feat: reach the model through the AI Gateway instead of a direct provider by EthanThatOneKid · Pull Request #78 · wazootech/computer

EthanThatOneKid · 2026-09-22T06:06:16Z

Filed against the recommendation on #77. The wiring is in place and verified; the model itself is not reachable on the current account, so this does not restore service on its own — see the blocker below.

What changed

agent/lib/models.ts selects the AI Gateway id deepseek/deepseek-v4.1-flash for all six roles; COMPUTER_MODEL overrides it.
lib/deepseek.ts (the createOpenAICompatible + DEEPSEEK_BASE_URL + fetch-middleware seam) is replaced by lib/gateway.ts.
The thinking-mode pin travels as providerOptions.deepseek.thinking — the native AI SDK option for @ai-sdk/deepseek — instead of rewriting every request body at the fetch layer. DEEPSEEK_THINKING still selects the value. All six roles share the pin.
Preflight probes the gateway and names the credential-path failures: 401 → unusable key/OIDC token, 403 → the model needs purchased AI Gateway credits.
The agent-file projection declared the old direct-provider lane (provider: deepseek, model_endpoint: https://api.deepseek.com) and a note pointing at lib/deepseek.ts, which this branch deletes. agent/agent-file-declaration.json now declares the gateway endpoint and id, and lib/agent-file.test.ts asserts the declared handle and endpoint against lib/gateway.ts so the published file cannot drift from the runtime again.
Required runtime secret becomes AI_GATEWAY_API_KEY (or Vercel's injected VERCEL_OIDC_TOKEN); DEEPSEEK_API_KEY is no longer read.

Verification

node --test lib/*.test.ts — 168 pass on this branch (main at 1835765 runs 165).
pnpm run typecheck clean, pnpm run build:eve clean, and both check:agent-file and check:data-agent-file pass, so this branch satisfies wazootech/computer#75's gate.
Rebased onto 1835765 after #70 and #75 landed; the only conflicts were the two doc sentences about the model configuration, resolved as the gateway wording plus #70's GitHub-sign-in sentence.
eve build compiles; the bundle carries _libs/@ai-sdk/gateway+[...].mjs and zero references to openai-compatible or api.deepseek.com.
Live gateway probes: deepseek/deepseek-r1 → 200, google/gemini-2.5-flash → 200, deepseek/deepseek-v4.1-flash → 403.
Preflight against the live gateway returns {"ok":false,"id":"deepseek/deepseek-v4.1-flash","status":403,"error":"gateway refused this model for the account (HTTP 403): the model requires purchased AI Gateway credits"}.

Blocker

The team is on the AI Gateway free tier, which serves "Free Tier eligible models" only. deepseek/deepseek-v4.1-flash is not eligible:

HTTP 403 — Free tier users do not have access to this model.
Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F~%2Fai

BYOK does not route around it. Per the AI Gateway docs, BYOK is paid-tier only, and on the free tier the credential is irrelevant to model access.

So the gateway lane needs purchased AI Gateway credits before this change reaches the model. Until then, the fastest restore remains a fresh provider key on the current wiring.

This should not merge before the account can reach the model. Merging it as-is trades a 401 for a 403 and removes the direct-provider path, which is the one that a replacement key would fix today. AI_GATEWAY_API_KEY also is not set on the Vercel project yet.

Re-probed 2026-09-22 against the live gateway and api.deepseek.com: deepseek/deepseek-v4.1-flash → 403 (no_providers_available, free tier), deepseek/deepseek-r1 → 200, google/gemini-2.5-flash → 200, and the direct DEEPSEEK_API_KEY on main → 401 with the same revoked key the deployment logs. So both lanes are closed today and neither change to this branch opens either.

Unblock, in order of what costs least: (1) issue a replacement provider key and set DEEPSEEK_API_KEY — restores main with no code change, and this branch is not needed for it; (2) purchase AI Gateway credits — then this branch is the right lane and needs only AI_GATEWAY_API_KEY on the project; (3) if neither is available today, a free-tier-eligible gateway model (deepseek/deepseek-r1 and google/gemini-2.5-flash both answered 200 on the free tier) can restore service on this branch's wiring, at the cost of running a different model than the one this repository pins.

