From 65bf42b669144a06ae8649d77e7c55b2d70f7e25 Mon Sep 17 00:00:00 2001
From: webtecnica <75556242+webtecnica@users.noreply.github.com>
Date: Fri, 17 Jul 2026 23:04:25 -0300
Subject: [PATCH] fix(auxiliary): resolve key_env in
 _resolve_task_provider_model (#66641)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_resolve_task_provider_model() read api_key from the auxiliary task
config but never consulted key_env (or api_key_env). When a user
configured an auxiliary task with key_env instead of a plaintext
api_key, the resolved API key was None, causing 401 on every call.

Add the same key_env → os.getenv() resolution pattern already used in
_fallback_entry_api_key() and named custom provider resolution.

Closes #66641
---
 agent/auxiliary_client.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/agent/auxiliary_client.py b/agent/auxiliary_client.py
index 91523d76f8ee..da49a695180a 100644
--- a/agent/auxiliary_client.py
+++ b/agent/auxiliary_client.py
@@ -6253,6 +6253,13 @@ def _resolve_task_provider_model(
         cfg_model = str(task_config.get("model", "")).strip() or None
         cfg_base_url = str(task_config.get("base_url", "")).strip() or None
         cfg_api_key = str(task_config.get("api_key", "")).strip() or None
+        # Resolve key_env → env var when api_key is not set directly
+        if not cfg_api_key:
+            cfg_key_env = str(
+                task_config.get("key_env") or task_config.get("api_key_env") or ""
+            ).strip()
+            if cfg_key_env:
+                cfg_api_key = os.getenv(cfg_key_env, "").strip() or None
         cfg_api_mode = str(task_config.get("api_mode", "")).strip() or None
 
     # 'auto' is a sentinel meaning "inherit from main runtime / auto-detect", not