fix(api): apply api_key_env/base_url in PATCH /api/agents/{id}/config instead of dropping them#6303
Merged
Merged
Conversation
github-actions
Bot
added
area/docs
houko
force-pushed
the
fix/agent-config-api-key-env-base-url
branch
2 times, most recently
from
June 24, 2026 01:09
ed793be to
7abbe89
Compare
houko
enabled auto-merge (squash)
June 24, 2026 01:22
github-actions
Bot
added
the
has-conflicts
houko
force-pushed
the
fix/agent-config-api-key-env-base-url
branch
from
June 24, 2026 01:27
7abbe89 to
51385c1
Compare
github-actions
Bot
added
ready-for-review
… instead of dropping them PatchAgentConfigRequest declares api_key_env and base_url and the OpenAPI schema for /config advertises both, but patch_agent_config never read them — only the sibling patch_hand_agent_runtime_config did. A client that switched a non-hand agent to a custom provider plus its credential env var / base URL in one PATCH /config call got 200 while the two fields were silently discarded, leaving the agent on stale credentials/URL (the #2380 class of failure). /config now applies them via update_model_provider_config after set_agent_model (which clears stale overrides on a provider change). Tri-state per field: a non-empty value sets it, an empty/whitespace value clears it, an absent field is left unchanged (merged against the current value so sending one field does not wipe the other). No OpenAPI change — the schema already advertised these fields; this makes behavior match the contract. Adds integration tests for the apply path and the empty-string-clears / absent-preserves semantics.
houko
force-pushed
the
fix/agent-config-api-key-env-base-url
branch
from
June 24, 2026 03:17
51385c1 to
02d7876
Compare
github-actions
Bot
added
ready-for-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PatchAgentConfigRequestis shared by two endpoints and declaresapi_key_env: Option<String>andbase_url: Option<String>. The OpenAPI schema forPATCH /api/agents/{id}/configadvertises both as settable, butpatch_agent_confignever read them — the only consumer of those two fields was the siblingpatch_hand_agent_runtime_config(hand agents only).So a non-dashboard API/SDK client that set a custom provider plus its credential env var or base URL in one
PATCH /configcall got200 {"status":"ok"}whileapi_key_envandbase_urlwere silently discarded. The agent stayed pointed at stale credentials / URL — exactly the failure the in-code comment at the model-update block documents (#2380: provider rejects the request with "Missing Authentication header").Fix
/confignow applies both fields via the existingAgentRegistry::update_model_provider_config, run afterset_agent_model(which clears staleapi_key_env/base_urlon a provider change, so the override must be re-applied after it).Tri-state per field, merged against the current value:
Some(non-empty)→ set itSome(empty / whitespace)→ clear itNone(field absent) → leave unchanged (so sending only one field does not wipe the other)No OpenAPI change — the schema already advertised these fields; this makes the behavior match the published contract, so no
openapi.jsonregeneration is required.Tests
Adds two
#[tokio::test]cases toagents_routes_integration.rs(read-back is via the registry, since no GET endpoint exposesapi_key_env):test_patch_config_applies_api_key_env_and_base_url— both fields land on the manifest.test_patch_config_empty_string_clears_api_key_env_but_preserves_base_url— empty string clears, absent field is preserved.Verification
This host has no native Rust toolchain and no working container runtime, so local
cargoverification was not possible — CI is the gate. Reviewers / CI:cargo test -p librefang-api.Scope
One of several independent findings from a repo audit; filed as its own PR per the one-PR-one-domain policy.