Skip to content

fix: _allow_private_urls name collision + stale OPENAI_BASE_URL test #4217

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
teknium1 merged 1 commit into from
Mar 31, 2026
Merged

fix: _allow_private_urls name collision + stale OPENAI_BASE_URL test #4217

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion tests/test_provider_parity.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -559,11 +559,18 @@ def test_nous_when_no_openrouter(self, monkeypatch):
assert model == "google/gemini-3-flash-preview"

def test_custom_endpoint_when_no_nous(self, monkeypatch):
"""Custom endpoint is used when no OpenRouter/Nous keys are available.

Since the March 2026 config refactor, OPENAI_BASE_URL env var is no
longer consulted — base_url comes from config.yaml via
resolve_runtime_provider. Mock _resolve_custom_runtime directly.
"""
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
monkeypatch.setenv("OPENAI_BASE_URL", "http://localhost:1234/v1")
monkeypatch.setenv("OPENAI_API_KEY", "local-key")
from agent.auxiliary_client import get_text_auxiliary_client
with patch("agent.auxiliary_client._read_nous_auth", return_value=None), \
patch("agent.auxiliary_client._resolve_custom_runtime",
return_value=("http://localhost:1234/v1", "local-key")), \
patch("agent.auxiliary_client.OpenAI") as mock:
client, model = get_text_auxiliary_client()
assert mock.call_args.kwargs["base_url"] == "http://localhost:1234/v1"
Expand Down
12 changes: 6 additions & 6 deletions tools/browser_tool.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ def _get_cdp_override() -> str:
_cached_cloud_provider: Optional[CloudBrowserProvider] = None
_cloud_provider_resolved = False
_allow_private_urls_resolved = False
_allow_private_urls: Optional[bool] = None
_cached_allow_private_urls: Optional[bool] = None


def _get_cloud_provider() -> Optional[CloudBrowserProvider]:
Expand Down Expand Up @@ -273,23 +273,23 @@ def _allow_private_urls() -> bool:
Reads ``config["browser"]["allow_private_urls"]`` once and caches the result
for the process lifetime. Defaults to ``False`` (SSRF protection active).
"""
global _allow_private_urls, _allow_private_urls_resolved
global _cached_allow_private_urls, _allow_private_urls_resolved
if _allow_private_urls_resolved:
return _allow_private_urls
return _cached_allow_private_urls

_allow_private_urls_resolved = True
_allow_private_urls = False # safe default
_cached_allow_private_urls = False # safe default
try:
hermes_home = Path(os.environ.get("HERMES_HOME", Path.home() / ".hermes"))
config_path = hermes_home / "config.yaml"
if config_path.exists():
import yaml
with open(config_path) as f:
cfg = yaml.safe_load(f) or {}
_allow_private_urls = bool(cfg.get("browser", {}).get("allow_private_urls"))
_cached_allow_private_urls = bool(cfg.get("browser", {}).get("allow_private_urls"))
except Exception as e:
logger.debug("Could not read allow_private_urls from config: %s", e)
return _allow_private_urls
return _cached_allow_private_urls


def _socket_safe_tmpdir() -> str:
Expand Down
Loading