fix(diagnostics): show masked API key and correct URL in request dumps for anthropic_messages mode by liuhao1024 · Pull Request #55552 · NousResearch/hermes-agent

liuhao1024 · 2026-06-30T09:29:33Z

What does this PR do?

Fixes the request debug dump (request_dump_*.json) for Anthropic-mode providers (MiniMax, Kimi, etc.) where agent.client is None. The dump previously read api_key from agent.client (which is None for anthropic_messages mode), producing "Bearer None" in the Authorization header of the dump — even though the actual HTTP request used the correct key via agent._anthropic_client. The dump also showed the wrong URL (/chat/completions instead of /v1/messages).

Related Issue

Fixes #55539

Type of Change

🐛 Bug fix (non-breaking change that fixes an issue)
✨ New feature (non-breaking change that adds functionality)
🔒 Security fix
📝 Documentation update
✅ Tests (adding or improving test coverage)
♻️ Refactor (no behavior change)
🎯 New skill (bundled or hub)

Changes Made

agent/agent_runtime_helpers.py: In dump_api_request_debug(), fall back to agent.api_key when agent.client is None (Anthropic mode). Also build the dump URL based on api_mode: /v1/messages for anthropic_messages, /responses for codex_responses, /chat/completions otherwise.
tests/run_agent/test_run_agent_codex_responses.py: Add two tests verifying the dump shows a masked key (not "None") and the correct /v1/messages URL for anthropic_messages mode.

How to Test

Run: python -m pytest tests/run_agent/test_run_agent_codex_responses.py::test_dump_api_request_debug_anthropic_mode_shows_masked_key tests/run_agent/test_run_agent_codex_responses.py::test_dump_api_request_debug_anthropic_mode_shows_messages_url -xvs
Both tests should pass — the dump shows a masked key (e.g. Bearer sk-cp-ab...6789) and the URL https://api.minimaxi.com/anthropic/v1/messages.
Run existing dump tests to verify no regression: python -m pytest tests/run_agent/test_run_agent_codex_responses.py -k "dump_api_request" -xvs — all 5 should pass.

Checklist

Code

I've read the Contributing Guide
My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
I searched for existing PRs to make sure this isn't a duplicate
My PR contains only changes related to this fix/feature (no unrelated commits)
I've run pytest tests/ -q and all tests pass
I've added tests for my changes (required for bug fixes, strongly encouraged for features)
I've tested on my platform: macOS 26.4.1

Documentation & Housekeeping

I've updated relevant documentation (README, docs/, docstrings) — or N/A
I've updated cli-config.yaml.example if I added/changed config keys — or N/A
I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
I've considered cross-platform impact (Windows, macOS) per the compatibility guide — N/A (dump logic is platform-independent)
I've updated tool descriptions/schemas if I changed tool behavior — or N/A

…s for anthropic_messages mode For Anthropic-mode providers (MiniMax, Kimi, etc.), agent.client is None — the real client lives in agent._anthropic_client. The dump code read from agent.client.api_key, producing 'Bearer None' in the debug dump even though the actual HTTP request used the correct key. Also fix the dump URL: Anthropic SDK posts to /v1/messages, not /chat/completions. Fixes NousResearch#55539

alt-glitch · 2026-06-30T09:37:02Z

This was generated by AI during triage.

Related: open PR #54221 ("fix(debug): show correct URL and API key in request dumps for all api_modes") fixes the same misleading request_dump_*.json output but covers all api_modes (including bedrock_converse//converse). This PR is the narrower anthropic_messages-focused version. Flagging the overlap so a maintainer can pick the canonical one.

tonydwb

Code Review Summary

Verdict: Approved

Clean diagnostics fix (2 files, +88 lines). Two issues addressed:

Anthropic-mode providers store the client in agent._anthropic_client with agent.client = None, causing debug dumps to show Bearer None. Falls back to agent.api_key.
URL construction for anthropic_messages mode was missing the /v1/messages path.

Both fixes include dedicated tests that verify the masked key and correct URL.

Looks Good

Correct fallback chain for API key extraction
URL construction now handles all three API modes (chat_completions, codex_responses, anthropic_messages)
Tests verify both the masked key and the URL for anthropic mode
No security concerns (keys are masked in dumps)

Reviewed by Hermes Agent

tonydwb

Code Review Summary

Verdict: Approved

Good fix for API request debug dumps showing Bearer None for Anthropic-mode providers. The fallback to agent.api_key when agent.client is None (Anthropic mode) is correct. Also fixes the dump URL to use /v1/messages for Anthropic mode instead of always using /chat/completions.

