fix(delegate): inherit parent api_key when delegation.base_url set without delegation.api_key (#15810) by briandevans · Pull Request #15853 · NousResearch/hermes-agent

briandevans · 2026-04-26T02:13:57Z

Summary

When delegation.base_url is configured without delegation.api_key, the child agent now inherits the parent's resolved API key instead of falling back to OPENAI_API_KEY
Explicit delegation.api_key still overrides as before
Two tests updated to reflect the corrected behaviour

The bug

_resolve_delegation_credentials() handled the delegation.base_url path as:

api_key = configured_api_key or os.getenv("OPENAI_API_KEY", "").strip()
if not api_key:
    raise ValueError("... Set delegation.api_key or OPENAI_API_KEY.")

This bypassed the provider credential pool entirely. Providers that store their key outside OPENAI_API_KEY (e.g. MINIMAX_API_KEY, DASHSCOPE_API_KEY) therefore caused the child agent to receive an empty API key → 401 Unauthorized. By contrast, the delegation.provider-only path correctly resolved credentials via resolve_runtime_provider().

The fix

When delegation.api_key is absent, return api_key = None instead of the OPENAI_API_KEY fallback. _spawn_child already has the correct inheritance logic:

effective_api_key = override_api_key or parent_api_key

With override_api_key = None, this naturally falls through to parent_api_key, which holds the key the parent agent resolved through the full provider credential chain.

Test plan

Before: test_direct_endpoint_returns_none_api_key_when_not_configured and test_direct_endpoint_no_raise_when_only_provider_env_key_present — both FAIL on unpatched code (one gets wrong "env-openai-key", one expects no ValueError but gets one)
After: 115/115 tests pass in tests/tools/test_delegate.py
Regression guard: reverted production change → both new tests fail; restored → 0 failures
Adjacent toolset tests unchanged

Pull request overview

This PR fixes delegation credential inheritance when delegation.base_url is set without delegation.api_key, ensuring subagents inherit the parent agent’s resolved API key (via the provider credential chain) instead of falling back to OPENAI_API_KEY.

Changes:

Update _resolve_delegation_credentials() so the base_url branch returns api_key=None when not explicitly configured, enabling inheritance in child construction.
Expand/update delegation credential resolution docstring/comments to describe the intended inheritance behavior.
Update two delegation credential resolution tests to assert api_key is None (no OPENAI_API_KEY fallback and no ValueError).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
tools/delegate_tool.py	Adjusts delegation credential resolution so direct-endpoint delegation inherits the parent API key when `delegation.api_key` is omitted.
tests/tools/test_delegate.py	Updates tests to reflect the new inheritance behavior when `base_url` is configured without `api_key`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-26T02:16:48Z

+    omitted, ``api_key`` is returned as None so ``_spawn_child`` inherits the
+    parent agent's key (``effective_api_key = override_api_key or parent_api_key``).
+    This lets providers that store their key outside ``OPENAI_API_KEY`` (e.g.


The docstring references _spawn_child, but there is no _spawn_child function in this module/repo. The credential inheritance logic (effective_api_key = override_api_key or parent_api_key) lives in _build_child_agent, so these references should be updated to avoid misleading future readers.

Suggested change

omitted, ``api_key`` is returned as None so ``_spawn_child`` inherits the

parent agent's key (``effective_api_key = override_api_key or parent_api_key``).

This lets providers that store their key outside ``OPENAI_API_KEY`` (e.g.

omitted, ``api_key`` is returned as None so the child-building path keeps

inheriting the parent agent's key in ``_build_child_agent``

(``effective_api_key = override_api_key or parent_api_key``). This lets

providers that store their key outside ``OPENAI_API_KEY`` (e.g.

Copilot · 2026-04-26T02:16:48Z

+        # When delegation.api_key is not set, return None so _spawn_child falls
+        # back to the parent agent's API key via the credential inheritance path
+        # (effective_api_key = override_api_key or parent_api_key).  This lets
+        # providers that store their key in a non-OPENAI_API_KEY env var (e.g.
+        # MINIMAX_API_KEY, DASHSCOPE_API_KEY) work without requiring callers to
+        # duplicate the key under delegation.api_key.
+        api_key = configured_api_key  # None → inherited from parent in _spawn_child


These inline comments mention _spawn_child, but the actual inheritance logic occurs in _build_child_agent (where effective_api_key is computed). Please rename the referenced function in the comment so it matches the code path and is searchable.

Copilot · 2026-04-26T02:16:49Z

-    def test_direct_endpoint_falls_back_to_openai_api_key_env(self):
+    def test_direct_endpoint_returns_none_api_key_when_not_configured(self):
+        # When base_url is set without api_key, api_key should be None so
+        # _spawn_child inherits the parent's key (effective_api_key = override or parent).


