v1.0.2: auth-gated service discovery, hermes v0.20 named-provider wiring, ollama-first auto-select, searxng fast probe

README.md

@@ -17,9 +17,24 @@ library_name: docker
 
 # 🏕️ Basecamp — The First Portable AI Agent Container with Network Auto-Discovery
 
+**v1.0.2** — the stack-gauntlet release (tested against a live 6-service AI
+stack):
+- **TabbyAPI + SillyTavern now discovered** — auth-gated services (401/403)
+  are fingerprinted and listed as `[needs auth]` so the connect screen can
+  prompt for keys (previously invisible)
+- **Fixed hermes v0.20 wiring** — named custom provider (`providers.basecamp`)
+  with inline API key, sidestepping the #28660 security gate that blocks env
+  keys for LAN endpoints; reasoning-effort turned off (local engines reject
+  thinking params with HTTP 400); stale context probes cleared
+- **Ollama preferred for auto-select** — hermes hard-requires ≥64K context, so
+  headless mode picks an Ollama endpoint; OpenAI-compatible engines (TabbyAPI,
+  vLLM) are still listed for interactive choice
+- **SearXNG probed via its fast static page** — no more slow search-query probe
+  losing the boot race
+
 **v1.0.1** — rebuilt on the official Hermes installer (the old `pip3 install
 hermes-cli` stub is gone), leaked-key fallback removed from `tavern.sh`, and
-the git history scrubbed of both.
+the git history scrubbed of both. Build from source below.
 
 One image. One command. It finds your AI stack and just works.
 
@@ -65,7 +80,7 @@ install on the host that runs it:
 
 ```bash
 # Option A: pull the prebuilt image (Docker Hub)
-docker pull jpanasuk/basecamp:1.0.1
+docker pull jpanasuk/basecamp:1.0.2
 
 # Option B: build from source
 docker build -t local/basecamp:latest .
@@ -78,7 +93,7 @@ docker run -it --rm \
   -p 11436:11434 \
   -v basecamp-ollama:/root/.ollama \
   -v basecamp-hermes:/root/.hermes \
-  jpanasuk/basecamp:1.0.1
+  jpanasuk/basecamp:1.0.2
 ```
 
 Or use the convenience launcher (auto-detects network + GPU, TTY-safe):

discover.py

@@ -41,6 +41,7 @@ SERVICE_PROBES = {
         "paths": ["/v1/models"],
         "method": "GET",
         "match": lambda r: '"data"' in r and ('"model"' in r.lower() or '"owned_by"' in r or '"id"' in r),
+        "match_auth": lambda r: '"detail"' in r and "api key" in r.lower(),
         "parse": lambda r: {
             "models": [m["id"] for m in json.loads(r).get("data", [])]
         },
@@ -116,9 +117,9 @@ SERVICE_PROBES = {
         "auth_type": "basic",
     },
     "searxng": {
-        "paths": ["/search?q=test&format=json"],
+        "paths": ["/", "/search?q=test&format=json"],
         "method": "GET",
-        "match": lambda r: '"results"' in r,
+        "match": lambda r: "searxng" in r.lower(),
         "parse": lambda r: {},
         "label": "SearXNG (private search)",
         "icon": "SRC",
@@ -153,7 +154,13 @@ COMMON_PORTS = [11434, 5000, 8000, 8080, 8001, 3000, 11435, 11436]
 # ── HTTP helpers ──
 
 def http_get(url, timeout=1, headers=None):
-    """Simple HTTP GET returning response text or None."""
+    """Simple HTTP GET returning response text or None.
+
+    For 401/403 responses, returns the error body (HTTPError bodies are
+    read and returned) so auth-gated services can still be fingerprinted
+    and listed as ``needs_auth`` — otherwise a service behind a 401 wall
+    (TabbyAPI, SillyTavern, ...) is invisible to discovery.
+    """
     try:
         req = urllib.request.Request(url, method="GET")
         if headers:
@@ -161,6 +168,13 @@ def http_get(url, timeout=1, headers=None):
                 req.add_header(k, v)
         with urllib.request.urlopen(req, timeout=timeout) as resp:
             return resp.read().decode("utf-8", errors="replace")
+    except urllib.error.HTTPError as e:
+        if e.code in (401, 403):
+            try:
+                return e.read().decode("utf-8", errors="replace")
+            except Exception:
+                return None
+        return None
     except Exception:
         return None
 
