Cairn
NousResearch/hermes-agent

API key inheritance scoped to exact origin match

Cluster 126104. Data as of

Nothing open on GitHub. Fix merged in #130508 on 3 Oct 2026. Check it covers your case.

The short answer

0open issues
0open PRs
4items grouped
Known?
Yes. 4 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #130508. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #130508. That is separate from the fix event.
Still open
Nothing open on GitHub.

A bug was identified where the auxiliary client incorrectly inherits the main API key based on hostname alone, ignoring scheme and port. Fixes narrow the inheritance logic to require a full origin match instead.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #130508 Auxiliary clients and the OpenRouter mirror send the main or OPENAI_BASE_URL-bound API key only to its exact origin (#126104, #126218, salvage #126108, #126222)

    merged to main

    files: agent/auxiliary_client.py, hermes_cli/runtime_provider_backends.py, tests/agent/test_auxiliary_client.py, tests/agent/test_auxiliary_ollama_local_provider.py, tests/hermes_cli/test_runtime_provider_resolution.py, website/docs/reference/environment-variables.md, website/docs/user-guide/configuration.md, website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/reference/environment-variables.md, website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/configuration.md

2 PRs closed without merging

From the close comments: merged via another change 1 · superseded by another PR 1

  • #126108 fix(auxiliary): inherit the main API key only on the identical origin · merged via another change → de64070, #130508
  • #127663 fix(agent): inherit the main API key for aux endpoints on origin match, not hostname · superseded by another PR → de64070, #130508
Closed issues · 1
  • Closed#126104[Bug]: auxiliary client inherits the main API key on a hostname match, ignoring scheme and port
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#130508
Closed issues
1
Attempts
2 PRs closed without merging
Fix link checked
3 Oct 2026

For your agent

The same facts, typed.

cluster/126104.json
cluster/126104.md