fix(auxiliary): inherit model.api_key for same-host custom endpoints when per-task key is empty - #59207
Merged
Merged
Conversation
…sk key is empty (#9318) When an auxiliary task is configured with provider=custom and an explicit base_url but an empty api_key, the custom_key fallback chain in resolve_provider_client() jumped straight to the no-key-required placeholder without consulting model.api_key from config.yaml. Users on self-hosted gateways who share the same endpoint and credentials for both the main model and auxiliary tasks got 401 auth errors. Add _read_main_api_key() following the same pattern as _read_main_model() and _read_main_provider(): checks _RUNTIME_MAIN_API_KEY (runtime override) first, then config.yaml model.api_key. Insert it into the fallback chain before no-key-required so real credentials are used when available, while local servers without auth still get the placeholder.
Follow-up to the #55911 salvage: inherit model.api_key only when the aux base_url resolves to the same hostname as the main model's base_url (runtime override or config). A misconfigured aux endpoint on a different host keeps the fail-safe no-key-required placeholder instead of leaking the main credential cross-host.
alt-glitch
added
type/bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auxiliary tasks configured with
provider: custom+ an explicitbase_urlbut an empty per-taskapi_keynow inherit the mainmodel.api_key— instead of sending theno-key-requiredplaceholder and 401ing on shared self-hosted gateways. Fixes #9318.Salvage of #55911 by @Tranquil-Flow, cherry-picked onto current main with authorship preserved, plus a hardening follow-up: inheritance is host-gated — the main key is only inherited when the aux base_url resolves to the same hostname as the main model's base_url (runtime override or config). A misconfigured aux endpoint on a different host keeps the previous fail-safe behavior instead of leaking the main credential cross-host.
Changes
agent/auxiliary_client.py:_read_main_api_key()(contributor — mirrors_read_main_model/_read_main_provider, runtime override → config);_read_main_base_url()+_read_main_api_key_if_same_host()(follow-up) wired into the custom-endpoint key fallback chain after explicit key andOPENAI_API_KEYtests/agent/test_auxiliary_client.py: contributor's 4 tests (adjusted for host gating) + 2 new negative tests (cross-host no-inherit, no-main-base_url no-inherit)Validation
no-key-required→ 401model.api_keyno-key-requiredno-key-required(unchanged — no leak)OPENAI_API_KEYno-key-requiredscripts/run_tests.sh tests/agent/test_auxiliary_client.py: 293/293 green. E2E with real imports + temp HERMES_HOME using the exact #9318 repro config: same-host inheritssk-my-real-key, cross-host staysno-key-required.Infographic