Skip to content

fix(auxiliary): use post-override base_url for endpoint detection - #36757

Open
wqz666 wants to merge 1 commit into
NousResearch:mainfrom
wqz666:fix/auxiliary-base-url-override-detection
Open

fix(auxiliary): use post-override base_url for endpoint detection#36757
wqz666 wants to merge 1 commit into
NousResearch:mainfrom
wqz666:fix/auxiliary-base-url-override-detection

Conversation

@wqz666

@wqz666 wqz666 commented Jun 1, 2026

Copy link
Copy Markdown

Summary

resolve_provider_client() in agent/auxiliary_client.py used the raw provider-registry base_url when deciding whether to wrap the client as Anthropic-compatible. When a user overrode the base_url to an OpenAI-compatible endpoint (e.g. via custom_providers or a non-Anthropic proxy), the detector still saw the registry's hard-coded /anthropic suffix and forced the request through the Anthropic SDK, which then hit the real Anthropic endpoint with the user's key and returned 401 invalid api key.

Fix: use the post-override base_url for endpoint-speak detection, so the wrapping decision follows the URL the request will actually hit. api_mode='anthropic_messages' remains an explicit opt-in.

Reproduction

MiniMax auxiliary tasks (title_generation, context_summary, memory_writer, etc.) returned:

⚠ Auxiliary title generation failed: HTTP 401: invalid api key (2049)

Root cause: the provider registry hard-codes minimax -> https://api.minimax.io/anthropic. Even when the user supplied their own base_url pointing to a different provider, the detector saw the registry's /anthropic suffix and forced the request through AnthropicAuxiliaryClient.

Changes

  • agent/auxiliary_client.py — use post-override base_url in _wrap_if_needed / _endpoint_speaks_anthropic_messages (1 line: raw_base_url -> base_url).
  • tests/agent/test_auxiliary_url_override_anthropic_detect.py — new regression test, 3 cases:
    1. user-override to non-Anthropic URL keeps OpenAI client (the bug)
    2. explicit api_mode=anthropic_messages still routes to Anthropic
    3. OpenAI path normalises /anthropic suffix to /v1

Verification

  • uv run pytest tests/agent/test_auxiliary_url_override_anthropic_detect.py -v -> 3/3 pass
  • uv run pytest tests/agent/test_auxiliary_named_custom_providers.py -v -> 29/29 pass
  • Pre-existing 12 failures in the full tests/agent/ suite were verified to be a test-isolation bug unrelated to this change (azure_foundry pollutes named_custom state; reproducing on stashed working tree confirmed it pre-dates this commit).

Test plan for reviewers

# 1. New regression test
uv run pytest tests/agent/test_auxiliary_url_override_anthropic_detect.py -v

# 2. Related test groups
uv run pytest tests/agent/test_auxiliary_named_custom_providers.py -v
uv run pytest tests/agent/test_auxiliary_client_azure_foundry.py -v

Workaround for affected users (pre-merge)

Add api_mode: chat_completions to the relevant provider block in ~/.hermes/config.yaml. This is a band-aid; the source fix is the proper resolution.

@wqz666
fix(auxiliary): use post-override base_url for endpoint detection
dbb4349 
resolve_provider_client() in agent/auxiliary_client.py used the raw
provider-registry base_url when deciding whether to wrap the client as
Anthropic-compatible. When a user overrode the base_url to an OpenAI-
compatible endpoint (e.g. via custom_providers or a non-Anthropic
proxy), the detector still saw the registry's hard-coded '/anthropic'
suffix and forced the request through the Anthropic SDK, which then
hit the real Anthropic endpoint with the user's key and returned 401.

Fix: use the post-override base_url for endpoint-speak detection so
the wrapping decision follows the URL the request will actually hit.
api_mode='anthropic_messages' remains an explicit opt-in.

Regression test: tests/agent/test_auxiliary_url_override_anthropic_detect.py
covers three scenarios:
  1. user-override to non-Anthropic URL keeps OpenAI client (the bug)
  2. explicit api_mode=anthropic_messages still routes to Anthropic
  3. OpenAI path normalises '/anthropic' suffix to '/v1'

Reproducer: MiniMax auxiliary tasks (title generation, memory
writer) returned 'HTTP 401: invalid api key (2049)' because the
registry's anthropic-suffixed URL was preferred over the user's
override.
@dsameer0-code

dsameer0-code commented Jun 1, 2026 via email

Copy link
Copy Markdown

@dsameer0-code

dsameer0-code commented Jun 1, 2026 via email

Copy link
Copy Markdown

@alt-glitch alt-glitch added type/bug Something isn't working P3 Low — cosmetic, nice to have comp/agent Core agent runtime: loop, agent_init, prompt builder, context-compression, responses endpoint labels Jun 1, 2026
mxnstrexgl
mxnstrexgl approved these changes Jun 1, 2026
View reviewed changes

@mxnstrexgl mxnstrexgl left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Automated PR Review

Security Scan

  • ✓ No hardcoded secrets, injection sinks, unsafe deserialization, or dependency red flags found by this automated scan.

Code Quality

  • ✓ No blocking code-quality issues found by this automated scan.

Summary

Status: APPROVE — security findings: 0, quality suggestions: 0.

Automated review; raw diff content intentionally omitted.

@alt-glitch alt-glitch mentioned this pull request Jul 10, 2026
Closed
@teknium1

teknium1 commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Thanks for isolating a real override mismatch. The proposed replacement needs one adjustment before it is safe to salvage.

Problems

  • The changed _wrap_if_needed(..., base_url, ...) call would regress the ordinary MiniMax API-key route. Current agent/auxiliary_client.py:4905-4911 normalizes /anthropic to /v1 only for the OpenAI client; agent/auxiliary_client.py:4976 deliberately passes raw_base_url to transport detection. That behavior was introduced by 4e296dcdda9dcc7b722961dc0a312684bc029d2f (fix(auxiliary): pass raw base_url to _maybe_wrap_anthropic for correct transport detection #17467) to prevent MiniMax/Kimi auxiliary calls from losing Anthropic Messages wrapping and returning 404s.

Suggested changes

  • Track a raw post-override transport URL separately: use explicit_base_url when present, otherwise the registry/credential raw_base_url; normalize it for client construction, but pass the raw transport URL to _wrap_if_needed.
  • Preserve /anthropic auto-detection in the tests, including the normal MiniMax default; only a non-Anthropic explicit override should avoid the wrapper.

Automated hermes-sweeper review.

@teknium1 teknium1 added sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform labels Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@mxnstrexgl mxnstrexgl mxnstrexgl approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

comp/agent Core agent runtime: loop, agent_init, prompt builder, context-compression, responses endpoint P3 Low — cosmetic, nice to have sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data type/bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@wqz666 @dsameer0-code @teknium1 @mxnstrexgl @alt-glitch