Jneeee
b98baa3039
Named providers / custom_providers entries in config.yaml now accept an extra_headers dict scoped to that endpoint — for reverse proxies, API gateways, and custom auth schemes (e.g. Cloudflare Access service tokens). - hermes_cli/config.py: normalize extra_headers on provider entries (_normalize_custom_provider_entry + providers-dict translation), add get_custom_provider_extra_headers / apply_custom_provider_extra_headers_to_client_kwargs helpers keyed on base_url (case/trailing-slash insensitive, no substring bypass — mirrors the TLS helpers) - hermes_cli/runtime_provider.py: surface extra_headers in the resolved runtime for named custom providers (providers dict, legacy custom_providers list, and the credential-pool path) - run_agent.py / agent/agent_init.py: merge per-provider extra_headers onto the OpenAI client default_headers at construction and on every _apply_client_headers_for_base_url re-application (credential swaps, rebuilds), most-specific level wins; OpenAI-wire only (native Anthropic/Bedrock scoped out) - agent/auxiliary_client.py: accept model.extra_headers as an alias of model.default_headers for the global variant - cli-config.yaml.example: documented commented example - Header values are treated as secrets and never logged Salvaged from PR #3526 by @jneeee, reimplemented against current main. Co-authored-by: Teknium <127238744+teknium1@users.noreply.github.com>
120 lines
4.1 KiB
Python
120 lines
4.1 KiB
Python
"""Per-provider ``extra_headers`` applied to the OpenAI client (#3526 salvage).
|
|
|
|
Custom providers (``providers`` / ``custom_providers`` in config.yaml) can
|
|
declare an ``extra_headers`` dict that must land on the OpenAI client's
|
|
``default_headers`` at construction and survive header re-application on
|
|
credential swaps / rebuilds. Values may carry credentials — the plumbing must
|
|
never log them.
|
|
"""
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from run_agent import AIAgent
|
|
|
|
_PROXY_URL = "https://llm.internal.example.com/v1"
|
|
_PROXY_CONFIG = {
|
|
"custom_providers": [
|
|
{
|
|
"name": "my-proxy",
|
|
"base_url": _PROXY_URL,
|
|
"api_key": "proxy-key",
|
|
"extra_headers": {
|
|
"CF-Access-Client-Id": "xxxx.access",
|
|
"X-Client-Name": "hermes-agent",
|
|
},
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
@patch("run_agent.OpenAI")
|
|
def test_custom_provider_extra_headers_applied_at_construction(mock_openai):
|
|
mock_openai.return_value = MagicMock()
|
|
with patch("hermes_cli.config.load_config", return_value=_PROXY_CONFIG):
|
|
agent = AIAgent(
|
|
api_key="proxy-key",
|
|
base_url=_PROXY_URL,
|
|
model="my-model",
|
|
provider="custom",
|
|
quiet_mode=True,
|
|
skip_context_files=True,
|
|
skip_memory=True,
|
|
)
|
|
|
|
headers = agent._client_kwargs["default_headers"]
|
|
assert headers["CF-Access-Client-Id"] == "xxxx.access"
|
|
assert headers["X-Client-Name"] == "hermes-agent"
|
|
|
|
|
|
@patch("run_agent.OpenAI")
|
|
def test_extra_headers_not_applied_for_other_base_url(mock_openai):
|
|
mock_openai.return_value = MagicMock()
|
|
with patch("hermes_cli.config.load_config", return_value=_PROXY_CONFIG):
|
|
agent = AIAgent(
|
|
api_key="other-key",
|
|
base_url="http://localhost:8080/v1",
|
|
model="my-model",
|
|
provider="custom",
|
|
quiet_mode=True,
|
|
skip_context_files=True,
|
|
skip_memory=True,
|
|
)
|
|
|
|
headers = agent._client_kwargs.get("default_headers") or {}
|
|
assert "CF-Access-Client-Id" not in headers
|
|
assert "X-Client-Name" not in headers
|
|
|
|
|
|
@patch("run_agent.OpenAI")
|
|
def test_extra_headers_survive_header_reapplication(mock_openai):
|
|
"""_apply_client_headers_for_base_url (credential swaps, rebuilds) must
|
|
re-apply per-provider extra_headers rather than dropping them."""
|
|
mock_openai.return_value = MagicMock()
|
|
with patch("hermes_cli.config.load_config", return_value=_PROXY_CONFIG):
|
|
agent = AIAgent(
|
|
api_key="proxy-key",
|
|
base_url=_PROXY_URL,
|
|
model="my-model",
|
|
provider="custom",
|
|
quiet_mode=True,
|
|
skip_context_files=True,
|
|
skip_memory=True,
|
|
)
|
|
agent._client_kwargs.pop("default_headers", None)
|
|
agent._apply_client_headers_for_base_url(_PROXY_URL)
|
|
|
|
headers = agent._client_kwargs["default_headers"]
|
|
assert headers["CF-Access-Client-Id"] == "xxxx.access"
|
|
|
|
|
|
@patch("run_agent.OpenAI")
|
|
def test_extra_headers_merge_with_global_default_headers(mock_openai):
|
|
"""Per-provider extra_headers win over global model.default_headers on
|
|
key collisions; non-colliding globals are preserved."""
|
|
mock_openai.return_value = MagicMock()
|
|
config = {
|
|
"model": {"default_headers": {"User-Agent": "curl/8.7.1", "X-Global": "1"}},
|
|
"custom_providers": [
|
|
{
|
|
"name": "my-proxy",
|
|
"base_url": _PROXY_URL,
|
|
"api_key": "proxy-key",
|
|
"extra_headers": {"User-Agent": "hermes-proxy", "X-Local": "2"},
|
|
}
|
|
],
|
|
}
|
|
with patch("hermes_cli.config.load_config", return_value=config):
|
|
agent = AIAgent(
|
|
api_key="proxy-key",
|
|
base_url=_PROXY_URL,
|
|
model="my-model",
|
|
provider="custom",
|
|
quiet_mode=True,
|
|
skip_context_files=True,
|
|
skip_memory=True,
|
|
)
|
|
|
|
headers = agent._client_kwargs["default_headers"]
|
|
assert headers["User-Agent"] == "hermes-proxy" # per-provider wins
|
|
assert headers["X-Global"] == "1"
|
|
assert headers["X-Local"] == "2"
|