fix(runtime): honor NOUS_INFERENCE_BASE_URL across pool/explicit/aux paths (salvage #55198) - #56122
Merged
Merged
Conversation
…paths Upstream #52270 added `_nous_inference_env_override()` but wired it into only `resolve_nous_runtime_credentials`. Three sibling resolution paths still ignored the override, so a self-hosted Nous inference endpoint set via `NOUS_INFERENCE_BASE_URL` was silently dropped whenever credentials arrived through any of them: - the credential-pool path (`_resolve_runtime_from_pool_entry`) - the explicit-provider path (`_resolve_explicit_runtime`) - the auxiliary side-LLM client (`_pool_runtime_base_url`) Route all three through the same auth-layer reader so every `NOUS_INFERENCE_BASE_URL` read shares one normalization path (trailing-slash stripping, blank -> empty) and the documented trusted-bypass intent stays in one place. The override is live-only: it wins for the base URL returned this run but is never persisted to auth.json or the credential pool, so an ephemeral dev/staging value cannot poison durable auth state. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
alt-glitch
added
type/bug
Contributor
Salvage of #55198 by @counterposition onto an org-owned branch (commit cherry-picked verbatim, authorship preserved) — exists so the arm64 Docker build gets a |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Salvage of #55198 by @counterposition (Harish Kukreja) onto an org-owned branch. His commit is cherry-picked verbatim (authorship preserved); this PR exists only so the arm64 Docker build gets a token with
packages: write.Why salvage instead of a re-run: #55198 is a fork PR (
counterposition/hermes-agent). ItsBuild&Test Docker image / build-arm64check fails withdenied: installation not allowed to Write organization package— fork PRs get a read-onlyGITHUB_TOKENfor org packages by design, so re-running the fork PR fails identically every time. Every other check on #55198 is green (all 8 test slices, e2e, ruff, ty, uv.lock). Running the same commit from an org branch clears the package-write permission.The fix (unchanged from #55198)
#52270 added
_nous_inference_env_override()soNOUS_INFERENCE_BASE_URLcan point a Nous OAuth session at a self-hosted / staging inference endpoint, but only wired it intoresolve_nous_runtime_credentials. Three sibling resolution paths still dropped the override:_resolve_runtime_from_pool_entry(hermes_cli/runtime_provider.py)_resolve_explicit_runtime(hermes_cli/runtime_provider.py)_pool_runtime_base_url(agent/auxiliary_client.py)This routes all three through the same auth-layer reader, so every
NOUS_INFERENCE_BASE_URLread shares one normalization + trusted-bypass path. Live-only invariant preserved: the override wins for the base URL returned this run but is never persisted toauth.jsonor the credential pool.Verification
Cherry-picked cleanly onto current
main(56d4bfe4b). PR's own suites re-run on the merged tree: 97 passed (tests/hermes_cli/test_runtime_provider_resolution.py,test_auth_nous_provider.py,tests/agent/test_auxiliary_client.py), including the pool/explicit/aux override tests and the live-not-persisted invariant.Attribution
Co-authored-by preserved from the original commit. Full credit to @counterposition — closing #55198 in favour of this once merged.
Salvages #55198.