fix(oauth): serialize Anthropic env fallback reads#1768
Closed
franksong2702 wants to merge 1 commit intonesquena:masterfrom
Closed
fix(oauth): serialize Anthropic env fallback reads#1768franksong2702 wants to merge 1 commit intonesquena:masterfrom
franksong2702 wants to merge 1 commit intonesquena:masterfrom
Conversation
pull Bot
pushed a commit
to soitun/hermes-webui
that referenced
this pull request
May 7, 2026
…1778, nesquena#1779) Constituent PRs: - nesquena#1768 (@franksong2702) serialize Anthropic env fallback reads. Closes nesquena#1736. - nesquena#1778 (@Michaelyklam) preserve CLI session tool metadata. Closes nesquena#1772. - nesquena#1779 (@Michaelyklam) reset model picker on session switch. Closes nesquena#1771. AUTO-FIX: Opus stage-310 caught a regression in the new !hasSessionModel branch — it dropped the deferModelCorrection guard that the parallel else-branch keeps. Fired spurious /api/session/update POSTs against imported/read-only CLI sessions whose model field reads 'unknown' (the exact surface nesquena#1778 introduces in this same release). Wrapped the new branch's _persistSessionModelCorrection call + state mutation in if(!deferModelCorrection). Added test_sync_topbar_does_not_persist_correction_while_model_resolution_deferred regression test covering both empty and 'unknown' fast-path interaction. Tests: 4694 → 4702 collected (+8). 4695 passed, 4 skipped, 3 xpassed, 0 failed in 141.29s. Pre-release verification: - All 3 PRs CI-green individually. - node -c clean on static/ui.js. - 11/11 browser API endpoints PASS. - Pre-stamp re-fetch: all PR heads match local rebases. - Opus advisor: SHIP nesquena#1768 + nesquena#1778, nesquena#1779 SHOULD-FIX before merge — auto-fix applied at stage with regression test, re-verified clean. Closes nesquena#1736, nesquena#1771, nesquena#1772.
Collaborator
|
Thanks @franksong2702 — this shipped in v0.51.16 (commit GitHub didn't auto-close because the merge commit only references the squash-merged stage branch, not your fork's commit directly — closing manually for hygiene. Live now on existing installs after Release notes: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.16 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1736.
Root Cause
_clear_anthropic_env_values()removedANTHROPIC_TOKENandANTHROPIC_API_KEYfromos.environafter the.envwrite attempt, outside the shared streaming env lock. Runtime-provider reads in chat/compression/handoff paths also read env fallbacks without that lock, so a concurrent request could observe a semantically half-cleared Anthropic fallback pair or cache a stale value across onboarding.What Changed
api/oauth.py.resolve_runtime_provider_with_anthropic_env_lock()and documented the per-request re-read invariant..envwrite path, and asserts the process env pair is not cleared until the reader releases.Conflict Check
origin/masterat2106083(v0.51.14).api/routes.py) merge-tree check is clean for this branch.api/routes.py) merge-tree check is clean for this branch.DIRTYand conflicts inapi/streaming.py; treated as non-blocking hold-state work rather than a current merge target.Verification
/Users/xuefusong/hermes-webui/.venv_test/bin/python -m pytest tests/test_issue1362_codex_oauth_onboarding.py -q— 24 passed/Users/xuefusong/hermes-webui/.venv_test/bin/python -m pytest tests/test_provider_management.py tests/test_sprint39.py -q— 29 passed/Users/xuefusong/hermes-webui/.venv_test/bin/python -m py_compile api/oauth.py api/streaming.py api/routes.py— passedgit diff --check— passed