@@ -293,6 +307,26 @@ def scan_network():
                         "needs_auth": probe.get("needs_auth", False),
                         "auth_type": probe.get("auth_type", "bearer"),
                     }
+                # Auth-gated service: the 401/403 body still identifies it
+                # (e.g. TabbyAPI's {"detail":"Please provide an API key"}).
+                # List it as needs_auth so the connect screen can prompt for a key.
+                if (
+                    probe.get("match_auth")
+                    and resp
+                    and probe["match_auth"](resp)
+                ):
+                    return {
+                        "type": svc_type,
+                        "label": probe["label"],
+                        "icon": probe["icon"],
+                        "host": name,
+                        "url": base_url,
+                        "port": port,
+                        "network": net,
+                        "details": {},
+                        "needs_auth": True,
+                        "auth_type": probe.get("auth_type", "bearer"),
+                    }
                 # If service needs auth and we got nothing, try with common defaults
                 if probe.get("needs_auth") and not resp:
                     auth_headers = get_default_auth_headers(probe.get("auth_type", "bearer"))
@@ -391,17 +425,31 @@ def generate_config(services, selected=None, auth_keys=None):
                 else:
                     config[role] = entry
     else:
-        # Auto-select
-        for svc in services:
-            if svc["type"] == "ollama":
-                config["secondary"] = {"type": "ollama", "url": svc["url"], "label": svc["label"]}
-                config["ollama_models"] = svc.get("details", {}).get("models", [])
-            elif svc["type"] in ("tabbyapi", "vllm", "litellm", "localai", "llamacpp", "text-generation-webui") and not config["inference"]:
-                config["inference"] = {"type": svc["type"], "url": svc["url"], "label": svc["label"]}
-                config["openai_models"] = svc.get("details", {}).get("models", [])
-        if not config["inference"] and config["secondary"]:
-            config["inference"] = config["secondary"]
-            config["secondary"] = None
+        # Auto-select. Hermes hard-requires >=64K context (its system prompt
+        # alone is ~16K), so PREFER an Ollama endpoint as inference: Ollama
+        # models are typically served with a 64K+ window, whereas TabbyAPI /
+        # vLLM endpoints on small GPUs are often capped at 8K (exl2/exl3 KV
+        # cache limits) and would be rejected by hermes. OpenAI-compatible
+        # engines are still listed at the connect screen for interactive pick.
+        ollamas = [s for s in services if s["type"] == "ollama"]
+        openai_engines = [s for s in services if s["type"] in (
+            "tabbyapi", "vllm", "litellm", "localai", "llamacpp",
+            "text-generation-webui")]
+        if ollamas:
+            primary = ollamas[0]
+            config["inference"] = {
+                "type": primary["type"], "url": primary["url"],
+                "label": primary["label"]}
+            config["openai_models"] = []
+            config["ollama_models"] = primary.get("details", {}).get("models", [])
+            if len(ollamas) > 1:
+                config["secondary"] = {"type": "ollama", "url": ollamas[1]["url"], "label": ollamas[1]["label"]}
+        elif openai_engines:
+            primary = openai_engines[0]
+            config["inference"] = {
+                "type": primary["type"], "url": primary["url"],
+                "label": primary["label"]}
+            config["openai_models"] = primary.get("details", {}).get("models", [])
         for svc in services:
             if svc["type"] == "searxng":
                 config["search"] = {"type": "searxng", "url": svc["url"], "label": svc["label"]}
@@ -806,7 +854,10 @@ def write_basecamp_env(config):
     env_path.write_text(
         f'export OPENAI_BASE_URL="{base_url}"\n'
         f'export OPENAI_API_KEY="{api_key}"\n'
-        f'export HERMES_MODEL="openai/{default_model}"\n'
+        # bare model id — the base URL already routes to the discovered
+        # engine; an "openai/" prefix is sent literally by hermes and 404s
+        # against ollama's /v1 (model 'openai/llama3.1:8b' not found).
+        f'export HERMES_MODEL="{default_model}"\n'
     )
     try:
         os.chmod(env_path, 0o600)

entrypoint.sh

@@ -61,11 +61,37 @@ if [ -f "$ENV_FILE" ]; then
 fi
 
 # Best-effort: if Hermes has no model configured yet, set it via Hermes' own
-# config CLI (schema-safe) so the first-run wizard doesn't block. This only
-# ever writes inside basecamp's own HERMES_HOME.
+# Best-effort: if Hermes has no model configured yet, set it via Hermes' own
+# config CLI (schema-safe). This only ever writes inside basecamp's own HERMES_HOME.
 if [ -n "${HERMES_MODEL:-}" ] && ! hermes config get model > /dev/null 2>&1; then
     hermes config set model "$HERMES_MODEL" > /dev/null 2>&1 || true
 fi
+# CRITICAL (v0.20+): the stock config.yaml ships a default model+base_url
+# (openrouter), so the guard above never fires and env-only wiring
+# (OPENAI_BASE_URL / OPENAI_API_KEY) is IGNORED for non-authoritative hosts —
+# hermes's #28660 security gate blocks env keys for LAN/custom endpoints and
+# sends the "no-key-required" sentinel instead (auth 401). The sanctioned path
+# is a NAMED custom provider with an inline api_key. Configure it in
+# basecamp's OWN HERMES_HOME (never a host install).
+if [ -n "${OPENAI_BASE_URL:-}" ]; then
+    hermes config set providers.basecamp.api "$OPENAI_BASE_URL" > /dev/null 2>&1 || true
+    hermes config set providers.basecamp.default_model "$HERMES_MODEL" > /dev/null 2>&1 || true
+    if [ -n "${OPENAI_API_KEY:-}" ]; then
+        hermes config set providers.basecamp.api_key "$OPENAI_API_KEY" > /dev/null 2>&1 || true
+    fi
+    hermes config set providers.basecamp.context_length 131072 > /dev/null 2>&1 || true
+    hermes config set model.provider basecamp > /dev/null 2>&1 || true
+    hermes config set model.default "$HERMES_MODEL" > /dev/null 2>&1 || true
+    # Drop the stock openrouter base_url so model.base_url doesn't lie about
+    # where traffic actually goes (the named provider's api is authoritative).
+    hermes config set model.base_url "" > /dev/null 2>&1 || true
+    # Local engines (ollama/tabbyapi/vllm) generally don't support hermes's
+    # reasoning-effort params — sending them yields "does not support thinking"
+    # HTTP 400. Turn reasoning off for the basecamp provider.
+    hermes config set agent.reasoning_effort off > /dev/null 2>&1 || true
+    # Clear stale context probes so the live endpoint is re-queried.
+    rm -f "${HERMES_HOME:-/root/.hermes}/context_length_cache.yaml" 2>/dev/null || true
+fi
 
 echo ""