Repository navigation
fix: compare base-URL hostnames, not substrings, in provider-identity checks - #85737
Merged
Merged
Conversation
… checks Port of the bug class from earendil-works/pi#7933 (DeepSeek base-URL detection matched by raw substring, missing case variants and matching lookalike URLs). Hermes had the same class at five sites: - cli_agent_setup_mixin.py: keyless-custom-endpoint detection treated any URL containing the OpenRouter host substring (path segment, lookalike domain) as OpenRouter, and missed case variants of the real host. - models.py validate_requested_model: same substring check for routing an openrouter provider with a custom base_url to the custom catalog. - runtime_provider.py: local-endpoint autodetect matched the string localhost anywhere in the URL, including remote hostnames containing it. - gateway/run.py: /status endpoint display, same local-host substring. - agent_runtime_helpers.py: Nous Portal cache-layout detection matched the nousresearch substring anywhere in the URL. All sites now use the existing base_url_host_matches / base_url_hostname helpers (exact host or subdomain, case-insensitive). Regression tests proven to fail against the old predicates.
૮ >ﻌ< ა ci reviewran on 82763e9 — fix: compare base-URL hostnames, not substrings, in provider
|
alt-glitch
added
type/bug
teknium1
added a commit
that referenced
this pull request
Aug 15, 2026
Follow-up to #85737, which migrated five provider-identity sites onto utils.base_url_host_matches()/base_url_hostname(). This completes the class sweep (never-patch-predicates: one owner, every site) and folds in the two open contributor PRs attacking individual sites: - agent/auxiliary_client.py ZAI/Kimi OpenAI-wire rewrite (PR #85715, pierrenode): 'bigmodel'/'api.z.ai'/'api.kimi.com' substring checks rewrote proxy paths containing those markers. - hermes_cli/runtime_provider.py Azure endpoint detection (PR #74721, RelaxJonh, issue #74312): 'azure.com' substring picked the Azure key for non-Azure hosts whose path contained the text. - run_agent.py: _is_azure_openai_url, _is_copilot_url, Anthropic credential-refresh azure guard, _anthropic_preserve_dots host allowlist, OpenRouter/mistral reasoning gates. - agent/chat_completion_helpers.py: nousresearch / nvidia detection. - agent/conversation_loop.py: GitHub Models 413 hint. - agent/usage_pricing.py: localhost billing-route detection. - hermes_cli/model_switch.py: api.openai.com catalog fallback and localhost custom-provider detection. - cli.py: local-model autodetect and Ollama/LM Studio context-length hints (port-anchored instead of '11434' in URL). - tools/mcp_oauth.py: Figma remote-MCP detection. - tools/skills_hub.py: raw.githubusercontent.com source-URL check. Regression tests extend tests/hermes_cli/test_base_url_host_identity.py (azure/copilot/dotted-model/figma proxy-path + lookalike cases) and tests/agent/test_minimax_auxiliary_url.py (ZAI/Kimi path false positives). Closes #74312. Salvages #85715 and #74721 with authorship preserved.
This was referenced Aug 15, 2026
RickyYii
added a commit
to RickyYii/hermes-agent
that referenced
this pull request
Aug 17, 2026
Resolves the only conflict: NousResearch#85737's follow-up (4b7b2b0) added `from utils import base_url_host_matches, base_url_hostname` at the same import site where this branch added `base_url_origin`. Both are wanted — upstream's two symbols back the widened hostname-identity sweep, and `base_url_origin` backs the alias credential-reuse origin check — so the import is merged rather than either side dropped. No other file conflicted. Verified after the merge: the alias credential matrix is unchanged (8/8), this branch's 46 cases pass, and upstream's new tests/hermes_cli/test_base_url_host_identity.py passes (13).
bobaba76
pushed a commit
to bobaba76/hermes-agent
that referenced
this pull request
Aug 27, 2026
Follow-up to NousResearch#85737, which migrated five provider-identity sites onto utils.base_url_host_matches()/base_url_hostname(). This completes the class sweep (never-patch-predicates: one owner, every site) and folds in the two open contributor PRs attacking individual sites: - agent/auxiliary_client.py ZAI/Kimi OpenAI-wire rewrite (PR NousResearch#85715, pierrenode): 'bigmodel'/'api.z.ai'/'api.kimi.com' substring checks rewrote proxy paths containing those markers. - hermes_cli/runtime_provider.py Azure endpoint detection (PR NousResearch#74721, RelaxJonh, issue NousResearch#74312): 'azure.com' substring picked the Azure key for non-Azure hosts whose path contained the text. - run_agent.py: _is_azure_openai_url, _is_copilot_url, Anthropic credential-refresh azure guard, _anthropic_preserve_dots host allowlist, OpenRouter/mistral reasoning gates. - agent/chat_completion_helpers.py: nousresearch / nvidia detection. - agent/conversation_loop.py: GitHub Models 413 hint. - agent/usage_pricing.py: localhost billing-route detection. - hermes_cli/model_switch.py: api.openai.com catalog fallback and localhost custom-provider detection. - cli.py: local-model autodetect and Ollama/LM Studio context-length hints (port-anchored instead of '11434' in URL). - tools/mcp_oauth.py: Figma remote-MCP detection. - tools/skills_hub.py: raw.githubusercontent.com source-URL check. Regression tests extend tests/hermes_cli/test_base_url_host_identity.py (azure/copilot/dotted-model/figma proxy-path + lookalike cases) and tests/agent/test_minimax_auxiliary_url.py (ZAI/Kimi path false positives). Closes NousResearch#74312. Salvages NousResearch#85715 and NousResearch#74721 with authorship preserved.