This test comment refers to _spawn_child, but delegation constructs children via _build_child_agent (which computes effective_api_key = override_api_key or parent_api_key). Updating the comment will keep the test documentation accurate and easier to follow.

Suggested change

# _spawn_child inherits the parent's key (effective_api_key = override or parent).

# _build_child_agent falls back to the parent's key

# (effective_api_key = override_api_key or parent_api_key).

Copilot · 2026-04-26T02:16:49Z

+        # Even if OPENAI_API_KEY is absent, no ValueError — parent key is the fallback.
        parent = _make_mock_parent(depth=0)


This test comment mentions _spawn_child, but the inheritance logic is implemented in _build_child_agent. Consider updating the wording so readers can find the relevant code quickly.

briandevans · 2026-04-26T02:22:21Z

Thanks @copilot — all four findings are the same root cause: I wrote _spawn_child but the actual function is _build_child_agent. Addressed in c6a16eda.

All four comments → renamed every occurrence of _spawn_child to _build_child_agent in:

tools/delegate_tool.py docstring (line 2182)
tools/delegate_tool.py inline comment (line 2206)
tests/tools/test_delegate.py test comment (line 649)
tests/tools/test_delegate.py test comment (line 662)

briandevans · 2026-04-26T16:35:29Z

@copilot All four _spawn_child → _build_child_agent comment corrections are done in commit c6a16eda. The docstring, inline comments in delegate_tool.py, and test comments in test_delegate.py now all reference _build_child_agent correctly.

…thout api_key (NousResearch#15810) When delegation.base_url is configured without delegation.api_key, the old code fell back to os.getenv("OPENAI_API_KEY"), bypassing the provider credential pool. Providers that store their key outside OPENAI_API_KEY (e.g. MINIMAX_API_KEY, DASHSCOPE_API_KEY) therefore received an empty key → 401 Unauthorized. Return None for api_key when delegation.api_key is absent so that _spawn_child picks up the parent agent's resolved key via the existing inheritance path (effective_api_key = override_api_key or parent_api_key). Explicit delegation.api_key still takes effect as before. Update two tests that asserted the old OPENAI_API_KEY fallback behaviour. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

teknium1 · 2026-05-04T12:18:47Z

Salvaged via #19741 onto current main. Docstring conflict resolved by merging both code paths' documentation; two existing tests that locked in the old OPENAI_API_KEY-fallback behavior were updated to expect the new parent-inheritance semantics. Your authorship was preserved. Thanks @briandevans!

Copilot AI review requested due to automatic review settings April 26, 2026 02:13

Copilot started reviewing on behalf of briandevans April 26, 2026 02:14 View session

Copilot AI reviewed Apr 26, 2026

View reviewed changes

alt-glitch added type/bug Something isn't working P2 Medium — degraded but workaround exists comp/tools Tool registry, model_tools, toolsets tool/delegate Subagent delegation labels Apr 26, 2026

liuhao1024 mentioned this pull request May 1, 2026

fix(tools): resolve delegation API key from provider credential chain when base_url is set #15815

Closed

briandevans and others added 2 commits May 3, 2026 20:12

fix(delegate): correct _spawn_child → _build_child_agent in comments

0908f17

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

briandevans force-pushed the fix/delegation-base-url-credential-chain-15810 branch from c6a16ed to 0908f17 Compare May 4, 2026 03:12

teknium1 mentioned this pull request May 4, 2026

fix(delegate): inherit parent api_key when delegation.base_url set without delegation.api_key #19741

Merged

teknium1 closed this May 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(delegate): inherit parent api_key when delegation.base_url set without delegation.api_key (#15810)#15853

fix(delegate): inherit parent api_key when delegation.base_url set without delegation.api_key (#15810)#15853
briandevans wants to merge 2 commits into
NousResearch:mainfrom
briandevans:fix/delegation-base-url-credential-chain-15810

briandevans commented Apr 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

briandevans commented Apr 26, 2026

Uh oh!

briandevans commented Apr 26, 2026

Uh oh!

teknium1 commented May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	# _spawn_child inherits the parent's key (effective_api_key = override or parent).
	# _build_child_agent falls back to the parent's key
	# (effective_api_key = override_api_key or parent_api_key).

		# Even if OPENAI_API_KEY is absent, no ValueError — parent key is the fallback.
		parent = _make_mock_parent(depth=0)

Conversation

briandevans commented Apr 26, 2026

Summary

The bug

The fix

Test plan

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

briandevans commented Apr 26, 2026

Uh oh!

briandevans commented Apr 26, 2026

Uh oh!

teknium1 commented May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants