Skip to content

fix(credential_pool): auto-detect Z.AI endpoint via probe and cache#5575

Closed
SeeYangZhi wants to merge 1 commit into
NousResearch:mainfrom
SeeYangZhi:fix/zai-credential-pool-endpoint-probe-clean
Closed

fix(credential_pool): auto-detect Z.AI endpoint via probe and cache#5575
SeeYangZhi wants to merge 1 commit into
NousResearch:mainfrom
SeeYangZhi:fix/zai-credential-pool-endpoint-probe-clean

Conversation

@SeeYangZhi

Copy link
Copy Markdown
Contributor

Summary

The credential pool seeder and runtime credential resolver hardcoded api.z.ai/api/paas/v4 for all Z.AI keys. Keys on the Coding Plan (or CN endpoint) would hit the wrong endpoint, causing HTTP 429/401 errors on the first request even though a working endpoint exists.

Root Cause

Same class of bug as #5561 (kimi-coding). _seed_from_env() in agent/credential_pool.py uses:

base_url = env_url or pconfig.inference_base_url

For zai, pconfig.inference_base_url is https://api.z.ai/api/paas/v4, so the pool and resolver always use that endpoint regardless of which plan the key belongs to. Meanwhile detect_zai_endpoint() exists in hermes_cli/auth.py to probe candidate endpoints, but was never wired up.

Fix

Add _resolve_zai_base_url() that:

  • Respects GLM_BASE_URL env var (no probe when explicitly set)
  • Checks provider state cache in auth.json for a previously detected endpoint (keyed on SHA-256 hash of the API key)
  • Calls detect_zai_endpoint() to probe all 4 candidates (global, cn, coding-global, coding-cn) if no cache hit
  • Persists and returns the detected endpoint, falls back to default if all probes fail

Wire into both _seed_from_env() in the credential pool and resolve_api_key_provider_credentials() in the runtime resolver, matching the pattern from the kimi-coding fix (#5566).

Changes

  • hermes_cli/auth.py — Add _resolve_zai_base_url() + wire into resolve_api_key_provider_credentials()
  • agent/credential_pool.py — Import and call _resolve_zai_base_url in _seed_from_env() for zai
  • tests/test_api_key_providers.py — Add TestZaiEndpointAutoDetect (4 tests), mock probe in existing zai tests

The credential pool seeder and runtime credential resolver hardcoded
api.z.ai/api/paas/v4 for all Z.AI keys.  Keys on the Coding Plan (or CN
endpoint) would hit the wrong endpoint, causing 401/429 errors on the
first request even though a working endpoint exists.

Add _resolve_zai_base_url() that:
- Respects GLM_BASE_URL env var (no probe when explicitly set)
- Probes all candidate endpoints (global, cn, coding-global, coding-cn)
  via detect_zai_endpoint() to find one that returns HTTP 200
- Caches the detected endpoint in provider state (auth.json) keyed on
  a SHA-256 hash of the API key so subsequent starts skip the probe
- Falls back to the default URL if all probes fail

Wire into both _seed_from_env() in the credential pool and
resolve_api_key_provider_credentials() in the runtime resolver,
matching the pattern from the kimi-coding fix (PR NousResearch#5566).

Fixes the same class of bug as NousResearch#5561 but for the zai provider.
@teknium1

teknium1 commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

Merged via PR #5763. Your commit was cherry-picked with authorship preserved. Thanks @SeeYangZhi!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants