Prevent leaking parent provider config by discarding inherited options for different services#312
Conversation
…s for different services
There was a problem hiding this comment.
Pull request overview
Fixes a configuration inheritance bug where a child agent switching to a different provider service could unintentionally inherit (and override) its own provider settings with parent provider options.
Changes:
- When
generate_withdetects a provider:servicechange between parent and child, it now discards all inherited options (instead of only stripping:serviceand:api_version). - Adds clarifying inline comments explaining the rationale (prevent leaking host/api_key/model, etc.).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Different Service, different APIs — discard all inherited options | ||
| # to prevent parent provider config (host, api_key, etc.) leaking through | ||
| if global_options[:service] != inherited_options[:service] | ||
| inherited_options.extract!(:service, :api_version) | ||
| inherited_options = {} | ||
| end |
There was a problem hiding this comment.
This changes provider option inheritance behavior in a subtle way (clearing all inherited options when the service changes), but there’s no automated test coverage validating the new behavior. Please add tests that cover: (1) parent/child with different service does not inherit provider-specific keys like host/api_key/model, and (2) same-service inheritance still works, and (3) explicit generate_with overrides still win over YAML config/inheritance.
Prevent parent provider config leaking when child agent switches service
Fixes #304
Summary
:serviceand:api_versionRoot cause
When a child agent overrides
generate_withwith a different provider (e.g. parent uses Ollama, child uses Azure), the merge ingenerate_withonly removed:serviceand:api_versionfrom inherited options. All other parent options (:host,:api_key,:model, etc.) survived and — because the merge order isglobal_options.merge(inherited_options)— overrode the child's YAML config. This caused requests to hit the wrong endpoint with the wrong credentials.Fix
When
global_options[:service] != inherited_options[:service], replaceinherited_options.extract!(:service, :api_version)withinherited_options = {}. This gives the child a clean slate from its own YAML config when switching providers, while preserving same-provider inheritance (e.g. a child that only tweakstemperature).Test plan
generate_withprovider uses its own YAML config (host, api_key, model)generate_with :azure, model: 'gpt-4.1') still take precedence