Skip to content

fix: update api_key in _try_activate_fallback for subagent auth#3103

Merged
teknium1 merged 1 commit intomainfrom
hermes/hermes-0b98b356
Mar 26, 2026
Merged

fix: update api_key in _try_activate_fallback for subagent auth#3103
teknium1 merged 1 commit intomainfrom
hermes/hermes-0b98b356

Conversation

@teknium1
Copy link
Copy Markdown
Contributor

Summary

When provider fallback activates (e.g. minimax → OpenRouter), _try_activate_fallback() updated self.provider, self.base_url, self.api_mode, and self._client_kwargs — but never self.api_key.

delegate_tool.py:186 reads parent_agent.api_key to pass credentials to child agents. After fallback, this returned the stale pre-fallback key (e.g. a minimax API key being sent to OpenRouter), causing 401 Missing Authentication header errors on all subagents.

Fix

Add self.api_key = ... in both branches of _try_activate_fallback():

  • anthropic_messages path: self.api_key = effective_key
  • chat_completions path: self.api_key = fb_client.api_key

Test plan

  • test_run_agent.py: 199 passed
  • test_fallback_model.py: 27 passed

When fallback activates (e.g. minimax → OpenRouter), self.provider,
self.base_url, self.api_mode, and self._client_kwargs were all updated
but self.api_key was not. delegate_tool.py reads parent_agent.api_key
to pass credentials to child agents, so subagents inherited the stale
pre-fallback key (e.g. a minimax key sent to OpenRouter), causing 401
Missing Authentication errors.

Add self.api_key = ... in both the anthropic_messages and
chat_completions branches of _try_activate_fallback().
@github-actions
Copy link
Copy Markdown

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

@teknium1 teknium1 merged commit 4b45f65 into main Mar 26, 2026
3 of 4 checks passed
outsourc-e pushed a commit to outsourc-e/hermes-agent that referenced this pull request Mar 26, 2026
…Research#3103)

When fallback activates (e.g. minimax → OpenRouter), self.provider,
self.base_url, self.api_mode, and self._client_kwargs were all updated
but self.api_key was not. delegate_tool.py reads parent_agent.api_key
to pass credentials to child agents, so subagents inherited the stale
pre-fallback key (e.g. a minimax key sent to OpenRouter), causing 401
Missing Authentication errors.

Add self.api_key = ... in both the anthropic_messages and
chat_completions branches of _try_activate_fallback().
StreamOfRon pushed a commit to StreamOfRon/hermes-agent that referenced this pull request Mar 29, 2026
…Research#3103)

When fallback activates (e.g. minimax → OpenRouter), self.provider,
self.base_url, self.api_mode, and self._client_kwargs were all updated
but self.api_key was not. delegate_tool.py reads parent_agent.api_key
to pass credentials to child agents, so subagents inherited the stale
pre-fallback key (e.g. a minimax key sent to OpenRouter), causing 401
Missing Authentication errors.

Add self.api_key = ... in both the anthropic_messages and
chat_completions branches of _try_activate_fallback().
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant