fix(moa): route native anthropic OAuth references through provider branch - #54609
Closed
jackroofan wants to merge 1 commit into
Closed
fix(moa): route native anthropic OAuth references through provider branch#54609jackroofan wants to merge 1 commit into
jackroofan wants to merge 1 commit into
Conversation
…anch MoA's _slot_runtime() whitelists providers that must keep their provider identity (so call_llm runs their provider branch) instead of being treated as a plain custom endpoint via forwarded base_url/api_key. Native anthropic was missing from this set. Native anthropic subscription OAuth setup-tokens (sk-ant-oat*) require Bearer auth plus the 'anthropic-beta: oauth-*' header, which only the anthropic provider branch adds. Without the whitelist entry, the slot's base_url/api_key were forwarded and call_llm sent the OAuth token as x-api-key, which Anthropic rejects with a bare 429 (rate_limit_error with no quota details). This made anthropic references in MoA presets fail every time. Add 'anthropic' to the whitelist so native anthropic reference/aggregator slots route through the provider branch. Extends upstream 9229d0d which added 'nous' for the same reason.
alt-glitch
added
type/bug
teknium1
added a commit
that referenced
this pull request
Jul 1, 2026
teknium1
added a commit
that referenced
this pull request
Jul 1, 2026
…e-preserve #54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
teknium1
added a commit
that referenced
this pull request
Jul 1, 2026
teknium1
added a commit
that referenced
this pull request
Jul 1, 2026
…e-preserve #54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
Contributor
|
Merged via #55897 — your commit was cherry-picked onto current Your root-cause analysis was the sharpest of the anthropic-fix PRs: |
This was referenced Jul 1, 2026
teknium1
added a commit
that referenced
this pull request
Jul 1, 2026
…okepoint (#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (#54609) and bedrock (#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
dtera
pushed a commit
to dtera/hermes-agent
that referenced
this pull request
Jul 1, 2026
dtera
pushed a commit
to dtera/hermes-agent
that referenced
this pull request
Jul 1, 2026
…e-preserve NousResearch#54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
dtera
pushed a commit
to dtera/hermes-agent
that referenced
this pull request
Jul 1, 2026
…okepoint (NousResearch#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (NousResearch#54609) and bedrock (NousResearch#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
Jul 2, 2026
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
Jul 2, 2026
…e-preserve NousResearch#54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
Jul 2, 2026
…okepoint (NousResearch#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (NousResearch#54609) and bedrock (NousResearch#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
Jasper6439
pushed a commit
to Jasper6439/hermes-agent
that referenced
this pull request
Jul 5, 2026
Jasper6439
pushed a commit
to Jasper6439/hermes-agent
that referenced
this pull request
Jul 5, 2026
…e-preserve NousResearch#54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
Jasper6439
pushed a commit
to Jasper6439/hermes-agent
that referenced
this pull request
Jul 5, 2026
…okepoint (NousResearch#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (NousResearch#54609) and bedrock (NousResearch#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
habarmc1223-sudo
pushed a commit
to habarmc1223-sudo/hermes-agent-fluxmem
that referenced
this pull request
Jul 8, 2026
habarmc1223-sudo
pushed a commit
to habarmc1223-sudo/hermes-agent-fluxmem
that referenced
this pull request
Jul 8, 2026
…e-preserve NousResearch#54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
habarmc1223-sudo
pushed a commit
to habarmc1223-sudo/hermes-agent-fluxmem
that referenced
this pull request
Jul 8, 2026
…okepoint (NousResearch#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (NousResearch#54609) and bedrock (NousResearch#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
…e-preserve NousResearch#54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
…okepoint (NousResearch#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (NousResearch#54609) and bedrock (NousResearch#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
…e-preserve NousResearch#54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
…okepoint (NousResearch#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (NousResearch#54609) and bedrock (NousResearch#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
…e-preserve NousResearch#54609 moves anthropic into the _slot_runtime name-preservation set (it must NOT forward base_url/api_key — OAuth sk-ant-oat* needs the provider branch's Bearer + anthropic-beta header). The pre-existing parametrized test_moa_provider_backed_slot_survives_aux_resolution still listed anthropic asserting the forward path, contradicting the new behavior. anthropic is now covered by test_slot_runtime_anthropic_oauth_routes_through_provider_branch; drop it from the forward-path parametrize (minimax-oauth/qwen-oauth remain).
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
…okepoint (NousResearch#55991) _slot_runtime maintained a hand-listed name-preservation set ({nous, anthropic, openai-codex, xai-oauth, bedrock}) that returned bare provider+model to avoid call_llm collapsing an explicit base_url to the generic 'custom' route. That duplicated _resolve_task_provider_model's _preserve_provider_with_base_url guard (a provider-catalog capability check) and had to be extended by hand for every provider with custom auth/signing — the exact drift that produced the anthropic (NousResearch#54609) and bedrock (NousResearch#54912) 429/ empty-response bugs. Removes the whitelist: _slot_runtime now forwards the resolved base_url/api_key/ api_mode for every slot, and the single chokepoint (_resolve_task_provider_model -> _preserve_provider_with_base_url) decides identity preservation. Behavior is unchanged for the five providers — their provider branches (codex Responses+Cloudflare, xai-oauth, bedrock SigV4, anthropic OAuth Bearer+anthropic-beta, nous Portal tags) re-resolve their own credentials by name and ignore a forwarded base_url/api_key, so forwarding is safe even for bedrock's placeholder 'aws-sdk' key. Verified via real-import E2E: _slot_runtime -> _resolve_task_provider_model preserves openai-codex/xai-oauth/bedrock/anthropic/nous (+openrouter control) — none collapse to custom. Tests updated to assert the pipeline invariant against the real resolver instead of the removed whitelist's bare-return shape.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Native
anthropicreference/aggregator slots in a MoA preset fail every time with a bare 429 (rate_limit_error, no quota details), even when the Anthropic account is well under quota.Root cause
agent/moa_loop.py's_slot_runtime()whitelists providers that must keep their provider identity — socall_llmruns their provider branch — instead of being treated as a plain custom endpoint via forwardedbase_url/api_key. Nativeanthropicwas missing from this set.Anthropic subscription OAuth setup-tokens (
sk-ant-oat*) require Bearer auth plus theanthropic-beta: oauth-*header, which only the anthropic provider branch adds. Without the whitelist entry, the slot'sbase_url/api_keywere forwarded andcall_llmsent the OAuth token asx-api-key, which Anthropic rejects with a bare 429.Fix
Add
"anthropic"to the whitelist so native anthropic slots route through the provider branch. One-line change, mirroring upstream9229d0db1which added"nous"for the same reason.Testing
test_slot_runtime_anthropic_oauth_routes_through_provider_branch: asserts anthropic slots return only provider/model (no base_url/api_key), while a non-whitelisted provider (openrouter) still forwards them.pytest tests/run_agent/test_moa_loop_mode.py-> 18 passed.