melon-xf
added a commit
to melon-xf/hermes-agent
that referenced
this pull request
Sep 3, 2026
Follow-up to NousResearch#85737, which migrated five provider-identity sites onto utils.base_url_host_matches()/base_url_hostname(). This completes the class sweep (never-patch-predicates: one owner, every site) and folds in the two open contributor PRs attacking individual sites: - agent/auxiliary_client.py ZAI/Kimi OpenAI-wire rewrite (PR NousResearch#85715, pierrenode): 'bigmodel'/'api.z.ai'/'api.kimi.com' substring checks rewrote proxy paths containing those markers. - hermes_cli/runtime_provider.py Azure endpoint detection (PR NousResearch#74721, RelaxJonh, issue NousResearch#74312): 'azure.com' substring picked the Azure key for non-Azure hosts whose path contained the text. - run_agent.py: _is_azure_openai_url, _is_copilot_url, Anthropic credential-refresh azure guard, _anthropic_preserve_dots host allowlist, OpenRouter/mistral reasoning gates. - agent/chat_completion_helpers.py: nousresearch / nvidia detection. - agent/conversation_loop.py: GitHub Models 413 hint. - agent/usage_pricing.py: localhost billing-route detection. - hermes_cli/model_switch.py: api.openai.com catalog fallback and localhost custom-provider detection. - cli.py: local-model autodetect and Ollama/LM Studio context-length hints (port-anchored instead of '11434' in URL). - tools/mcp_oauth.py: Figma remote-MCP detection. - tools/skills_hub.py: raw.githubusercontent.com source-URL check. Regression tests extend tests/hermes_cli/test_base_url_host_identity.py (azure/copilot/dotted-model/figma proxy-path + lookalike cases) and tests/agent/test_minimax_auxiliary_url.py (ZAI/Kimi path false positives). Closes NousResearch#74312. Salvages NousResearch#85715 and NousResearch#74721 with authorship preserved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Provider-identity checks now compare base-URL hostnames instead of raw substrings, so proxy URLs with a provider host in their path, lookalike domains, and case variants no longer misroute credentials, catalogs, or cache layout.
Port of the bug class from earendil-works/pi#7933 ("detect DeepSeek base URLs case-insensitively" — their substring check missed case variants and matched lookalike URLs). Hermes had the identical class at five sites that
utils.base_url_host_matches()/base_url_hostname()were built for but never migrated onto.Changes
hermes_cli/cli_agent_setup_mixin.py: keyless-custom-endpoint detection (2 sites) —"openrouter.ai" not in base_urltreatedhttps://proxy.internal/openrouter.ai/v1andhttps://openrouter.ai.evil.comas OpenRouter (blocking keyless local use) and treatedhttps://OpenRouter.AIas a keyless custom endpoint (silently sending a placeholder key to real OpenRouter).hermes_cli/models.pyvalidate_requested_model: same substring check deciding openrouter-vs-custom catalog routing for/modelvalidation.hermes_cli/runtime_provider.py: local-model autodetect fired for any URL containinglocalhost/127.0.0.1— including remote hostnames that merely contain the string.gateway/run.py:/statusendpoint display, same local-host substring.agent/agent_runtime_helpers.py: Nous Portal cache-layout detection matchednousresearchanywhere in the URL.tests/hermes_cli/test_base_url_host_identity.py: regression tests for the class (proxy-path, lookalike-domain, case-variant, local-host cases).Validation
https://proxy.internal/openrouter.ai/v1, no keyhttps://OpenRouter.AI/api/v1, no keytests/cli/test_cli_first_run_setup.py+tests/agent/test_nous_portal_anthropic_wire.py+test_prompt_cache_boundary.pyWeekly Pi scout cron; opened for review, not merged.
Infographic