fix(auxiliary): resolve key_env in _resolve_task_provider_model (#66641)

[webtecnica]

Summary

_resolve_task_provider_model() read api_key from the auxiliary task config but never consulted key_env (or api_key_env). When a user configured an auxiliary task with key_env instead of a plaintext api_key, the resolved API key was None, causing 401 on every call.

Root cause: cfg_api_key was only read from task_config.get("api_key", ""). The key_env → os.getenv() resolution pattern already existed in two other places in the same file (_fallback_entry_api_key() and named custom provider resolution) but was missing from the top-level _resolve_task_provider_model().

Change

• Added key_env/api_key_env → os.getenv() fallback in _resolve_task_provider_model() right after reading cfg_api_key, matching the existing pattern used elsewhere in the file.

agent/auxiliary_client.py | 7 +++++++
 1 file changed, 7 insertions(+)

Verification

• python3 -m py_compile agent/auxiliary_client.py passes cleanly
• The fix mirrors the same key_env/api_key_env fallback pattern already proven in _fallback_entry_api_key() (L4291) and named custom provider resolution (L5047)

Closes #66641

/cc @hanjunwp

[alt-glitch]

This was generated by AI during triage.

Related to #36080, not a duplicate: both repair the same key_env/api_key_env resolution gap, but #36080 is the earlier test-backed implementation and this PR is a narrower production-only repair.

[tonydwb]

Code Review Summary

Verdict: Approved

Fixes key_env/api_key_env resolution in _resolve_task_provider_model() to match the existing pattern in _fallback_entry_api_key() and named custom provider resolution. Clean 7-line fix with no behavioral changes to paths that already use direct api_key.

LGTM.

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused auxiliary credential-resolution fix. Current main still reads only auxiliary.<task>.api_key in _resolve_task_provider_model() (agent/auxiliary_client.py:6251-6256) and returns that value to provider resolution (agent/auxiliary_client.py:6331-6344), so the premise is verified.

Problems

• This production change has no regression coverage. tests/agent/test_auxiliary_client.py:113-276 exercises configured endpoint propagation but does not cover task-level key_env or api_key_env resolution.

Suggested changes

• Add focused resolver tests for both aliases, direct api_key precedence, and an unset referenced variable. The member-linked related PR #36080 already contains test coverage for these exact cases and can be used when salvaging this narrow production fix.

Automated hermes-sweeper review.

[teknium1]

Please add a focused regression test for this branch: task-level key_env and api_key_env resolution, direct api_key precedence, and an unset referenced variable. The existing resolver tests do not cover these aliases.

[OutThisLife]

Salvaged into #67192 with authorship preserved, rebased on current main. Thanks @webtecnica.