Commit 982a3329a for llama.cpp

commit 982a3329af8401772087d67c54d5948a5b270943
Author: Nandan Vallamdasu <nandan.vallamdasu@outlook.com>
Date:   Mon Sep 21 16:15:58 2026 +0530

    server : do not forward --api-key-file to router-spawned child instances (#28938)

    In router mode, authentication belongs to the router. unset_reserved_args()
    already unset LLAMA_API_KEY, but did not unset LLAMA_ARG_API_KEY_FILE.
    When --api-key-file was passed, children re-validated against file keys only,
    causing clients using --api-key to 401 on chat completions (#28820).
    In addition, router internal calls without auth headers (such as
    POST /v1/streams/lookup and DELETE /v1/stream) were silently rejected with 401.

    Unset LLAMA_ARG_API_KEY_FILE in unset_reserved_args() so no API keys reach
    child instances. This keeps keys out of child argv, ensures all keys the router
    accepts work end-to-end, and prevents router internal stream calls from 401ing.

    Fixes #28820

diff --git a/tools/server/server-models.cpp b/tools/server/server-models.cpp
index b10d9bd8a..9c00036e0 100644
--- a/tools/server/server-models.cpp
+++ b/tools/server/server-models.cpp
@@ -470,6 +470,7 @@ static void unset_reserved_args(common_preset & preset, bool unset_model_args) {
     preset.unset_option("LLAMA_ARG_SSL_KEY_FILE");
     preset.unset_option("LLAMA_ARG_SSL_CERT_FILE");
     preset.unset_option("LLAMA_API_KEY");
+    preset.unset_option("LLAMA_ARG_API_KEY_FILE");
     preset.unset_option("LLAMA_ARG_MODELS_DIR");
     preset.unset_option("LLAMA_ARG_MODELS_MAX");
     preset.unset_option("LLAMA_ARG_MODELS_PRESET");