fix(inference): narrow Hermes Provider host smoke skip

src/lib/inference/onboard-probes.test.ts

@@ -1,10 +1,10 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, expect, it } from "vitest";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { describe, expect, it } from "vitest";
 
 const {
   getChatCompletionsProbeCurlArgs,

src/lib/inference/onboard-probes.ts

@@ -834,16 +834,35 @@ module.exports = {
   RETRIABLE_HTTP_PROBE_STATUSES,
 };
 
-function shouldSmokeOpenAiLikeOnboardRoute(provider) {
+export function shouldSmokeOpenAiLikeOnboardRoute(provider: string, credentialEnv: string | null = null) {
+  const {
+    HERMES_INFERENCE_CREDENTIAL_ENV,
+    HERMES_PROVIDER_NAME,
+  } = require("../hermes-provider-auth");
+  // Hermes Provider OAuth mints a short-lived agent key and stores it with
+  // OpenShell provider storage. A host-side direct probe would resolve the
+  // ambient OPENAI_API_KEY instead, which can falsely fail after successful
+  // OAuth if the user's shell has a different OpenAI key staged. The Nous API
+  // key path still has a host credential and should keep the direct smoke.
+  // Remove this exception once the host smoke can resolve the actual Hermes
+  // OAuth agent key from OpenShell provider storage.
+  if (provider === HERMES_PROVIDER_NAME && credentialEnv === HERMES_INFERENCE_CREDENTIAL_ENV) {
+    return false;
+  }
   const { REMOTE_PROVIDER_CONFIG } = require("../onboard/providers");
   if (provider === "nvidia-nim" || provider === "nvidia-router") return true;
   return Object.values(REMOTE_PROVIDER_CONFIG).some(
     (entry) => entry.providerName === provider && entry.providerType === "openai",
   );
 }
 
-function verifyOnboardInferenceSmoke(options) {
-  if (!options.forceOpenAiLike && !shouldSmokeOpenAiLikeOnboardRoute(options.provider)) return;
+export function verifyOnboardInferenceSmoke(options: any) {
+  if (
+    !options.forceOpenAiLike &&
+    !shouldSmokeOpenAiLikeOnboardRoute(options.provider, options.credentialEnv)
+  ) {
+    return;
+  }
   if (process.env.VITEST === "true") return;
 
   const endpointUrl = options.endpointUrl || require("./config").INFERENCE_ROUTE_URL;

