Skip to content

fix(agent-init): forward custom_headers on OpenAI-wire branch #28790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
shailensobhee wants to merge 1 commit into from
Closed

fix(agent-init): forward custom_headers on OpenAI-wire branch #28790

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions agent/agent_init.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -655,6 +655,38 @@ def init_agent(
client_kwargs["default_headers"] = dict(_ph.default_headers)
except Exception:
pass
# Resolve custom_headers from custom_providers config for
# gateway auth (e.g. subscription keys for API-management proxies).
# The anthropic_messages branch above does the same lookup; without
# this mirror block on the OpenAI-wire path, APIM-style gateways
# that require a subscription key (e.g. AMD LLM Gateway's
# Ocp-Apim-Subscription-Key) are silently rejected with HTTP 401
# because the only outbound auth header is the Bearer token the
# gateway doesn't recognise. Also forward `verify: false` for
# gateways behind self-signed certs.
if "default_headers" not in client_kwargs:
try:

@teknium1 teknium1 Jun 15, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because this lookup lives only in the explicit startup branch, resolver-built custom clients and credential-swap rebuilds can still drop the same gateway header. This should probably be a shared custom-provider header resolver used by init, fallback/resolver, auxiliary, and _apply_client_headers_for_base_url rather than a one-off block here.

from hermes_cli.config import load_config as _load_cp_cfg
_cp_cfg = _load_cp_cfg()

@teknium1 teknium1 Jun 15, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reading raw load_config()["custom_providers"] bypasses the repo's compatible custom-provider view, so any equivalent provider entry represented through the newer providers schema will be missed unless the normalization layer is extended to preserve these fields.

_cp_list = _cp_cfg.get("custom_providers", [])
if isinstance(_cp_list, list):
_my_base = (base_url or "").rstrip("/")
for _cp in _cp_list:
if not isinstance(_cp, dict):
continue
_cp_base = (_cp.get("base_url") or "").rstrip("/")
if (_cp_base and _my_base
and _cp_base.lower() == _my_base.lower()
and _cp.get("custom_headers")):
client_kwargs["default_headers"] = dict(
_cp["custom_headers"])
if _cp.get("verify") is False:
import httpx as _httpx_local
client_kwargs["http_client"] = (
_httpx_local.Client(verify=False))
break
except Exception:
pass
else:
# No explicit creds — use the centralized provider router
from agent.auxiliary_client import resolve_provider_client
Expand Down