Bug Description

When auxiliary.vision.provider is set to zai with a custom base_url pointing to open.bigmodel.cn, the credential pool fails to automatically resolve the ZAI_API_KEY for vision use. The API key must be hardcoded in config.yaml under auxiliary.vision.api_key for vision to work.

Error message: 401 - {'error': {'code': '401', 'message': '令牌已过期或验证不正确'}}

Steps to Reproduce

1. Configure ZAI_API_KEY in .env
2. Set the following in config.yaml:

   auxiliary:
     vision:
       provider: zai
       model: glm-4v
       base_url: https://open.bigmodel.cn/api/paas/v4
       api_key: ''    # leave empty, expecting auto-resolve

3. Run vision_analyze with any image
4. Observe 401 error

Workaround

Hardcoding the API key directly in config.yaml fixes it:

auxiliary:
  vision:
    provider: zai
    model: glm-4v
    base_url: https://open.bigmodel.cn/api/paas/v4
    api_key: '<actual_key>'

Root Cause Analysis

In agent/auxiliary_client.py, resolve_vision_provider_client() at line 2236:

if resolved_base_url:
    client, final_model = resolve_provider_client(
        "custom",           # <-- hardcodes provider to "custom"
        model=resolved_model,
        explicit_base_url=resolved_base_url,
        explicit_api_key=resolved_api_key,  # <-- only used if set
    )

When resolved_base_url is not null (which happens when base_url is explicitly set in config), it forces the provider to "custom" and falls back to credential-pool lookup for the "custom" provider. The zai credential pool is never consulted, so ZAI_API_KEY is not found.

The fix should check the credential pool for the configured provider (e.g. zai) when provider is explicitly set, even when base_url overrides the default endpoint.

Debug Report

Report: https://paste.rs/uYr7k
agent.log: https://paste.rs/MEiaS

Environment

• OS: macOS 15.4 (Sequoia)
• Python: 3.11.15 (venv)
• Hermes: v0.11.0 (2026.4.23)