test/helpers/onboard-smoke-verifier-harness.ts

@@ -0,0 +1,109 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+export type SmokeVerifierHarnessCall = [string, ...unknown[]];
+
+type VerifyOnboardSmokeInvocation = {
+  credentialEnv?: string;
+  endpointUrl?: string;
+  forceOpenAiLike?: boolean;
+  model?: string;
+  provider?: string;
+};
+
+export function runVerifyOnboardSmokeHarness(
+  invocations: VerifyOnboardSmokeInvocation[],
+): SmokeVerifierHarnessCall[] {
+  const harness = String.raw`
+const Module = require("node:module");
+const originalLoad = Module._load;
+const calls = [];
+
+process.env.VITEST = "false";
+
+Module._load = function patchedLoad(request, _parent, _isMain) {
+  if (request === "../credentials/store") {
+    return {
+      getCredential(name) {
+        calls.push(["getCredential", name]);
+        return "stored-" + name;
+      },
+      normalizeCredentialValue(value) {
+        calls.push(["normalizeCredentialValue", value]);
+        return value;
+      },
+      resolveProviderCredential(name) {
+        calls.push(["resolveProviderCredential", name]);
+        return "resolved-" + name;
+      },
+    };
+  }
+  if (request === "../hermes-provider-auth") {
+    return {
+      HERMES_PROVIDER_NAME: "hermes-provider",
+      HERMES_INFERENCE_CREDENTIAL_ENV: "OPENAI_API_KEY",
+      HERMES_NOUS_API_KEY_CREDENTIAL_ENV: "NOUS_API_KEY",
+    };
+  }
+  if (request === "../adapters/http/probe") {
+    return {
+      getCurlTimingArgs() {
+        return [];
+      },
+      runChatCompletionsStreamingProbe() {
+        throw new Error("unexpected streaming probe");
+      },
+      runCurlProbe(args) {
+        const authHeader =
+          args.find((arg) => String(arg).startsWith("Authorization: Bearer ")) || "no-auth";
+        calls.push(["runCurlProbe", args[args.length - 1], authHeader]);
+        return {
+          ok: true,
+          httpStatus: 200,
+          curlStatus: 0,
+          message: "OK",
+          body: '{"choices":[{"message":{"content":"OK"}}]}',
+        };
+      },
+      runStreamingEventProbe() {
+        throw new Error("unexpected streaming event probe");
+      },
+    };
+  }
+  return originalLoad.apply(this, arguments);
+};
+
+const { verifyOnboardInferenceSmoke } = require(process.env.PROBES_MODULE);
+const invocations = JSON.parse(process.env.SMOKE_INVOCATIONS || "[]");
+console.log = (...args) => calls.push(["log", args.join(" ")]);
+
+for (const invocation of invocations) {
+  verifyOnboardInferenceSmoke({
+    endpointUrl: "https://api.example.com/v1",
+    model: "nous/test-model",
+    provider: "hermes-provider",
+    ...invocation,
+  });
+}
+
+process.stdout.write(JSON.stringify(calls));
+`;
+  const result = spawnSync(process.execPath, ["-e", harness], {
+    cwd: process.cwd(),
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PROBES_MODULE: path.join(process.cwd(), "dist/lib/inference/onboard-probes.js"),
+      SMOKE_INVOCATIONS: JSON.stringify(invocations),
+      VITEST: "false",
+    },
+  });
+
+  if (result.status !== 0) {
+    throw new Error(result.stderr || result.stdout || "smoke verifier harness failed");
+  }
+  return JSON.parse(result.stdout) as SmokeVerifierHarnessCall[];
+}

test/onboard-smoke-verifier.test.ts

@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+import { shouldSmokeOpenAiLikeOnboardRoute } from "../dist/lib/inference/onboard-probes";
+import { runVerifyOnboardSmokeHarness } from "./helpers/onboard-smoke-verifier-harness";
+
+describe("Hermes onboard smoke verification", () => {
+  it("does not host-smoke Hermes Provider with the ambient OPENAI_API_KEY", () => {
+    expect(shouldSmokeOpenAiLikeOnboardRoute("hermes-provider", "OPENAI_API_KEY")).toBe(false);
+    expect(shouldSmokeOpenAiLikeOnboardRoute("hermes-provider", "NOUS_API_KEY")).toBe(true);
+    expect(shouldSmokeOpenAiLikeOnboardRoute("openai-api")).toBe(true);
+  });
+
+  it("skips only the Hermes OAuth smoke path in the runtime verifier", () => {
+    const calls = runVerifyOnboardSmokeHarness([
+      { credentialEnv: "OPENAI_API_KEY" },
+      { credentialEnv: "NOUS_API_KEY" },
+      { credentialEnv: "OPENAI_API_KEY", forceOpenAiLike: true },
+    ]);
+    expect(
+      calls.filter((call) =>
+        ["resolveProviderCredential", "getCredential", "runCurlProbe"].includes(call[0]),
+      ),
+    ).toEqual([
+      ["resolveProviderCredential", "NOUS_API_KEY"],
+      [
+        "runCurlProbe",
+        "https://api.example.com/v1/chat/completions",
+        "Authorization: Bearer resolved-NOUS_API_KEY",
+      ],
+      ["resolveProviderCredential", "OPENAI_API_KEY"],
+      [
+        "runCurlProbe",
+        "https://api.example.com/v1/chat/completions",
+        "Authorization: Bearer resolved-OPENAI_API_KEY",
+      ],
+    ]);
+  });
+});