feat: vision fallback auth

core/framework/agent_loop/agent_loop.py

@@ -219,8 +219,20 @@ async def _captioning_chain(
     logger.warning("vision_fallback failed; retrying configured model")
     if result := await caption_tool_image(intent, image_content):
         return result
-    logger.warning("vision_fallback retry failed; trying gemini-3-flash-preview")
-    return await caption_tool_image(intent, image_content, model_override="gemini/gemini-3-flash-preview")
+    # Match the configured model's proxy prefix so the override is routed
+    # through the same endpoint with the same auth shape. Without this,
+    # a Hive subscriber's `hive/...` config would override to
+    # `gemini/...` — which sends Google's Gemini protocol to the
+    # Anthropic-compatible Hive proxy (404), not what we want.
+    configured = (get_vision_fallback_model() or "").lower()
+    if configured.startswith("hive/"):
+        override = "hive/gemini-3-flash-preview"
+    elif configured.startswith("kimi/"):
+        override = "kimi/gemini-3-flash-preview"
+    else:
+        override = "gemini/gemini-3-flash-preview"
+    logger.warning("vision_fallback retry failed; trying %s", override)
+    return await caption_tool_image(intent, image_content, model_override=override)
 
 
 # Pattern for detecting context-window-exceeded errors across LLM providers.

core/framework/agent_loop/internals/vision_fallback.py

@@ -213,10 +213,12 @@ async def caption_tool_image(
         "max_tokens": 8192,
         "timeout": timeout_s,
     }
-    # Pass api_key directly only when there are no proxy-rewritten
-    # extra_headers carrying the auth (e.g. the gemini-3-flash override
-    # path goes direct to Gemini, not through the Hive proxy).
-    if api_key and not extra_headers:
+    # Always pass api_key when we have one, even alongside proxy-rewritten
+    # extra_headers. litellm's anthropic handler refuses to dispatch
+    # without an api_key (it sends it as x-api-key); the proxy itself
+    # authenticates via the Authorization: Bearer header in
+    # extra_headers. Both are needed — matches LiteLLMProvider's path.
+    if api_key:
         kwargs["api_key"] = api_key
     if rewritten_base:
         kwargs["api_base"] = rewritten_base