hermes-admin/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

fix(aux): stop republishing the legacy mirrors from a key rotation

Browse Source 
The rotation tried to decide whether the current runtime was the one
the legacy mirrors were published from, first by key equality and then
by route-tuple equality. Neither identifies the publisher: a scoped
copy with an identical route still matched, and another session could
publish between the comparison and the write (both reproduced by the
second-model verifier). Nothing needs the republish: no production
code reads the legacy globals directly, and _compat_runtime_main()
ignores them while they equal the compat snapshot, which an unchanged
mirror always does. Rotate the published runtime dict in place only,
as before this PR's mirror handling, and pin that an unchanged mirror
never becomes a runtime input.
This commit is contained in:
kshitijk4poor
2026-10-07 11:45:39 +05:30
committed by kshitij
parent dd31854898
commit 4887aba342
2 changed files with 9 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
agent/auxiliary_key_rotation.py
View File

@@ -1,7 +1,6 @@
"""Rotate the published auxiliary main-runtime key after a credential refresh.
Split from ``agent.auxiliary_client`` (facade size cap). It reads the facade's runtime-main state
at call time, so the late import below always sees the current legacy mirror values.
Split from ``agent.auxiliary_client`` (facade size cap).
"""
from __future__ import annotations
@@ -15,16 +14,10 @@ def rotate_runtime_main_api_key(old: Any, new: Any) -> None:
A refresh can run inside a request worker's copied Context, where rebinding the ContextVar
would stay invisible to the turn thread; the published dict is shared, so mutating it is not.
"""
from agent.auxiliary_client import (
_RUNTIME_MAIN_COMPAT_SNAPSHOT, _MAIN_RUNTIME_FIELDS, _RUNTIME_MAIN_CONTEXT, _normalize_api_key,
_publish_runtime_main_mirrors,
)
from agent.auxiliary_client import _RUNTIME_MAIN_CONTEXT, _normalize_api_key
# The legacy mirrors are left alone: _compat_runtime_main() ignores them while they equal the compat
# snapshot, and republishing from here cannot tell which runtime published them.
runtime = _RUNTIME_MAIN_CONTEXT.get()
if isinstance(runtime, dict) and runtime.get("api_key") == old:
# Only the runtime the mirrors were published from may republish them: a scoped runtime (or another
# session's) that happens to share the old key must not overwrite them with its own route.
published = tuple(runtime.get(field, "") for field in _MAIN_RUNTIME_FIELDS) == _RUNTIME_MAIN_COMPAT_SNAPSHOT
runtime["api_key"] = _normalize_api_key(new)
if published:
_publish_runtime_main_mirrors(tuple(runtime.get(field, "") for field in _MAIN_RUNTIME_FIELDS))

14
tests/agent/test_anthropic_third_party_oauth_guard.py
View File

@@ -205,16 +205,12 @@ class TestOAuthFlagOnRefresh:
"anthropic", agent.model, runtime.get("base_url", ""), runtime.get("api_key"), "anthropic_messages",
)
assert seen["api_key"] == new
# A scoped runtime (normalized copy) rotates in place but never reaches the legacy mirrors.
with aux.scoped_runtime_main({"provider": "anthropic", "api_key": old, "model": "m"}):
rotate_runtime_main_api_key(old, new)
assert aux._RUNTIME_MAIN_CONTEXT.get()["api_key"] == new
assert (aux._RUNTIME_MAIN_MODEL, aux._RUNTIME_MAIN_API_KEY) == (agent.model, new)
# Even a scope sharing the still-published old key must not republish its own route.
aux.set_runtime_main("anthropic", agent.model, api_key=old, api_mode="anthropic_messages")
with aux.scoped_runtime_main({"provider": "anthropic", "api_key": old, "model": "m"}):
rotate_runtime_main_api_key(old, new)
# A scoped runtime rotates in place; the legacy mirrors are never republished by a rotation.
with aux.scoped_runtime_main({"provider": "anthropic", "api_key": new, "model": "m"}):
rotate_runtime_main_api_key(new, "sk-ant...cccc")
assert aux._RUNTIME_MAIN_CONTEXT.get()["api_key"] == "sk-ant...cccc"
assert (aux._RUNTIME_MAIN_MODEL, aux._RUNTIME_MAIN_API_KEY) == (agent.model, old)
assert aux._compat_runtime_main() is None # unchanged mirrors never become a runtime input
finally:
aux.clear_runtime_main()