llama.cpp's router was forwarding --api-key-file to child servers and 401ing its own internal calls

GitHub·medium signalXBlueskyLinkedInCopy link

PR #28938 (merged 2026-09-21) fixes llama.cpp server router mode leaking authentication to spawned children: `unset_reserved_args()` already unset `LLAMA_API_KEY` but missed `LLAMA_ARG_API_KEY_FILE`, so children re-validated against file keys only and clients using `--api-key` got 401s on chat completions (issue #28820). Worse, the router's own internal calls — `POST /v1/streams/lookup` and `DELETE /v1/stream` — carry no auth headers and were being silently rejected. Unsetting the variable keeps all keys out of child argv, which is the right invariant: in router mode authentication belongs to the router, not the children.