateway would serve.","messagePattern":"`omp auth-gateway check` requires OMP_AUTH_BROKER_URL \\(or `auth\\.broker\\.url`/`auth\\.broker\\.token` in config\\.yml\\)\\. It probes the same credentials the gateway would serve\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/cli/auth-gateway-cli.ts","lineNumber":593,"sourceCode":"\treturn chalk.yellow(\" [chat: skip]\");\n}\n\n/**\n * `omp auth-gateway check` — probe each broker-supplied credential and print\n * per-credential auth health. Use this when the gateway is returning 401s and\n * you need to find which row in a multi-account pool is the bad one. The\n * aggregate `/v1/usage` endpoint silently drops failed credentials, so a\n * dedicated diagnostic is the only way to see which credentials failed.\n *\n * Strict mode (`--strict`) additionally exercises each credential against a\n * cheap chat model from its provider's bundled catalog. This catches the case\n * where the usage endpoint reports 200 but the chat endpoint 401s the same\n * bearer (revoked OAuth scope, mislabeled provider row, etc).\n */\nasync function runCheck(flags: AuthGatewayCommandArgs[\"flags\"]): Promise<void> {\n\tconst brokerConfig = await resolveAuthBrokerConfig();\n\tif (!brokerConfig) {\n\t\tthrow new Error(\n\t\t\t\"`omp auth-gateway check` requires OMP_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). It probes the same credentials the gateway would serve.\",\n\t\t);\n\t}\n\n\tconst accountPool = await loadAuthBrokerAccountPool();\n\tconst client = createBrokerClient(brokerConfig);\n\tconst initialSnapshot = await fetchBrokerSnapshot(client);\n\tconst store = new RemoteAuthCredentialStore({\n\t\tclient,\n\t\tinitialSnapshot,\n\t\taccountPool,\n\t});\n\tconst storage = new AuthStorage(store, { sourceLabel: `broker ${brokerConfig.url}` });\n\ttry {\n\t\tawait storage.reload();\n\t\tconst results = await storage.checkCredentials(\n\t\t\tflags.strict\n\t\t\t\t? { completionProbe: createStrictCompletionProbe(), completionTimeoutMs: STRICT_PROBE_OVERALL_TIMEOUT_MS }","sourceCodeStart":575,"sourceCodeEnd":611,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/cli/auth-gateway-cli.ts#L575-L611","documentation":"`omp auth-gateway check` probes broker credentials the same way the gateway serves them, so it requires broker configuration. runCheck throws when resolveAuthBrokerConfig() yields null — no OMP_AUTH_BROKER_URL env var and no auth.broker.url/auth.broker.token in config.yml. Fail-fast validation before probing.","triggerScenarios":"Running `omp auth-gateway check` without broker env vars or config.yml keys.","commonSituations":"Diagnosing gateway issues on a box that lacks the broker config; forgot to source the env file; new teammate without config setup.","solutions":["Export OMP_AUTH_BROKER_URL (plus token) or add auth.broker.url/auth.broker.token to config.yml.","Re-run check in the same shell/environment the gateway runs in so results are representative."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const hasBroker = Boolean(process.env.OMP_AUTH_BROKER_URL ?? config.auth?.broker?.url);\nif (!hasBroker) { console.error(\"auth-gateway check needs broker config\"); process.exit(1); }","typeGuard":"function hasBrokerConfig(c: unknown): c is { url: string; token?: string } {\n  return typeof (c as { url?: unknown })?.url === \"string\";\n}","tryCatchPattern":"try {\n  await runCheck(flags);\n} catch (err) {\n  if (String(err).includes(\"requires OMP_AUTH_BROKER_URL\")) {\n    console.error(\"export OMP_AUTH_BROKER_URL and re-run\");\n  }\n  throw err;\n}","preventionTips":["Run check in the same shell that runs the gateway","Source env files explicitly in scripts (set -a; source .env; set +a)","Validate config.yml keys before invoking CLI commands"],"tags":["auth-gateway","configuration","missing-env-var"],"backgroundTag":"missing-env-var","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}