Follow-up, not settled here

The pin is expressed as providerOptions.deepseek.thinking, which only takes effect when the gateway routes to the first-party DeepSeek provider. Whether a routing decision to another upstream preserves or ignores it is unverified — it cannot be tested until the model is reachable.

vercel · 2026-09-22T06:06:22Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
computer	Ready	Preview	Sep 22, 2026 5:29pm UTC

wazoocomputer · 2026-09-22T06:06:28Z

I hit an error while handling your request (Model provider API error: Authentication Fails, Your api key: ****53a6 is invalid).

Please try again, rephrase, or reach out if it keeps failing.

Error id: b7c8dba7-d56c-4c69-98dc-99d420a9bfd5

wazoocomputer · 2026-09-22T06:06:29Z

This session could not recover from an error (Model provider API error: Authentication Fails, Your api key: ****53a6 is invalid).

Start a new comment to continue.

Error id: b7c8dba7-d56c-4c69-98dc-99d420a9bfd5

EthanThatOneKid · 2026-09-22T17:22:15Z

Re-checked against the live account — still blocked, and it is the only blocker

The batch merged around this one (#70 as baf1046, #75 as 1835765) and both cleared, so this PR no longer conflicts. The merge conflict was never the problem; the model still is.

Probed the gateway again just now with the account's AI_GATEWAY_API_KEY:

deepseek/deepseek-v4.1-flash  -> 403  Free tier users do not have access to this model
deepseek/deepseek-v3.2        -> 403
anthropic/claude-haiku-4.5    -> 403
deepseek/deepseek-r1          -> 200
google/gemini-2.5-flash       -> 200

So the free tier is live and the credential is valid — it is model access, not the key. Failover does not help either: the refusal is no_providers_available for the model as a whole, not one upstream. The direct-provider key on main is still the revoked one (deepseek-chat -> 401, ****53a6), so neither lane reaches a model right now and #77 is not yet fixed by this PR landing.

Three ways out, in the order I would rank them:

Purchased AI Gateway credits — then this merges exactly as it stands, same V4.1-Flash id, no behavior or prompt-cache change, and the revoked-key failure mode is gone. Cheapest in engineering, costs money.
A fresh first-party DeepSeek key on main — no code change, restores service fastest, but keeps the hand-wired seam that made one revoked key fatal.
Free-tier stopgap on this lane — the gateway is only blocked on which model, not on the lane, so defaulting to deepseek/deepseek-r1 would restore service today at zero cost. It is a different model than V4.1-Flash, so that is a behavior change and deserves to be its own deliberate decision rather than a silent edit here.

Leaving this open and unmerged: merging it as-is trades a legible 401 for a 403 and deletes the direct-provider path, which is the one a replacement key fixes today. Say which of the three you want and this is a short follow-up either way.

…ider Computer built a direct `createOpenAICompatible` client against `api.deepseek.com` behind a single `DEEPSEEK_API_KEY`. One revoked key took the whole agent down with a 401 and there was no second path to the model. The agent now selects the AI Gateway id `deepseek/deepseek-v4.1-flash`, so provider choice and retry move out of this repo: the gateway resolves the slug to one of its upstream providers and fails the request over to another provider serving the same model when one is unavailable. The runtime credential becomes `AI_GATEWAY_API_KEY` (falling back to Vercel's injected `VERCEL_OIDC_TOKEN`), which is no longer tied to one upstream provider account. `COMPUTER_MODEL` overrides the slug. The thinking-mode pin travels as the provider option `providerOptions.deepseek.thinking` instead of a fetch middleware that rewrote the request body; `DEEPSEEK_THINKING` still selects the value, and all six roles share the pin so no role silently runs with thinking ON. Preflight now probes the gateway and names the credential-path failures a call can hit: a 401 reports an unusable key or OIDC token, and a 403 reports that the model needs purchased AI Gateway credits.

The projection's llm_config is declared by hand in agent/agent-file-declaration.json, and this branch made it stale: it still named the DeepSeek provider, endpoint, and API id, and its note pointed at lib/deepseek.ts, which this branch deletes. The committed computer.af therefore described a direct-provider agent while the runtime reaches the gateway. Declare the gateway as the endpoint and the id as the handle, restore the cross-check the projection's own header comment promises (the declared handle against lib/gateway.ts), and regenerate computer.af.

EthanThatOneKid · 2026-09-22T17:30:36Z

Rebasing done — mechanism ready, still blocked on the account reaching the model

Rebased onto 1835765 (after #70 and #75 landed) and re-verified. This PR is now MERGEABLE/CLEAN with verify green, so nothing but the credential keeps it from landing.

