noconnorandClaude Opus 5
135112eee5
Folds in the in-flight local-checkout work and fixes the context accounting
on top of it. Both halves are the same bug seen from two ends: clients were
sending requests larger than the backend's window and getting hard
ContextWindowExceededError 400s, intermittently, in a way that looked like
the model or the GPU misbehaving.
Already in flight here (unchanged in intent):
- sync.sh prefers the LOCAL CHECKOUT over re-downloading from Gitea, and
install.sh records the checkout path so it can be found. That recording
is load-bearing: without it sync.sh cannot find the repo, silently falls
back to Gitea, and every local edit to opencode.gateway.json is ignored.
Observed on this box — ~/.config/mcp-sync/source did not exist, the
default ~/.dotfiles is not where the checkout lives, and the Gitea base
still served models:{}.
- the hermes custom-provider wiring.
Fixed on top:
opencode had NO context limit on ANY gateway model, not a wrong one. Two
faults compounded. /model/info 403s for a day-to-day virtual key (only
management-scoped keys may read it), which sync.sh treats as best-effort and
falls back to names-only — as designed and as commented. But the merge then
did `prov["models"] = models`, replacing the map wholesale, so limits
declared in the base config were discarded too and there was no floor left.
Base specs are now a floor that live /model/info overrides field by field:
discovery still wins where present, so this adds no drift, and a 403 no
longer strips the limits. Verified: ornith 195584/32768, the qwens
261120/32768.
hermes' model map named `qwen3-vl-30b-a3b` at 262144 — a model the gateway
stopped serving when Ornith replaced it — while ornith-1.0-35b, the model
actually on cg-1 AND the only one with a window smaller than its neighbours
(196608), had no entry at all and inherited Hermes' default. The one model
needing a lower ceiling was the one not declaring one, which is exactly the
shape that fails only once a session grows.
NOTE for other boxes: hermes reads ~/.hermes/config.yaml, which install.sh
produces by MERGING gateway.yaml. Editing gateway.yaml alone changes nothing
until install.sh re-runs — this machine's live config was patched by hand.
Not addressed here, deliberately: the gateway-side context_window_fallback
(ai-k8s-iac). It is wired but inert while cg-2 is scaled down, so preventing
the oversized request client-side is what actually works today.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FoDK4wwB1Twty5gwiriYLf
55 lines
2.8 KiB
Plaintext
55 lines
2.8 KiB
Plaintext
# ~/.zshrc.local — per-machine customizations. Copy this file to
|
|
# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
|
|
# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
|
|
# lives in the repo — this is the ONLY place to put secrets.
|
|
#
|
|
# cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local
|
|
|
|
# --- Gitea -------------------------------------------------------------
|
|
# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
|
|
# auth itself goes through credential.helper store, see git/).
|
|
# export GITEA_KEY=...
|
|
|
|
# --- covert-gpt LiteLLM gateway -----------------------------------------
|
|
# LITELLM_KEY is normally exported by mcp-config's sync hook from
|
|
# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
|
|
# setting it here. Only set it here on a box without mcp-sync:
|
|
# export LITELLM_KEY=sk-...
|
|
#
|
|
# Hermes Agent uses the same key and endpoint. The base_url is configured
|
|
# in ~/.hermes/config.yaml to point to your covert-gpt gateway
|
|
# (https://llm.covert-gpt.com). Run hermes setup or update config.yaml
|
|
# to set the default model (see ~/.hermes/config.yaml for available models).
|
|
|
|
# mcp-config/install.sh records the checkout it ran from, and the sync reads
|
|
# the config and skills from there — no download, no anonymous read of the repo.
|
|
# To point it at a DIFFERENT checkout (e.g. develop against a feature branch
|
|
# while ~/.dotfiles stays on main), set one variable:
|
|
# MCP_SYNC_REPO="$HOME/source/dotfiles"
|
|
#
|
|
# Only the bootstrap-managed checkout (~/.dotfiles) is ever `git pull`-ed by the
|
|
# hook, and only when clean — a tree you work in is read, never touched.
|
|
|
|
# --- 1Password CLI -------------------------------------------------------
|
|
# Service-account token for non-interactive `op read` / `op run`.
|
|
# export OP_SERVICE_ACCOUNT_TOKEN=ops_...
|
|
|
|
# --- Proxmox -------------------------------------------------------------
|
|
# One pair of credentials, several consumers: the proxmox MCP server
|
|
# (mcp-config/opencode.gateway.json) and the terraform layer in
|
|
# rke2-devops-airgap, whose Taskfile composes PROXMOX_VE_API_TOKEN from them.
|
|
# Unprefixed on purpose — these are Proxmox credentials, not MCP ones.
|
|
#
|
|
# The op-vault loop above already exports them from the `noconnor` item, so
|
|
# these lines are only needed without 1Password. Never committed.
|
|
# export PROXMOX_TOKEN_ID="root@pam!terragrunt-proxmox"
|
|
# export PROXMOX_TOKEN_SECRET="00000000-0000-0000-0000-000000000000"
|
|
#
|
|
# The host and TLS setting are hardcoded per-server in the MCP config and read
|
|
# from variables.yaml by terraform, so there is nothing to export for them.
|
|
|
|
# --- Anything else -------------------------------------------------------
|
|
# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
|
|
# so it can override anything the managed zshrc sets.
|
|
# export KUBECONFIG="$HOME/.kube/homelab.yaml"
|