Skip to content

fix: add error transform to cryptic openAI SDK errors when API key is invalid#7586

Merged
mrubens merged 8 commits intomainfrom
fix/api-key-validation-non-ascii
Sep 5, 2025
Merged

fix: add error transform to cryptic openAI SDK errors when API key is invalid#7586
mrubens merged 8 commits intomainfrom
fix/api-key-validation-non-ascii

Conversation

@roomote
Copy link
Contributor

@roomote roomote bot commented Sep 1, 2025

Summary

Display a localized, provider-agnostic error when an API key contains invalid characters, triggered at request time for OpenAI-compatible providers.

Problem

If the API key contains invalid characters (for example emojis or other non-ASCII symbols), the OpenAI SDK surfaces a low-level ByteString error that is unclear to users.

Implementation

i18n

  • Added common:errors.api.invalidKeyInvalidChars in all locales.
  • Removed the unused common:errors.api.invalidKeyNonAscii key.

User impact

Users see a clear, localized message instead of a cryptic low-level error when their API key contains invalid characters.

Fixes #7483

@roomote roomote bot requested review from cte, jr and mrubens as code owners September 1, 2025 22:58
@dosubot dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. bug Something isn't working labels Sep 1, 2025
Copy link
Contributor Author

@roomote roomote bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewing my own code is like debugging in production - technically possible but morally questionable.

this.options = options

// LM Studio uses "noop" as a placeholder API key, but we should still validate if a real key is provided
const apiKey = "noop"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this intentional? The comment on line 28 suggests we should validate a real key if provided, but we're always validating the hardcoded "noop" string. Should we check for a real API key from options.lmStudioApiKey first before defaulting to "noop"?

const charCode = apiKey.charCodeAt(i)
if (charCode > 255) {
throw new Error(
`Invalid ${providerName} API key: contains non-ASCII character at position ${i + 1}. ` +
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The error message says "non-ASCII character" but we actually allow extended ASCII (128-255). Would it be clearer to say something like "character above 255" or "non-ByteString compatible character" to be more precise about what's actually being validated?

for (let i = 0; i < apiKey.length; i++) {
const charCode = apiKey.charCodeAt(i)
if (charCode > 255) {
throw new Error(
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we enhance the error message to also show the actual character that caused the issue? This might help with debugging. For example, including the character itself and its character code in the error message.

)
})

it("should handle undefined and empty keys", () => {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding test cases for null values (in addition to undefined), very long API keys to ensure performance, and keys with only extended ASCII characters. This would make the test coverage even more comprehensive.

@hannesrudolph hannesrudolph added the Issue/PR - Triage New issue. Needs quick review to confirm validity and assign labels. label Sep 1, 2025
@daniel-lxs daniel-lxs moved this from Triage to PR [Needs Prelim Review] in Roo Code Roadmap Sep 2, 2025
@hannesrudolph hannesrudolph added PR - Needs Preliminary Review and removed Issue/PR - Triage New issue. Needs quick review to confirm validity and assign labels. labels Sep 2, 2025
@daniel-lxs daniel-lxs changed the title fix: add API key validation for non-ASCII characters in OpenAI-compatible providers fix: add error transform to cryptic openAI SDK errors when API key is invalid Sep 4, 2025
@daniel-lxs daniel-lxs force-pushed the fix/api-key-validation-non-ascii branch from f90906a to 3c43bc0 Compare September 4, 2025 05:23
roomote and others added 5 commits September 4, 2025 00:25
…ible providers

- Created shared validation utility to check for non-ASCII characters in API keys
- Added validation to all OpenAI-compatible providers to prevent ByteString conversion errors
- Provides clear error messages when invalid characters are detected
- Fixes issue #7483 where non-ASCII characters in API keys caused cryptic errors
…-time; centralize in openai-error-handler; remove provider/index specifics; i18n: add invalidKeyInvalidChars, remove invalidKeyNonAscii
…truct clients directly and keep request-time error mapping via handleOpenAIError
@daniel-lxs daniel-lxs force-pushed the fix/api-key-validation-non-ascii branch from 3c43bc0 to fc6e9c6 Compare September 4, 2025 05:27
- Wrap all non-ByteString errors with provider-specific prefix
- Handle potential undefined error messages safely
- Maintain consistent error format expected by unit tests
@daniel-lxs daniel-lxs moved this from PR [Needs Prelim Review] to PR [Needs Review] in Roo Code Roadmap Sep 4, 2025
- Add providerName constant to all provider classes that use handleOpenAIError
- Replace hardcoded provider name strings with this.providerName
- Improves maintainability and consistency across providers
- Affected providers: OpenAI, HuggingFace, LM Studio, Ollama, OpenRouter, Requesty, xAI
- Replace hardcoded 'OpenAI' strings with this.providerName property
- Follows same pattern as other provider classes for consistency
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working lgtm This PR has been approved by a maintainer PR - Needs Review size:L This PR changes 100-499 lines, ignoring generated files.

Projects

No open projects
Archived in project

Development

Successfully merging this pull request may close these issues.

Request faile without a clear message when there is non-ascii char in api key

4 participants