From 7ca0d2b1f73c009f6cdad78aeec3c5cdc6734a13 Mon Sep 17 00:00:00 2001 From: Teknium <127238744+teknium1@users.noreply.github.com> Date: Wed, 2 Sep 2026 21:13:46 -0700 Subject: [PATCH] =?UTF-8?q?refactor(hermes=5Fcli/web=5Frouters):=20config?= =?UTF-8?q?=5Fenv=20=E2=80=94=20keep=20raw=20api=5Fkey=20type=20semantics?= =?UTF-8?q?=20exact?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hermes_cli/web_routers/config_env.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/hermes_cli/web_routers/config_env.py b/hermes_cli/web_routers/config_env.py index 4b71ff92b5..ac0522003f 100644 --- a/hermes_cli/web_routers/config_env.py +++ b/hermes_cli/web_routers/config_env.py @@ -352,10 +352,10 @@ def _api_key_display(entry: Dict[str, Any]) -> Tuple[bool, Optional[str]]: return False, None -def _raw_provider_api_key(endpoint_id: str) -> str: - """The on-disk (un-expanded) ``api_key`` of a providers entry, or ``""``.""" +def _raw_provider_api_key(endpoint_id: str) -> Any: + """The on-disk (un-expanded) ``api_key`` of a providers entry, or ``None``.""" _stored, entry = find_provider_entry(read_raw_config().get("providers"), endpoint_id) - return str(entry.get("api_key") or "").strip() if isinstance(entry, dict) else "" + return entry.get("api_key") if isinstance(entry, dict) else None def _config_api_key_is_env_ref(endpoint_id: str) -> bool: @@ -366,7 +366,8 @@ def _config_api_key_is_env_ref(endpoint_id: str) -> bool: an entry already keeps its secret out of config.yaml, so migrating it would only copy that secret into a second env var the user didn't ask for. """ - return bool(re.search(r"\$\{[^}]+\}", _raw_provider_api_key(endpoint_id))) + raw_key = _raw_provider_api_key(endpoint_id) + return bool(isinstance(raw_key, str) and re.search(r"\$\{[^}]+\}", raw_key)) def _custom_endpoint_response(cfg: Dict[str, Any]) -> Dict[str, Any]: @@ -591,7 +592,7 @@ def activate_custom_endpoint(endpoint_id: str, profile: Optional[str] = None): # `cfg` is env-expanded, so a raw `${VAR}` api_key would land as # plaintext; copy the raw template when that's what's on disk. try: - _raw_key = _raw_provider_api_key(provider_key) + _raw_key = str(_raw_provider_api_key(provider_key) or "").strip() except Exception: _raw_key = "" if _raw_key.startswith("${") and _raw_key.endswith("}"):