Release 2026.3.9

Fix Groq OpenAI-compatible passthrough endpoint selection, persist provider-specific external_llm_url from set-key, and cut the 2026.3.9 release.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robinson

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2026.3.9] - 2026-03-27
+
+### Fixed
+- **Groq OpenAI passthrough endpoint selection**: OpenAI-compatible tool passthrough now falls back to Groq's own `/openai/v1/chat/completions` endpoint instead of reusing the OpenAI default URL, preventing Groq keys from being sent to OpenAI and failing with misleading `401 invalid_api_key` errors.
+- **`isartor set-key -p groq` endpoint wiring**: provider key setup now writes the provider-specific `external_llm_url` alongside the model and key so Groq and other OpenAI-compatible providers start with the correct Layer 3 endpoint.
+
 ## [2026.3.8] - 2026-03-27
 
 ### Changed
@@ -403,7 +409,8 @@ Isartor's first CalVer release — marking go-live readiness.
 ### Fixed
 - Build musl targets with runner-based zigbuild (no Docker container)
 
-[Unreleased]: https://github.com/isartor-ai/Isartor/compare/v2026.3.8...HEAD
+[Unreleased]: https://github.com/isartor-ai/Isartor/compare/v2026.3.9...HEAD
+[2026.3.9]: https://github.com/isartor-ai/Isartor/compare/v2026.3.8...v2026.3.9
 [2026.3.8]: https://github.com/isartor-ai/Isartor/compare/v2026.3.7...v2026.3.8
 [2026.3.7]: https://github.com/isartor-ai/Isartor/compare/v2026.3.6...v2026.3.7
 [2026.3.6]: https://github.com/isartor-ai/Isartor/compare/v2026.3.5...v2026.3.6

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "isartor"
-version = "2026.3.8"
+version = "2026.3.9"
 edition = "2024"
 license = "Apache-2.0"
 description = "Open-source Prompt Firewall — a local LLM gateway with caching, semantic deduplication, and content filtering"

Cargo.toml

@@ -4,7 +4,7 @@ use std::path::PathBuf;
 use anyhow::{Context, Result, bail};
 use clap::Parser;
 
-use crate::config::LlmProvider;
+use crate::config::{LlmProvider, default_chat_completions_url};
 
 /// Set the API key for an LLM provider (writes to isartor.toml or env file).
 #[derive(Parser, Debug, Clone)]
@@ -129,8 +129,13 @@ pub async fn handle_set_key(args: SetKeyArgs) -> Result<()> {
     // 4. Handle --env-file mode
     if args.env_file {
         let env_content = format!(
-            "export ISARTOR__LLM_PROVIDER=\"{}\"\nexport ISARTOR__EXTERNAL_LLM_MODEL=\"{}\"\nexport ISARTOR__EXTERNAL_LLM_API_KEY=\"{}\"\n",
-            provider_str, model, api_key
+            "export ISARTOR__LLM_PROVIDER=\"{}\"\n{}export ISARTOR__EXTERNAL_LLM_MODEL=\"{}\"\nexport ISARTOR__EXTERNAL_LLM_API_KEY=\"{}\"\n",
+            provider_str,
+            default_chat_completions_url(&provider)
+                .map(|url| format!("export ISARTOR__EXTERNAL_LLM_URL=\"{}\"\n", url))
+                .unwrap_or_default(),
+            model,
+            api_key
         );
 
         if args.dry_run {
@@ -176,6 +181,9 @@ pub async fn handle_set_key(args: SetKeyArgs) -> Result<()> {
         .with_context(|| format!("Failed to parse {}", config_path.display()))?;
 
     doc["llm_provider"] = toml_edit::value(provider_str);
+    if let Some(url) = default_chat_completions_url(&provider) {
+        doc["external_llm_url"] = toml_edit::value(url);
+    }
     doc["external_llm_model"] = toml_edit::value(model.as_str());
     doc["external_llm_api_key"] = toml_edit::value(api_key.as_str());
 
@@ -288,6 +296,10 @@ mod tests {
 
         let content = std::fs::read_to_string(&tmp).unwrap();
         assert!(content.contains("llm_provider = \"groq\""));
+        assert!(
+            content
+                .contains("external_llm_url = \"https://api.groq.com/openai/v1/chat/completions\"")
+        );
         assert!(content.contains("external_llm_model = \"llama-3.1-8b-instant\""));
         assert!(content.contains("external_llm_api_key = \"gsk_testkey12345678\""));
 

