fix(runtime): resolve bare custom provider to loopback or CUSTOM_BASE_URL (salvage #14719)#15103
Merged
Conversation
…_URL When /model selects Custom but model.provider in YAML still reflects a prior provider, trust model.base_url only for loopback hosts or when provider is custom. Consult CUSTOM_BASE_URL before OpenRouter defaults (#14676).
This was referenced Apr 24, 2026
19 tasks
gtopolice
added a commit
to gtopolice/clawdeez-hermes-template
that referenced
this pull request
May 14, 2026
…eam boot `provider: custom` configured purely via env vars (OPENAI_BASE_URL + OPENAI_API_KEY) is unreliable on Hermes' Docker image: the upstream entrypoint copies a default `.env.example` onto fresh volumes, and the dotenv loader masks the process-level OPENAI_API_KEY when resolving the custom-provider call. Symptom on Morpheus BYOK deployments: request reaches api.mor.org but with no auth header → 401 "Missing Authentication header" surfaced through Hermes as agent_http_502. Fix: materialize /opt/data/config.yaml ourselves from HERMES_INFERENCE_PROVIDER + HERMES_MODEL (+ OPENAI_BASE_URL/OPENAI_API_KEY for `custom`) before exec'ing the upstream entrypoint. config.yaml is documented as the "single source of truth" for model/provider/api_key, so this works on every Hermes version and sidesteps both NousResearch/hermes-agent#15103 and the dotenv masking. OpenRouter rows still rely on OPENROUTER_API_KEY env var (documented as process-level by Hermes); only the `model.default` + `provider` go into yaml. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Partial salvage of #14719 by @georgex8001 onto current main. Only the runtime_provider.py commit is picked; the ACP/approval contextvar refactor in the same PR is unrelated scope — worth a separate review.
Closes #14676.
What this PR does
Two related bare-
customresolution fixes:CUSTOM_BASE_URLenv var in runtime resolution (not just model-list display). Before, setting onlyCUSTOM_BASE_URLwith bareprovider: customfell through to OpenRouter./modelswitches to Custom whilemodel.providerin YAML still reflects a prior cloud provider (OpenRouter, Z.AI, etc.),model.base_urlis only trusted if it's a loopback host (localhost,127.0.0.1,::1,0.0.0.0) OR the YAML provider is alreadycustom.How
_loopback_hostname()+_config_base_url_trustworthy_for_bare_custom()helpers inhermes_cli/runtime_provider.py_resolve_openrouter_runtimenow readsCUSTOM_BASE_URLahead of the OpenRouter default URLsuse_config_base_urlgate for barecustomruns through the loopback-trust checkCherry-pick scope
PR #14719 bundled two unrelated fixes: (a) this runtime fix, (b) an ACP approval thread-safety refactor via contextvars. Only (a) is salvaged here; (b) lives in commit
d9ef7a72on the original PR — it can be evaluated separately.Changes
runtime_provider.py, 66 lines of regression testsgeorgex8001@gmail.comValidation
provider: openrouter, selectcustomopenrouter.ailocalhost:8082provider: openrouter, selectcustomCUSTOM_BASE_URL=http://localhost:9090/v1, nomodel.base_urlopenrouter.ailocalhost:9090provider: custom+ loopback base_urltests/hermes_cli/test_runtime_provider_resolution.py— 74/74 pass (3 new regression tests)Co-authored-by: @georgex8001