This issue was filed by Claude Opus 4.6 (via Claude Code) on behalf of the user.

Bug Description

_build_keepalive_http_client() in run_agent.py ignores the no_proxy / NO_PROXY environment variable when constructing the custom httpx.Client. This causes all HTTP requests — including those to localhost / 127.0.0.1 — to be routed through the proxy, even when the user has explicitly excluded them via no_proxy.

Real-World Scenario

A common setup for using Hermes with AWS Bedrock via a local LiteLLM proxy:

Hermes  →  localhost:4000 (LiteLLM Proxy)  →  AWS Bedrock

In a corporate network, outbound traffic goes through a forward proxy (e.g., Squid). The environment is configured as:

export http_proxy="http://corporate-proxy:8118"    # for external traffic
export no_proxy="localhost,127.0.0.1"               # local traffic should bypass proxy

What should happen: Hermes sends requests directly to localhost:4000 (LiteLLM), and LiteLLM uses the proxy to reach AWS Bedrock. The no_proxy setting ensures local traffic stays local.

What actually happens: Hermes ignores no_proxy and sends the localhost:4000 request through the corporate proxy. The proxy rejects it with ERR_ACCESS_DENIED (HTTP 403), because it refuses to forward requests to internal addresses.

As a result, Hermes cannot communicate with the local LiteLLM proxy at all, even though LiteLLM itself is running correctly (verified by direct curl to localhost:4000).

Root Cause

In run_agent.py:4418-4424, a custom httpx.HTTPTransport is created for TCP keepalive. Because httpx disables automatic proxy env detection when a custom transport is provided, the code explicitly reads proxy settings via _get_proxy_from_env().

However, _get_proxy_from_env() (run_agent.py:180-191) only reads proxy URLs (HTTP_PROXY, HTTPS_PROXY, etc.) and never checks no_proxy. The returned proxy URL is then passed directly as proxy=_proxy to httpx.Client(...), which applies it unconditionally to all requests.

# run_agent.py:4418-4425
_proxy = _get_proxy_from_env()          # ← reads http_proxy but ignores no_proxy
return _httpx.Client(
    transport=_httpx.HTTPTransport(socket_options=_sock_opts),
    proxy=_proxy,                        # ← applied to ALL requests including localhost
)

# run_agent.py:180-191
def _get_proxy_from_env() -> Optional[str]:
    for key in ("HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY",
                "https_proxy", "http_proxy", "all_proxy"):
        value = os.environ.get(key, "").strip()
        if value:
            return normalize_proxy_url(value)
    return None
    # ← no_proxy / NO_PROXY is never checked

In contrast, when httpx auto-detects proxies (trust_env=True without custom transport), it correctly parses no_proxy and builds mount-based routing that skips the proxy for matching hosts.

Steps to Reproduce

1. Set environment variables:

   export http_proxy="http://corporate-proxy.example.com:8118"
   export no_proxy="localhost,127.0.0.1"

2. Run a local LiteLLM proxy on localhost:4000 (e.g., bridging to AWS Bedrock)

3. Configure Hermes to use custom:litellm provider with base_url: http://localhost:4000/v1

4. Run hermes chat -q "hello"

Expected: Request goes directly to localhost:4000 (bypassing proxy per no_proxy)

Actual: Request is sent through the corporate proxy, which returns HTTP 403 (ERR_ACCESS_DENIED)

Verification

• curl http://localhost:4000/v1/chat/completions ... works perfectly (curl respects no_proxy)
• python3 -c "import openai; client = openai.OpenAI(base_url='http://localhost:4000/v1', ...); ..." also works (default httpx respects no_proxy)
• Only Hermes fails, because its custom _build_keepalive_http_client() bypasses no_proxy

Workaround

Unset proxy env vars before running Hermes:

alias hermes='http_proxy="" https_proxy="" command hermes'

Then configure proxy explicitly in the LiteLLM startup script, so LiteLLM can still reach external APIs.

Suggested Fix

Option A: Parse no_proxy in _build_keepalive_http_client and use httpx's mount-based routing to exclude matching hosts.

Option B: Instead of passing proxy= directly, replicate httpx's trust_env behavior by building proper proxy mounts that respect no_proxy.

Environment

• Hermes Agent v0.10.0 (commit 3e652f75)
• Python 3.11.8
• httpx 0.28.1
• OpenAI SDK 2.24.0
• macOS Darwin 24.6.0

🤖 This issue was authored by Claude Opus 4.6 (Anthropic) via Claude Code, with human review and approval.