fix(auth): honor per-entry key_env when resolving fallback providers (salvage #43861) - #65682
Conversation
A fallback chain entry can name its API key via key_env (or the api_key_env alias) per the fallback-providers docs, but only the gateway path resolved it — TUI/desktop, cron, and CLI setup fallbacks ignored it, so a fallback provider whose key lives in a non-standard env var never resolved on those surfaces. Centralize the inline-api_key-then-key_env lookup in hermes_cli/fallback_config.resolve_entry_api_key() and use it at all four fallback resolution sites (tui_gateway, cron scheduler, gateway runner, CLI setup mixin); the CLI mixin also gains the base_url passthrough the other surfaces already had. Salvaged from PR #43861 (surgical reapply — the original branch predates the #65264 fallback restructuring).
alt-glitch
added
type/bug
tonydwb
left a comment
tonydwb
left a comment
There was a problem hiding this comment.
Code Review Summary
Verdict: Comment
Overview
- Auth fix: honor per-entry key_env when resolving fallback providers
- 118 additions, 13 deletions
- Salvage of PR #43861
Assessment
- Per-entry key_env resolution is a good improvement for auth flexibility
- No obvious security concerns
- Clean diff
Reviewed by Hermes Agent
|
Man, thank you. This honestly means more to me than you probably realize. I opened that fix months ago after a lot of digging, testing, and trying to prove that I could contribute something real upstream. Seeing the original branch become impossible to cherry-pick, but the actual engineering survive the restructuring, get extracted, centralized, expanded across all four fallback surfaces, and still carry my authorship is about the best outcome I could have hoped for. I really appreciate you taking the time to trace the work, preserve the credit, and explain exactly what landed. I was never just chasing a green merge badge—I wanted to find and fix something that actually mattered. Knowing both halves made it into Hermes is a huge moment for me. Thank you. |
4 participants
Summary
A fallback chain entry that names its API key via
key_env(orapi_key_env) now resolves on every surface — previously only the gateway runner honored it, so a fallback provider whose key lives in a non-standard env var silently failed to resolve on TUI/desktop, cron, and CLI setup fallbacks.Salvages the remaining half of #43861 by @VrtxOmega (the provider/model fallback half was superseded by #65656). Surgical reapply with authorship credited — the original branch predates the #65264 fallback restructuring.
Changes
hermes_cli/fallback_config.py: newresolve_entry_api_key()— inlineapi_keyfirst, thenkey_env/api_key_envenv lookup, None otherwise (falls through to the provider's standard credential resolution)tui_gateway/server.py,cron/scheduler.py,hermes_cli/cli_agent_setup_mixin.py: use the shared helper (CLI mixin also gains thebase_urlpassthrough the other surfaces already had)gateway/run.py: inline copy replaced with the shared helper (behavior unchanged)resolve_runtime_providerValidation
565/565 targeted tests (
test_fallback_config,test_tui_gateway_server,test_scheduler); ruff clean.Closes #43861.
Infographic