src/cli/set_key.rs

@@ -96,6 +96,26 @@ impl std::fmt::Display for LlmProvider {
     }
 }
 
+pub const DEFAULT_OPENAI_CHAT_COMPLETIONS_URL: &str = "https://api.openai.com/v1/chat/completions";
+
+pub fn default_chat_completions_url(provider: &LlmProvider) -> Option<&'static str> {
+    match provider {
+        LlmProvider::Openai => Some(DEFAULT_OPENAI_CHAT_COMPLETIONS_URL),
+        LlmProvider::Copilot => Some("https://api.githubcopilot.com/chat/completions"),
+        LlmProvider::Xai => Some("https://api.x.ai/v1/chat/completions"),
+        LlmProvider::Mistral => Some("https://api.mistral.ai/v1/chat/completions"),
+        LlmProvider::Groq => Some("https://api.groq.com/openai/v1/chat/completions"),
+        LlmProvider::Deepseek => Some("https://api.deepseek.com/chat/completions"),
+        LlmProvider::Galadriel => Some("https://api.galadriel.com/v1/chat/completions"),
+        LlmProvider::Hyperbolic => Some("https://api.hyperbolic.xyz/v1/chat/completions"),
+        LlmProvider::Moonshot => Some("https://api.moonshot.cn/v1/chat/completions"),
+        LlmProvider::Openrouter => Some("https://openrouter.ai/api/v1/chat/completions"),
+        LlmProvider::Perplexity => Some("https://api.perplexity.ai/chat/completions"),
+        LlmProvider::Together => Some("https://api.together.xyz/v1/chat/completions"),
+        _ => None,
+    }
+}
+
 impl From<&str> for LlmProvider {
     fn from(s: &str) -> Self {
         match s.to_lowercase().as_str() {
@@ -445,10 +465,7 @@ impl AppConfig {
             .set_default("embedding_sidecar.timeout_seconds", 10_i64)?
             // Layer 3
             .set_default("llm_provider", "openai")?
-            .set_default(
-                "external_llm_url",
-                "https://api.openai.com/v1/chat/completions",
-            )?
+            .set_default("external_llm_url", DEFAULT_OPENAI_CHAT_COMPLETIONS_URL)?
             .set_default("external_llm_model", "gpt-4o-mini")?
             .set_default("external_llm_api_key", "")?
             .set_default("l3_timeout_secs", 120_i64)?

src/config.rs

@@ -17,7 +17,9 @@ use tokio_stream::wrappers::IntervalStream;
 use tracing::{Instrument, info_span};
 
 use crate::anthropic_sse;
-use crate::config::LlmProvider;
+use crate::config::{
+    DEFAULT_OPENAI_CHAT_COMPLETIONS_URL, LlmProvider, default_chat_completions_url,
+};
 use crate::core::cache_scope::{
     build_exact_cache_key, extract_session_cache_scope, namespaced_semantic_cache_input,
 };
@@ -98,7 +100,17 @@ fn provider_chat_completions_url(state: &AppState) -> Option<String> {
             state.config.external_llm_url.clone()
         }),
         provider if supports_openai_passthrough(provider) => {
-            Some(state.config.external_llm_url.clone())
+            let configured_url = state.config.external_llm_url.trim();
+            let default_url = default_chat_completions_url(provider)?;
+
+            if configured_url.is_empty()
+                || (*provider != LlmProvider::Openai
+                    && configured_url == DEFAULT_OPENAI_CHAT_COMPLETIONS_URL)
+            {
+                Some(default_url.to_string())
+            } else {
+                Some(configured_url.to_string())
+            }
         }
         _ => None,
     }
@@ -1772,6 +1784,32 @@ mod tests {
         );
     }
 
+    #[test]
+    fn groq_passthrough_uses_groq_default_when_config_still_points_to_openai() {
+        let state = test_state(Arc::new(SuccessAgent));
+        let mut config = (*state.config).clone();
+        config.llm_provider = LlmProvider::Groq;
+        config.external_llm_url = DEFAULT_OPENAI_CHAT_COMPLETIONS_URL.into();
+
+        let state = Arc::new(AppState {
+            http_client: reqwest::Client::new(),
+            exact_cache: state.exact_cache.clone(),
+            vector_cache: state.vector_cache.clone(),
+            llm_agent: Arc::new(SuccessAgent),
+            slm_client: state.slm_client.clone(),
+            text_embedder: state.text_embedder.clone(),
+            instruction_cache: Arc::new(InstructionCache::new()),
+            config: Arc::new(config),
+            #[cfg(feature = "embedded-inference")]
+            embedded_classifier: None,
+        });
+
+        assert_eq!(
+            provider_chat_completions_url(&state).as_deref(),
+            Some("https://api.groq.com/openai/v1/chat/completions")
+        );
+    }
+
     #[tokio::test]
     async fn openai_models_returns_configured_l3_model_list() {
         let state = test_state(Arc::new(SuccessAgent));