fix(api_server): pop model from runtime_kwargs to prevent kwarg colli…

[LifeJiggy]

fix/agent-model-kwarg-collision → fixes #27540

fix(api_server): pop model from runtime_kwargs to prevent kwarg collision with explicit model=

When the primary provider auth fails (e.g. OAuth token exhausted), _try_resolve_fallback_provider() returns a dict that includes 'model'. _resolve_runtime_agent_kwargs() passes this through, and _create_agent() then passes both model=model and
**runtime_kwargs to AIAgent(), causing TypeError on the second turn of a session.

Mirrors the existing pattern in _resolve_session_agent_runtime() (gateway/run.py:1866) which already pops model from runtime_kwargs. Fixes #27540.

Related Issue
Fixes #27540

Type of Change

• 🐛 Bug fix

Changes Made

• gateway/platforms/api_server.py:880-884 — Added runtime_model = runtime_kwargs.pop("model", None) before passing kwargs to AIAgent(). When fallback provider injects "model" into runtime kwargs, it is popped out and used as the effective model instead of _resolve_gateway_model(), preventing the duplicate keyword argument crash.

How to Test

1. Configure a primary provider with limited OAuth pool (e.g., Anthropic OAuth)
2. Configure a fallback provider with a different model
3. Start a session and send 2 messages
4. Expected: second turn processes normally (not TypeError: multiple values for keyword argument 'model')

[alt-glitch]

Duplicate of #27678 which fixes the same #27540 (pop model from runtime_kwargs before AIAgent() in api_server.py). Both PRs apply the identical pattern.

[BoardJames-Bot]

BoardJames triage: no branch-local failing check found yet; Tests / test is still in progress and Tests / e2e plus the non-test checks are green. The PR diff is a one-line api_server.py runtime-kwargs/model collision fix. Local focused validation of the changed area is mixed only because current origin/main already has unrelated CORS default-test failures: HERMES_HOME=$(mktemp -d) python -m pytest tests/gateway/test_api_server.py::TestCORS -q --tb=short fails the same 4 CORS assertions on origin/main, so I’m not attributing those to this PR. Next action: wait for the GitHub Tests / test job; if it later cancels/times out, treat it as the same shared full-suite problem seen on neighboring PRs unless a new branch-specific traceback appears.