fix(runtime): resolve bare custom provider to loopback or CUSTOM_BASE_URL (#14676)#14719
fix(runtime): resolve bare custom provider to loopback or CUSTOM_BASE_URL (#14676)#14719georgex8001 wants to merge 2 commits into
Conversation
…_URL When /model selects Custom but model.provider in YAML still reflects a prior provider, trust model.base_url only for loopback hosts or when provider is custom. Consult CUSTOM_BASE_URL before OpenRouter defaults (NousResearch#14676).
Replace process-wide HERMES_INTERACTIVE mutation in ThreadPoolExecutor with context-local state in tools.approval so concurrent ACP sessions cannot race or bypass dangerous-command approval (GHSA-96vc-wcxf-jjff). effective_hermes_interactive() overrides os.environ for terminal sudo and cronjob eligibility checks. Made-with: Cursor
|
Partial salvage: your runtime_provider.py commit (44e02f2) landed via #15103. The ACP/approval contextvar refactor commit (d9ef7a7) is a separate scope and is worth reviewing on its own — leaving this PR open for that piece. If you'd rather, we can drop the runtime commit from this branch (now duplicated on main) and leave just the ACP change, or close this and open a new PR for the ACP work. Your call. |
|
Awesome, thanks for cherry-picking the runtime fix! I completely agree that the ACP contextvar refactor deserves its own isolated review scope. To keep things completely clean and avoid any git rebase confusion, I will close this PR and open a fresh, dedicated PR targeting main containing solely the d9ef7a7 commit for the ACP concurrency fix. Give me a few minutes! |
Summary
Fixes incorrect routing when the user explicitly selects the Custom provider (e.g. via
/model) whilemodel.providerinconfig.yamlstill reflects a previous provider (e.g.openrouter). In that case,model.base_urlwas ignored unlessprovider: custom, so resolution fell through to OpenRouter with a local model id (see #14676).Changes
model.base_urlfor barecustomwhen either:model.provideriscustom, orbase_urlhost is loopback (localhost,127.0.0.1,::1,0.0.0.0).CUSTOM_BASE_URLbefore OpenRouter default URLs so users can pin a local endpoint without a namedcustom:*entry.model.base_urlwhenprovideris notcustom, so a stale cloud URL cannot hijack a Custom session.Tests
tests/hermes_cli/test_runtime_provider_resolution.py: three regressions for loopback YAML + non-custom provider,CUSTOM_BASE_URLoverride, and non-loopback URL not trusted.Fixes #14676