hotfix(proxy): dispatch Makora/Together on Anthropic + OpenAI surfaces (fix 502 no-translation-path)

[steventohme]

Hotfix — production-burning

Makora and Together were never able to serve a single Claude Code turn.

The bug (confirmed in prod)

The router registers the makora and together providers (keys wired, "provider enabled" at boot) and the catalog makes them primary for DeepSeek V4 models. But the proxy's cross-format dispatch switches hardcode the list of OpenAI-compatible providers and omit makora and together.

So when an inbound Anthropic Messages request (/v1/messages, i.e. Claude Code) is routed to Makora/Together, the switch decision.Provider falls through to default: and returns:

provider not configured: makora (no translation path defined for inbound Anthropic Messages)

→ HTTP 502. Claude Code retries, gets empty turns, the no-progress detector breaks the turn and re-routes to Claude. Net effect: Makora/Together have never successfully served a Claude Code request.

The fix

Add providers.ProviderMakora and providers.ProviderTogether to every hardcoded OpenAI-compat provider set so these decisions take the cross-format OpenAI translation path:

• internal/proxy/service.go — ProxyMessages cross-format dispatch switch (the prod bug)
• internal/proxy/service.go — ProxyOpenAIChatCompletion cross-format dispatch switch (same bug class on the OpenAI inbound surface)
• internal/proxy/credentials.go — ExtractClientCredentials (Bearer client/BYOK creds for these OpenAI-compat upstreams)
• internal/proxy/service.go — requestUsesNonDeploymentCreds (a client-supplied key for these providers must skip the summarizer)

Both providers are wired via openaicompat.NewClientWithModelIDMap in cmd/router/main.go and documented as OpenAI-compatible surfaces, so they belong in exactly the same sets as deepinfra/fireworks.

Regression test

Extended the existing DispatchesDeepInfraAndBedrock table tests (both ProxyMessages and ProxyOpenAIChatCompletion) with makora and together cases. Verified the ProxyMessages case reproduces the exact prod error and fails without the switch fix:

--- FAIL: .../makora    provider not configured: makora (no translation path defined for inbound Anthropic Messages)
--- FAIL: .../together  provider not configured: together (no translation path defined for inbound Anthropic Messages)

and passes with it.

Deliberately left unchanged

• internal/translate/emit_openai.go applySessionAffinity — the x-session-affinity header is a Fireworks/DeepInfra-specific caching optimization, not a dispatch/translation gate; the default (no header) is correct for other targets.
• internal/api/admin/config.go configProviderOrder — a curated self-hosted dashboard display list (already omits DeepInfra/Bedrock), not the cross-format provider set.

Validation

go build ./...            # OK
go vet ./internal/proxy/... # OK
go test ./internal/proxy/... # ok (all pass)

🤖 Generated with Claude Code

[greptile-apps]

T-Rex Logs

What T-Rex did

• Attempted to run a focused Go test to verify Makora credential resolution from inbound OpenAI bearer, but the Go toolchain was not installed in the environment, blocking runtime execution.
• Makora and Together tests showed that before Makora the provider was not configured and the test exited with Upstream_CALLS=0; after Makora/Together the provider was configured, the test exited with Upstream_CALLS=1, and a translated Anthropic response was returned.
• The captured artifacts indicate that before/after artifacts contain the exact commands, working directory, shell output, and exit codes, but no runtime dispatch path was exercised due to the missing Go binary.
• The artifacts show that before: Makora and Together are absent from both ExtractClientCredentials and requestUsesNonDeploymentCreds tests, producing simulated requestUsesNonDeploymentCreds=false, and after: they are present with requestUsesNonDeploymentCreds=true, confirming the shared OpenAI bearer path is used.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "hotfix(proxy): dispatch Makora/Together ..." | Re-trigger Greptile}

[greptile-apps]

T-Rex pricing update — T-Rex was free through June 2026. Effective July 1, 2026, T-Rex adds 2 credits on top of the standard 1-credit review (3 total). T-Rex settings

[greptile-apps]

Bearer Key Cross-Provider Forwarding

When an OpenAI-surface request carries a normal Authorization: Bearer sk-* key and routing selects Makora or Together, this shared extraction case now treats that key as credentials for the selected upstream. The openaicompat client then prefers the request credential over the deployment key, so a caller's OpenAI key can be sent to inference.makora.com or api.together.xyz, leaking the credential and causing the upstream auth to fail.