[BUG] provider create --credential always shows CREDENTIAL_KEYS: 0 on WSL2, inference.local returns HTTP 403 #501
Description
Agent Diagnostic
Investigated before filing. Tested --credential KEY=VALUE, --from-existing,
and provider update on both v0.0.10 and v0.0.11. Confirmed API key is valid
via direct curl. Confirmed inference.local is reachable (GET /v1/models returns
full model list). 403 only occurs on POST /v1/chat/completions. Provider
ordering (before/after sandbox creation) makes no difference.
Description
Expected
NAME TYPE CREDENTIAL_KEYS CONFIG_KEYS
nvidia-nim nvidia 1 0
Actual
NAME TYPE CREDENTIAL_KEYS CONFIG_KEYS
nvidia-nim nvidia 0 0
CREDENTIAL_KEYS always shows 0 regardless of method used.
Impact
All chat completion requests through inference.local return HTTP 403:
{"status":403,"title":"Forbidden","detail":"Authorization failed"}Diagnostic Output
Gateway endpoint: https://127.0.0.1:8080
NAME NAMESPACE CREATED PHASE
my-sandbox openshell 2026-03-19 23:27:14 Ready
NAME TYPE CREDENTIAL_KEYS CONFIG_KEYS
nvidia-nim nvidia 0 0
Gateway inference:
Provider: nvidia-nim
Model: nvidia/nemotron-3-super-120b-a12b
Version: 1
Verified Working
GET /v1/models via inference.local returns 200 with full model catalog.
Direct curl to integrate.api.nvidia.com with same key returns 200.
Only authenticated endpoints (chat completions) fail.
Reproduction Steps
bash
openshell gateway start --name nemoclaw
export NVIDIA_API_KEY=nvapi-xxx
openshell provider create --name nvidia-nim --type nvidia
--credential NVIDIA_API_KEY=$NVIDIA_API_KEY
openshell provider list
Environment
- OS: Windows 11 (build 26200) → WSL2 Ubuntu 24.04 LTS (glibc 2.39)
- OpenShell: v0.0.11
- Docker Desktop: 27.5.1 (WSL2 backend)
- GPU: NVIDIA GeForce RTX 3050 Laptop (driver 576.02, CUDA 12.9)
- Kernel: 5.15.167.4-microsoft-standard-WSL2
Logs
curl -s https://inference.local/v1/chat/completions \
-k -H "Content-Type: application/json" \
-d '{"model":"nvidia/nemotron-3-super-120b-a12b","messages":[{"role":"user","content":"hello"}],"max_tokens":50}'
Response: {"status":403,"title":"Forbidden","detail":"Authorization failed"}Agent-First Checklist
- I pointed my agent at the repo and had it investigate this issue
- I loaded relevant skills (e.g.,
debug-openshell-cluster,debug-inference,openshell-cli) - My agent could not resolve this — the diagnostic above explains why