Rebase

Conflicts were the two doc sentences that describe the model configuration (README.md, .github/ARCHITECTURE.md), plus one duplicated sentence the auto-merge produced. Resolved as the gateway wording from this branch, carried over #70's GitHub-sign-in sentence and #69's session-repository sentence, and dropped the duplicate. Nothing else was touched by hand.
#75's agent-file gate applies here now, so this branch also regenerates computer.af. That surfaced a real inconsistency: the declaration still described the direct-provider lane (provider: deepseek, model_endpoint: https://api.deepseek.com) with a note pointing at lib/deepseek.ts, which this branch deletes. The declaration now names the gateway endpoint and id, and lib/agent-file.test.ts asserts the declared handle and endpoint against lib/gateway.ts, so the published .af cannot drift from the runtime again. lib/agent-file-project.ts had a comment claiming that cross-check already existed; it now describes what the test actually does.
pnpm run typecheck clean, pnpm test 168 pass, pnpm run build:eve clean, check:agent-file and check:data-agent-file both up to date.

Blocker is unchanged and I re-probed it today

target	result
`deepseek/deepseek-v4.1-flash` via the gateway	403 `no_providers_available` — free tier excludes the model
`deepseek/deepseek-r1` via the gateway	200
`google/gemini-2.5-flash` via the gateway	200
`DEEPSEEK_API_KEY` directly on `api.deepseek.com`	401, the same revoked `****53a6` key the deployment logs

So both lanes are closed right now: the direct path on main fails on the dead key, and the gateway path fails on model eligibility. Note that this PR alone does not fix the outage — but neither does main as it stands.

The decision I need from you, in order of cost

A replacement provider key (DeepSeek, or OpenRouter/Groq if you would rather switch provider) and set DEEPSEEK_API_KEY. Restores main today with no code change; this PR stays queued for when the gateway lane is affordable.
Purchase AI Gateway credits. Then this branch is the right lane and needs only AI_GATEWAY_API_KEY on the Vercel project. It also retires the single-key failure mode that caused today's outage.
Neither available today? A free-tier-eligible gateway model can restore service on this branch's wiring — deepseek/deepseek-r1 and google/gemini-2.5-flash both answered 200 on the free tier. That means shipping a different model than the one the repo pins, so I would only do it with your explicit go-ahead, and as a separate commit that is easy to revert.

Say which and I will do it. I have not merged anything to main from this branch.

vercel Bot deployed to Preview September 22, 2026 06:06 View deployment

EthanThatOneKid mentioned this pull request Sep 22, 2026

P0: Computer is offline — invalid DeepSeek key fails every dispatch and the raw provider error is posted to threads #77

Closed

EthanThatOneKid and others added 2 commits September 22, 2026 17:24

EthanThatOneKid force-pushed the gateway-model branch from 106c386 to 2c4f5c1 Compare September 22, 2026 17:28

vercel Bot deployed to Preview September 22, 2026 17:29 View deployment

EthanThatOneKid merged commit c08c217 into main Sep 23, 2026
3 checks passed

EthanThatOneKid mentioned this pull request Sep 23, 2026

proposal: a durable model path for Computer (gateway free tier vs paid credits vs OpenRouter vs Groq) #83

Closed

EthanThatOneKid deleted the gateway-model branch September 23, 2026 20:03

Navigation Menu

feat: reach the model through the AI Gateway instead of a direct provider - #78

feat: reach the model through the AI Gateway instead of a direct provider#78
EthanThatOneKid merged 2 commits into
mainfrom
gateway-model

EthanThatOneKid commented Sep 22, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

wazoocomputer Bot commented Sep 22, 2026

Uh oh!

wazoocomputer Bot commented Sep 22, 2026

Uh oh!

EthanThatOneKid commented Sep 22, 2026

Uh oh!

EthanThatOneKid commented Sep 22, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

EthanThatOneKid commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Verification

Blocker

Follow-up, not settled here

Uh oh!

vercel Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wazoocomputer Bot commented Sep 22, 2026

Uh oh!

wazoocomputer Bot commented Sep 22, 2026

Uh oh!

EthanThatOneKid commented Sep 22, 2026

Re-checked against the live account — still blocked, and it is the only blocker

Uh oh!

EthanThatOneKid commented Sep 22, 2026

Rebasing done — mechanism ready, still blocked on the account reaching the model

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

EthanThatOneKid commented Sep 22, 2026 •

edited

Loading

vercel Bot commented Sep 22, 2026 •

edited

Loading