Skip to content

fix(gateway): respect OPENAI_API_KEY env var to bypass OAuth#47

Closed
mjshiggins wants to merge 1 commit into
NousResearch:mainfrom
mjshiggins:fix/gateway-oauth-env-check
Closed

fix(gateway): respect OPENAI_API_KEY env var to bypass OAuth#47
mjshiggins wants to merge 1 commit into
NousResearch:mainfrom
mjshiggins:fix/gateway-oauth-env-check

Conversation

@mjshiggins

Copy link
Copy Markdown

(generated by Hermes, haven’t reviewed myself)

The gateway was forcing OAuth authentication for all Nous Research URLs, overriding user-provided API keys from environment variables. This caused failures when Nous Portal credits were exhausted or when users wanted to use direct API keys.

Changes:

  • Check for OPENAI_API_KEY before triggering OAuth flow
  • Only mint agent keys when no explicit API key is provided
  • Allows direct API usage without portal authentication

The gateway was forcing OAuth authentication for all Nous Research URLs,
overriding user-provided API keys from environment variables. This caused
failures when Nous Portal credits were exhausted or when users wanted to
use direct API keys.

Changes:
- Check for OPENAI_API_KEY before triggering OAuth flow
- Only mint agent keys when no explicit API key is provided
- Allows direct API usage without portal authentication

Fixes issues where users couldn't use kimi-k2.5 or other models
due to OAuth credit exhaustion blocking all gateway requests.
@teknium1

Copy link
Copy Markdown
Contributor

Fixed earlier!

@teknium1 teknium1 closed this Feb 26, 2026
sudo-yf pushed a commit to sudo-yf/hermes-agent that referenced this pull request Apr 5, 2026
…sResearch#47)

ci: multi-arch Docker builds + GitHub Releases on tag push
malaiwah pushed a commit to malaiwah/hermes-agent that referenced this pull request Apr 5, 2026
Previous commit had double-escaped backslashes (\\) which broke
the Dockerfile syntax. This fixes the RUN instructions to use
proper single backslashes for line continuation.

Fixes build failure in run NousResearch#47.
malaiwah pushed a commit to malaiwah/hermes-agent that referenced this pull request Apr 11, 2026
Previous commit had double-escaped backslashes (\\) which broke
the Dockerfile syntax. This fixes the RUN instructions to use
proper single backslashes for line continuation.

Fixes build failure in run NousResearch#47.
teknium1 added a commit that referenced this pull request May 29, 2026
…kew) (#34475)

A process running mismatched module versions — conversation_compression.py
re-imported with the post-#34351 lock code while a long-lived
hermes_state.SessionDB stays bound to the pre-#34351 class in memory — has
the try_acquire_compression_lock call site but not the method. The
AttributeError it raises is NOT a sqlite3.Error, so the method's own
fail-open guard never runs; the exception escapes to the outer agent loop,
which prints the error and retries. Compression never succeeds, the token
count never drops, and the loop re-triggers compaction forever (the
'API call #47/#48/#49 ... has no attribute try_acquire_compression_lock'
spin a user hit after an update).

Wrap the lock acquire so any unexpected exception fails OPEN: skip locking
and proceed with compression. Skipping the lock risks a rare
concurrent-compression session fork; an infinite no-progress loop that never
compresses at all is strictly worse. The remediation hint in the log points
at the real fix (restart / hermes update to resync the stale module).

Also guards get_compression_lock_holder against the same skew.

Adds a regression test simulating the version skew (real SessionDB wrapped
so only the lock methods raise AttributeError) — asserts _compress_context
proceeds and rotates instead of raising.
KKT-OPT pushed a commit to KKT-OPT/hermes-agent that referenced this pull request May 31, 2026
…kew) (NousResearch#34475)

A process running mismatched module versions — conversation_compression.py
re-imported with the post-NousResearch#34351 lock code while a long-lived
hermes_state.SessionDB stays bound to the pre-NousResearch#34351 class in memory — has
the try_acquire_compression_lock call site but not the method. The
AttributeError it raises is NOT a sqlite3.Error, so the method's own
fail-open guard never runs; the exception escapes to the outer agent loop,
which prints the error and retries. Compression never succeeds, the token
count never drops, and the loop re-triggers compaction forever (the
'API call NousResearch#47/NousResearch#48/NousResearch#49 ... has no attribute try_acquire_compression_lock'
spin a user hit after an update).

Wrap the lock acquire so any unexpected exception fails OPEN: skip locking
and proceed with compression. Skipping the lock risks a rare
concurrent-compression session fork; an infinite no-progress loop that never
compresses at all is strictly worse. The remediation hint in the log points
at the real fix (restart / hermes update to resync the stale module).

Also guards get_compression_lock_holder against the same skew.

Adds a regression test simulating the version skew (real SessionDB wrapped
so only the lock methods raise AttributeError) — asserts _compress_context
proceeds and rotates instead of raising.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants