Offer every model at install time, and stop the Keychain prompt - #20
Open
BeLazy167 wants to merge 2 commits into
Open
Offer every model at install time, and stop the Keychain prompt#20BeLazy167 wants to merge 2 commits into
BeLazy167 wants to merge 2 commits into
Conversation
Two install-time reports from the same session: - The model chooser listed only the four Claude models. It reads /v1/models — the Anthropic surface, which by design serves only Claude — while the GPT models live on the OpenAI-compat surface. It now reads /models, the same endpoint models.tsv already uses, so all 12 appear and the default can be a GPT model. - macOS Keychain prompted "password data for new item:" mid-install and blocked. The write used bare `-w`, which relies on security reading the password from stdin — undocumented, and it falls back to a /dev/tty prompt when it does not. Not reproducible here (verified both plain and `cat script | bash`), so it is environment-specific, most likely a locked keychain. `security -i` takes the command on stdin, cannot fall back to a prompt, and keeps the key out of the process argument list. The failure message now names the locked-keychain case. Verified: install exits 0 and the chooser offers all 12 models.
The stub read the action from $1, so `security -i` (command on stdin) fell through and stored nothing — failing the generation-rotation assertions. It now models both shapes the installer uses.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two install-time issues from the same run.
1. The chooser hid every GPT model
It listed only
claude-sonnet-4-6 / haiku-4-5 / opus-4-8 / opus-5because it reads/v1/models— the Anthropic surface, which by design serves only Claude models. The GPT models live on the OpenAI-compat surface. Now reads/models, the same endpointmodels.tsvalready uses, so all 12 appear and the default can be a GPT model.Verified: install exits 0 with
default model: gpt-5.6-sol.2. "password data for new item:" blocked the install
macOS Keychain prompted mid-install. The write used bare
-w, which depends onsecurityreading the password from stdin — undocumented behaviour that falls back to a/dev/ttyprompt when it doesn't happen.Not reproducible here. I tested both a plain run and
cat script | bash(thecurl | bashshape) and the write succeeded silently both times, so this is environment-specific — most likely a locked login keychain.Fixed anyway, because the old form relied on undocumented behaviour:
security -itakes the command on stdin, so it cannot fall back to a prompt, and it keeps the key out of the process argument list (ps) — consistent with thecurl --config -pattern used elsewhere for the same reason. The failure message now names the locked-keychain case.If it recurs after this, the next thing to check is
security show-keychain-info ~/Library/Keychains/login.keychain-dband the macOS version.