fix(delegation): normalize child runtime tuple#25386
Conversation
wesleysimplicio
left a comment
There was a problem hiding this comment.
Read-only review pass: one remaining edge case seems to preserve the stale key this PR is trying to eliminate.
_normalize_child_runtime_tuple only repairs the inherited tuple when URL/mode/provider shape mismatches. If base_url and api_mode already match the resolved runtime but the inherited api_key is stale, the helper returns the old key. I reproduced this in a local read-only checkout by patching the resolver to return fresh-key; the helper still returned stale-key because no URL/mode mismatch was present.
I would include api_key mismatch in the repair condition whenever the resolver provides a key, plus a targeted regression for inherited stale key with matching base URL and API mode.
|
thanks, good catch. i added a follow-up commit that includes the api_key mismatch in the normalization condition and a regression test for the matching URL/mode case.\n\nwhile testing this on my live Hermes setup, i also found a related credential pool edge case: after a parent route switch, parent.provider can be openai-codex while the inherited pool is still from the previous provider. i added a small guard so child agents only share the parent pool when the pool provider matches too.\n\nlocal checks after the follow-up commit:\n- scripts/run_tests.sh tests/tools/test_delegate.py -> 132 passed\n- .venv/bin/ruff check tools/delegate_tool.py tests/tools/test_delegate.py -> passed |
Summary
AIAgent.delegation.base_urland ACP transport overrides.base_urland explicit endpoint preservation.Why
Current main already passes
target_modelduring delegation provider resolution via #19623. PR #25369 also avoids inheriting staleapi_modewhen the provider changes. There is still one unsafe state: a child can have the intended provider/model but keep a stale inheritedbase_url,api_key, orapi_modefrom the parent. That can send a request to the wrong API surface.This patch asks the existing runtime provider resolver for the canonical tuple when the child is not using an explicit direct endpoint. If the inherited tuple does not match, the child gets the provider-resolved runtime instead.
Tests
scripts/run_tests.sh tests/tools/test_delegate.py.venv/bin/ruff check tools/delegate_tool.py tests/tools/test_delegate.pyRelated
Complements #19623 and #25369.