… instead of dropping them

PatchAgentConfigRequest declares api_key_env and base_url and the OpenAPI schema for /config advertises both, but patch_agent_config never read them — only the sibling patch_hand_agent_runtime_config did.
A client that switched a non-hand agent to a custom provider plus its credential env var / base URL in one PATCH /config call got 200 while the two fields were silently discarded, leaving the agent on stale credentials/URL (the #2380 class of failure).

/config now applies them via update_model_provider_config after set_agent_model (which clears stale overrides on a provider change). Tri-state per field: a non-empty value sets it, an empty/whitespace value clears it, an absent field is left unchanged (merged against the current value so sending one field does not wipe the other).

No OpenAPI change — the schema already advertised these fields; this makes behavior match the contract. Adds integration tests for the apply path and the empty-string-clears / absent-preserves semantics.

… instead of dropping them

PatchAgentConfigRequest declares api_key_env and base_url and the OpenAPI schema for /config advertises both, but patch_agent_config never read them — only the sibling patch_hand_agent_runtime_config did.
A client that switched a non-hand agent to a custom provider plus its credential env var / base URL in one PATCH /config call got 200 while the two fields were silently discarded, leaving the agent on stale credentials/URL (the #2380 class of failure).

/config now applies them via update_model_provider_config after set_agent_model (which clears stale overrides on a provider change). Tri-state per field: a non-empty value sets it, an empty/whitespace value clears it, an absent field is left unchanged (merged against the current value so sending one field does not wipe the other).

No OpenAPI change — the schema already advertised these fields; this makes behavior match the contract. Adds integration tests for the apply path and the empty-string-clears / absent-preserves semantics.

… instead of dropping them

PatchAgentConfigRequest declares api_key_env and base_url and the OpenAPI schema for /config advertises both, but patch_agent_config never read them — only the sibling patch_hand_agent_runtime_config did.
A client that switched a non-hand agent to a custom provider plus its credential env var / base URL in one PATCH /config call got 200 while the two fields were silently discarded, leaving the agent on stale credentials/URL (the #2380 class of failure).

/config now applies them via update_model_provider_config after set_agent_model (which clears stale overrides on a provider change). Tri-state per field: a non-empty value sets it, an empty/whitespace value clears it, an absent field is left unchanged (merged against the current value so sending one field does not wipe the other).

No OpenAPI change — the schema already advertised these fields; this makes behavior match the contract. Adds integration tests for the apply path and the empty-string-clears / absent-preserves semantics.

… instead of dropping them

PatchAgentConfigRequest declares api_key_env and base_url and the OpenAPI schema for /config advertises both, but patch_agent_config never read them — only the sibling patch_hand_agent_runtime_config did.
A client that switched a non-hand agent to a custom provider plus its credential env var / base URL in one PATCH /config call got 200 while the two fields were silently discarded, leaving the agent on stale credentials/URL (the #2380 class of failure).

/config now applies them via update_model_provider_config after set_agent_model (which clears stale overrides on a provider change). Tri-state per field: a non-empty value sets it, an empty/whitespace value clears it, an absent field is left unchanged (merged against the current value so sending one field does not wipe the other).

No OpenAPI change — the schema already advertised these fields; this makes behavior match the contract. Adds integration tests for the apply path and the empty-string-clears / absent-preserves semantics.

… instead of dropping them (#6303)

PatchAgentConfigRequest declares api_key_env and base_url and the OpenAPI schema for /config advertises both, but patch_agent_config never read them — only the sibling patch_hand_agent_runtime_config did.
A client that switched a non-hand agent to a custom provider plus its credential env var / base URL in one PATCH /config call got 200 while the two fields were silently discarded, leaving the agent on stale credentials/URL (the #2380 class of failure).

/config now applies them via update_model_provider_config after set_agent_model (which clears stale overrides on a provider change). Tri-state per field: a non-empty value sets it, an empty/whitespace value clears it, an absent field is left unchanged (merged against the current value so sending one field does not wipe the other).

No OpenAPI change — the schema already advertised these fields; this makes behavior match the contract. Adds integration tests for the apply path and the empty-string-clears / absent-preserves semantics.