Looks Good

Correct fallback chain: client.api_key -> agent.api_key
URL normalization matches the actual outbound endpoint per api_mode
Good test coverage for both the masked key and correct URL
Minimal surface area (2 files, 88 additions)

Reviewed by Hermes Agent

teknium1

Thanks for isolating the request-dump defect; current main still reads agent.client.api_key at agent/agent_runtime_helpers.py:1443-1457 even though Anthropic initialization sets agent.client = None at agent/agent_init.py:817-832.

Problems

The new agent.api_key fallback can be stale after native Anthropic refresh. run_agent.py:4406-4416 rebuilds with new_token and updates only _anthropic_api_key.
Appending /v1/messages to agent.base_url can produce /v1/v1/messages: agent/anthropic_adapter.py:757-760 strips /v1 for the live SDK client, while native configured URLs are retained in hermes_cli/runtime_provider.py:435-443.

Suggested changes

Prefer _anthropic_api_key for anthropic_messages, then fall back to api_key, with a refreshed-token regression test.
Normalize a trailing /v1 before constructing the diagnostic Messages URL and test that configured form.

This is an automated hermes-sweeper review.

teknium1 · 2026-07-15T10:28:45Z

+        # Fall back to ``agent.api_key`` (set by init_agent for all modes)
+        # so the dump shows a masked key instead of ``Bearer None``.
+        if not api_key:
+            api_key = getattr(agent, "api_key", None)


For anthropic_messages, prefer agent._anthropic_api_key before agent.api_key: native credential refresh rebuilds the live client and updates only _anthropic_api_key (run_agent.py:4406-4416), so this fallback can mask a stale rather than active credential.

teknium1 · 2026-07-15T10:28:45Z

+        # stripped by the normalizer); Codex uses ``/responses``.
+        if agent.api_mode == "anthropic_messages":
+            _dump_url = f"{agent.base_url.rstrip('/')}/v1/messages"
+        elif agent.api_mode == "codex_responses":


Normalize a trailing /v1 before appending /v1/messages. The live Anthropic adapter strips that suffix (agent/anthropic_adapter.py:757-760), so a valid configured https://api.anthropic.com/v1 would otherwise be dumped as /v1/v1/messages.

alt-glitch added type/bug Something isn't working comp/agent Core agent runtime: loop, agent_init, prompt builder, context-compression, responses endpoint P3 Low — cosmetic, nice to have labels Jun 30, 2026

tonydwb reviewed Jun 30, 2026

View reviewed changes

alt-glitch mentioned this pull request Jun 30, 2026

fix(auth): add config.yaml model.api_key fallback for API-key providers #55587

Open

tonydwb reviewed Jun 30, 2026

View reviewed changes

teknium1 reviewed Jul 15, 2026

View reviewed changes

teknium1 added sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data sweeper:blast-contained Sweeper blast radius: contained — one narrow path / opt-in / few users labels Jul 15, 2026

frizikk mentioned this pull request Jul 21, 2026

custom_providers + api_mode: anthropic_messages silently routes to /v1/chat/completions instead of /v1/messages — usage.input_tokens always 0 #68159

Closed

Navigation Menu

Uh oh!

fix(diagnostics): show masked API key and correct URL in request dumps for anthropic_messages mode - #55552

fix(diagnostics): show masked API key and correct URL in request dumps for anthropic_messages mode#55552
liuhao1024 wants to merge 1 commit into
NousResearch:mainfrom
liuhao1024:liuhao/cron-bugfix-55539-dump-api-key-anthropic-mode

liuhao1024 commented Jun 30, 2026

Uh oh!

alt-glitch commented Jun 30, 2026

Uh oh!

tonydwb left a comment

Uh oh!

tonydwb left a comment

Uh oh!

teknium1 left a comment

Uh oh!

teknium1 Jul 15, 2026

Uh oh!

teknium1 Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

liuhao1024 commented Jun 30, 2026

What does this PR do?

Related Issue

Type of Change

Changes Made

How to Test

Checklist

Code

Documentation & Housekeeping

Uh oh!

alt-glitch commented Jun 30, 2026

Uh oh!

tonydwb left a comment

Choose a reason for hiding this comment

Code Review Summary

Looks Good

Uh oh!

tonydwb left a comment

Choose a reason for hiding this comment

Code Review Summary

Looks Good

Uh oh!

teknium1 left a comment

Choose a reason for hiding this comment

Problems

Suggested changes

Uh oh!

teknium1 Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

teknium1 Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants