Upstream issue draft — hermes-muse-code v0.6.0

Title: v0.6.0 loopback wire adapter never receives traffic: profile.base_url mutation is not read by runtime credential resolution (runtime_base_url not overridden)

Component: plugin __init__.py (MuseCodeSubscriptionProfile) vs Hermes hermes_cli/auth.py / providers/base.py

Summary

On Hermes ≥ 0.22.0, resolve_api_key_provider_credentials() (hermes_cli/auth.py:2236) derives the runtime base URL via ProviderProfile.runtime_base_url(...). The base-class implementation returns None (providers/base.py:630), and MuseCodeSubscriptionProfile does not override it. As a result, resolution falls through to _default_api_key_base_url() → pconfig.inference_base_url (https://api.meta.ai/v1), so every inference request goes directly to Meta even though the loopback adapter is running and bound.

Observed (all verified on-disk)

• register() runs; the adapter starts and listens on 127.0.0.1:43219 (DEFAULT_PORTS 43219-43222) in the gateway process (confirmed via lsof).
• The provider profile is constructed with base_url=_adapter_base_url() and _refresh_base_url() keeps it pointed at the loopback URL — but nothing in the runtime resolution path reads profile.base_url. It is a dead write.
• Request dumps show url = https://api.meta.ai/v1/responses (direct, not loopback), with raw (un-aliased) tool names in the payload.
• Meta answers 403 client_attestation_denied ("This API key is billed to a Muse Code subscription... use it in Muse Code") — exactly what the wire adapter exists to prevent.

Note for maintainers

Because base_url_env_var is left empty in the profile constructor, there is also no <PROVIDER>_BASE_URL-style env override users could set as a workaround; the only escape hatches are the code path above or a registry resolver entry.

Suggested minimal fix (inside MuseCodeSubscriptionProfile)

def runtime_base_url(self, *, api_key, default, env_url):
    return self.base_url or None

self.base_url is already maintained at construction and by register() → _refresh_base_url(), so it tracks the adapter (loopback when bound, DEFAULT_BASE_URL fallback otherwise).

Verified live (post-fix)

With the override added (and the plugin correctly registered), the loopback adapter receives traffic and a live subscription request succeeds end-to-end: request goes to http://127.0.0.1:<port>/v1/responses, tool names are aliased on the wire, and Meta answers 200. The override is confirmed necessary and sufficient for routing.

Environment

• Hermes 0.22.x (macOS, arm64), plugin v0.6.0 (commit b419754), subscription credential via device login, MUSE_CODE_SUB_TOKEN set in the profile .env.