From 019ea9b5f30af1ee137a492594765016232dafe2 Mon Sep 17 00:00:00 2001
From: Thomas Connally <51974392+tcconnally@users.noreply.github.com>
Date: Mon, 3 Aug 2026 02:22:58 +0000
Subject: [PATCH] fix(auxiliary): preserve custom provider headers

---
 agent/auxiliary_client.py                     | 12 +++++
 .../test_auxiliary_named_custom_providers.py  | 44 +++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/agent/auxiliary_client.py b/agent/auxiliary_client.py
index 22bf9c165cf04..a51c1bc51690d 100644
--- a/agent/auxiliary_client.py
+++ b/agent/auxiliary_client.py
@@ -6077,6 +6077,18 @@ def _wrap_if_needed(client_obj, final_model_str: str, base_url_str: str = "",
                     raw_base_for_wrap = custom_base
                 _clean_base2, _dq2 = _extract_url_query_params(openai_base)
                 _extra2 = {"default_query": _dq2} if _dq2 else {}
+                # Named custom providers may carry credentials in
+                # ``extra_headers`` (for example Cloudflare Access service
+                # headers).  Preserve them on auxiliary clients just as the
+                # main client path does.  Values are intentionally never
+                # logged.
+                _provider_headers2 = custom_entry.get("extra_headers")
+                if isinstance(_provider_headers2, dict) and _provider_headers2:
+                    _extra2["default_headers"] = {
+                        str(key): str(value)
+                        for key, value in _provider_headers2.items()
+                        if value is not None
+                    }
                 _headers2 = _apply_user_default_headers(_extra2.get("default_headers"))
                 if _headers2:
                     _extra2["default_headers"] = _headers2
diff --git a/tests/agent/test_auxiliary_named_custom_providers.py b/tests/agent/test_auxiliary_named_custom_providers.py
index ca49f16798789..b4a9973ee9b34 100644
--- a/tests/agent/test_auxiliary_named_custom_providers.py
+++ b/tests/agent/test_auxiliary_named_custom_providers.py
@@ -109,6 +109,50 @@ def test_named_custom_provider(self, tmp_path):
         assert model == "my-model"
         assert "beans.local" in str(client.base_url)
 
+    def test_named_custom_provider_extra_headers_reach_auxiliary_client(self, tmp_path):
+        """Named-provider headers must be installed on auxiliary OpenAI clients."""
+        _write_config(tmp_path, {
+            "providers": {
+                "llama": {
+                    "name": "llama",
+                    "base_url": "https://llama.example/v1",
+                    "api_key": "no-key-required",
+                    "extra_headers": {
+                        "CF-Access-Client-Id": "client.access",
+                        "CF-Access-Client-Secret": "secret-value",
+                    },
+                },
+            },
+        })
+        from agent import auxiliary_client
+
+        with patch.object(auxiliary_client, "OpenAI") as mock_openai:
+            mock_openai.return_value = MagicMock()
+            client, model = auxiliary_client.resolve_provider_client(
+                "llama", "gemma-test"
+            )
+
+        assert client is not None
+        assert model == "gemma-test"
+        kwargs = mock_openai.call_args.kwargs
+        assert kwargs["default_headers"] == {
+            "CF-Access-Client-Id": "client.access",
+            "CF-Access-Client-Secret": "secret-value",
+        }
+
+    def test_named_custom_provider_default_model(self, tmp_path):
+        _write_config(tmp_path, {
+            "model": {"default": "main-model"},
+            "custom_providers": [
+                {"name": "beans", "base_url": "http://beans.local/v1", "api_key": "k"},
+            ],
+        })
+        from agent.auxiliary_client import resolve_provider_client
+        client, model = resolve_provider_client("beans")
+        assert client is not None
+        # Should use _read_main_model() fallback
+        assert model == "main-model"
+
 
     def test_named_custom_no_api_key_uses_fallback(self, tmp_path):
         _write_config(tmp_path, {