fix(cli,auth): resolve base_url_env_var from ~/.hermes/.env#20656
Open
haosenwang1018 wants to merge 1 commit into
Open
fix(cli,auth): resolve base_url_env_var from ~/.hermes/.env#20656haosenwang1018 wants to merge 1 commit into
haosenwang1018 wants to merge 1 commit into
Conversation
Closes NousResearch#18757 Provider base URLs declared via ``base_url_env_var`` were resolved through ``os.getenv`` only — bypassing ``~/.hermes/.env``. API keys already used ``get_env_value`` (which reads ``.env``), so users with a base URL set only in ``.env`` (not exported in the shell) ended up with a working API key but the registry default base URL. The original report describes Xiaomi's ``token-plan-cn`` endpoint silently regressing to the public ``api.xiaomimimo.com`` default, producing 401s on auxiliary tasks. The same inconsistency affects every API-key provider with a ``base_url_env_var``. Four call sites were inconsistent and now use the ``get_env_value(...) or os.getenv(...)`` fallback (matching the existing API-key resolution pattern): - ``auth.get_api_key_provider_status`` (status / ``hermes doctor``) - ``auth.resolve_api_key_provider_credentials`` (the original report) - ``auth.resolve_external_process_provider_credentials`` (Copilot ACP) - ``runtime_provider._build_runtime_for_api_key_provider`` (auxiliary client base URL plumbing) Tests cover the regression (``.env``-only base URL is now picked up) and pin the existing shell-env behavior so we don't regress in the other direction. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Collaborator
|
Duplicate of #18948 — both fix |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
Closes #18757
Root cause
Provider base URLs declared via
base_url_env_var(e.g.XIAOMI_BASE_URL,ARCEE_BASE_URL) resolved only throughos.getenv— they didn't see~/.hermes/.env. API keys already usedget_env_value(which reads.env), so the function had two halves with inconsistent semantics: API key found, base URL silently fell back to the registry default.The original report describes Xiaomi's
token-plan-cn-cn.xiaomimimo.comendpoint silently regressing to the publicapi.xiaomimimo.comdefault → 401s on auxiliary tasks. The same inconsistency affected every API-key provider with abase_url_env_var(Arcee, GLM, Kimi, GMI, MiniMax, Stepfun, GMI, AI Gateway, OpenCode, Kilocode, HF, TokenHub, Ollama, Bedrock, Azure Foundry, etc.).Fix
Four call sites needed the same
.env-aware lookup. The bug report named the first one; the rest were grep'd from the same access pattern:hermes_cli/auth.pyresolve_api_key_provider_credentialshermes_cli/auth.pyget_api_key_provider_statushermes doctorstatus outputhermes_cli/auth.pyresolve_external_process_provider_credentialshermes_cli/runtime_provider.py_build_runtime_for_api_key_provider(around the existingpconfig.base_url_env_varblock)All four now use the same fallback pattern that API-key resolution already uses elsewhere in the file:
Behavior when the value is set in the shell environment is unchanged.
Tests
tests/hermes_cli/test_provider_base_url_dotenv.py(new) covers:.env-only base URL is now picked up byresolve_api_key_provider_credentialsget_api_key_provider_status(sohermes doctorno longer lies when a.envbase URL is set)Existing
test_arcee_provider.pyandtest_runtime_provider_resolution.pyalso pass unchanged (139 tests in this scope, all green).