feat(image_gen): support configurable endpoint, credential routing, and proxy bypass for OpenAI image generation - #65323
Open
asdlem wants to merge 2 commits into
Open
Conversation
Allow the OpenAI image generation provider to read endpoint and credential source from config.yaml: image_gen.openai.base_url → explicit endpoint (fallback: OPENAI_BASE_URL) image_gen.openai.key_env → env var holding the API key (fallback: OPENAI_API_KEY) Also fixes the proxy-bypass gap: the image client now uses build_keepalive_http_client() (same helper the main LLM and auxiliary clients use), so macOS system proxy settings no longer intercept localhost image endpoint calls. Fixes NousResearch#65309
alt-glitch
added
type/feature
Collaborator
teknium1
reviewed
Jul 16, 2026
teknium1
left a comment
teknium1
left a comment
Contributor
There was a problem hiding this comment.
Thanks for addressing a verified configuration gap in the OpenAI image provider.
Problems
- The new resolution and transport path has no regression coverage. Current tests cover only
OPENAI_API_KEYand tier resolution (tests/plugins/image_gen/test_openai_provider.py:74-121), while this PR changes onlyplugins/image_gen/openai/__init__.py. - The new
image_gen.openai.base_urlandkey_envcontract is not documented. The current image-generation guide still describes OpenAI credentials only asOPENAI_API_KEY(website/docs/user-guide/features/image-generation.md:193-196).
Suggested changes
- Add temporary-
HERMES_HOMEtests for endpoint/key precedence,is_available(), configured client arguments, and the macOS system-proxy-bypass case. The analogous proxy test pattern istests/agent/test_auxiliary_client_proxy_env.py:61-79. - Document the two new image-provider settings and their fallback order.
Automated hermes-sweeper review.
| @@ -118,6 +123,52 @@ def _resolve_model() -> Tuple[str, Dict[str, Any]]: | |||
| return DEFAULT_MODEL, _MODELS[DEFAULT_MODEL] | |||
Contributor
There was a problem hiding this comment.
Please add focused temporary-HERMES_HOME coverage for this resolver: config-vs-environment precedence, key_env availability/generation behavior, and propagation into openai.OpenAI(). The current provider tests only cover OPENAI_API_KEY and tier resolution.
teknium1
added
sweeper:risk-security-boundary
Address review feedback from NousResearch#65323 — add TestCredentialResolution class covering base_url/key_env precedence, fallback chains, and proxy-bypass transport logic. Document the two new config options (base_url, key_env) with their fallback order in the image-generation user guide.
This was referenced Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #65309
Summary
Single canonical fix that gives the OpenAI image gen provider three
capabilities it currently lacks:
Configurable endpoint —
image_gen.openai.base_urlsets theAPI base URL (falls back to
OPENAI_BASE_URL→ SDK default).This enables routing through local gateways, task-scoped proxies,
and third-party OpenAI-compatible backends. Related: fix(plugins): support OPENAI_IMAGE_API_MODEL env var + base_url config for third-party backends #18796.
Credential routing via
key_env—image_gen.openai.key_envpoints to an env var holding the API key. The token itself is
never written to
config.yaml. This enables task-scoped tokensfrom gateway/injection systems (e.g., Workbench).
Proxy-bypass client — the image client now uses the shared
build_keepalive_http_client()transport so macOS system proxysettings no longer intercept localhost image endpoints.
Config example
Precedence (per-call)
Related