Debug 401 auth error in pi-moonshot npm extension
Session from pi-mono-sessions on Hugging Face by thomasmustier · MIT · condensed by Coders Talk
Click a segment to jump to that moment
5msession
1interventions
by library · 2d
GOAL
Figure out why the pi-moonshot npm extension returns a 401 invalid auth error when used with pi.
- +1mPrompt · +1mI'm getting a 401 auth error with the npm:pi-moonshot extension. Let's check the actual code to figure out what's going on.
- +1mAgent did · +1mSearched the pi-mono repo for 'moonshot' references across packages/agent, packages/ai, packages/coding-agent; only found model name strings in generated model lists, no extension code, and a node_modules lookup for pi-moonshot came back empty.
- +1mIntervention · +1mDeveloper said the extension code is 'not likely in this repo', steering the agent away from searching the pi-mono source tree.Why: The agent was searching the wrong place - the extension isn't part of this repo, it's a separately installed npm package.
- +2mPrompt · +2mI got it from npm. Try looking in ~/.pi/agent/extensions/
- +2mAgent did · +2mChecked ~/.pi/agent/extensions (no pi-moonshot there), then checked npm global root, and found the pi-moonshot package installed under /opt/homebrew/lib/node_modules, listing its files.
- +2mAgent did · +2mRead the pi-moonshot extension's package.json, README, and index.ts (which registers the moonshot provider with an apiKey field), then cross-referenced pi's own provider registration docs, auth-storage.ts, model-registry.ts, migrations.ts, sdk.ts, stream.ts and agent-loop.ts to understand how API keys are resolved.
- +5mOutcome · +5mDiagnosed likely cause: the extension sets apiKey to the literal string "MOONSHOT_API_KEY", which pi treats as an env var name unless it's set - if unset, it sends that literal string as the key, causing the 401; also noted that settings.json apiKeys is deprecated in favor of auth.json keyed by provider name.
VERDICT
Next time I'd open with where the extension actually lives (globally installed via npm) instead of assuming it was in the repo - that would have saved several minutes of searching pi-mono source for nothing. Redirecting the agent to check ~/.pi/agent/extensions and then the global npm root was the correction that actually got us to the real file and the root cause.