fix(tts): honor config.yaml endpoints across all providers + bounded upstream buffering

[teknium1]

fix(tts): honor config.yaml endpoints/keys across providers + bound upstream buffering and model caches

Consolidated salvage of five contributor PRs. One theme: TTS providers should honor config.yaml endpoints/keys the same way everywhere (class-level base_url parity), plus two bounded-memory fixes.

Config endpoints / keys (fixes #26175)

tts.openai.api_key + base_url from config.yaml — the resolver was env-only (VOICE_TOOLS_OPENAI_KEY/OPENAI_API_KEY) and ignored the tts.openai block. This was first reported and fixed by @zccyman in #26209 (earliest submitter — thank you!) and independently by @LeonSGP43 in #26233; the cherry-picked commit carries the #26233 diff (it shipped with tests) rebased onto the current 3-tuple _resolve_openai_audio_client_config (is_managed flag, post-#73072 layout). Resolution order now mirrors the STT resolver: config → env (still honoring config base_url) → managed gateway. _has_openai_audio_backend also counts a config key as an available backend.

OpenAI streaming path (salvaged from #70307, @aml1973) — OpenAIStreamer read env only; it now uses the shared audio-key resolver and prefers tts.openai.base_url. Follow-up commit completes parity: the streamer also honors tts.openai.api_key in both available() and stream().

Configurable ElevenLabs URLs (salvaged from #66311, @moeadham) — tts.elevenlabs.base_url (+ optional wss_url, derived from base_url when omitted) routes both the sync path and the chunked ElevenLabsStreamer through an ElevenLabsEnvironment, matching the STT side's ELEVENLABS_STT_BASE_URL/config pattern.

Class-level base_url parity audit — swept every cloud provider section: xAI, MiniMax, Gemini, OpenAI and DeepInfra already honored tts.<provider>.base_url; ElevenLabs and Mistral were the gaps. Mistral now passes tts.mistral.base_url as the SDK server_url. Every cloud TTS provider section now supports base_url consistently.

Bounded buffering (fixes #55171)

Bound upstream response bodies (salvaged from #55177, @ooiuuii) — the requests-based providers (xAI, MiniMax, Gemini) buffered the entire upstream body via response.content/response.json() with no cap. New _read_tts_response_bytes() streams with a hard 16 MiB cap (64 KiB chunks) and closes the response; JSON/file-write helpers layer on it. A hostile/broken endpoint can no longer OOM the process.

Bound the Piper/KittenTTS model caches (salvaged from #62977, @Vissirexa — TTS half only; the hindsight turn-buffer half is a different subsystem and was deliberately dropped) — _piper_voice_cache / _kittentts_model_cache had no eviction and each entry is a whole loaded model (tens of MB). New _tts_cache_get_or_load() runs them through a small LRU (_TTS_MODEL_CACHE_MAX=3) with recency refresh on hit.

Commits (contributor authorship preserved)

Commit	Author	Salvaged from
cd7bde218f	@LeonSGP43	#26233 (dupe of earlier #26209 by @zccyman)
e6d631177d	@aml1973	#70307
2290272b0d	ours	follow-up: streaming honors config api_key
851f75b7e2	@moeadham	#66311
ba055b3a80	ours	base_url parity audit (Mistral) + provider config tests
c6087a8981	@ooiuuii	#55177
15673dfce7	@Vissirexa	#62977 (model-cache half)
bd4744cfbc	ours	contributor email mappings

Tests

• tests/tools/test_tts_openai_config.py (6) — config/env/gateway resolution order, error message, backend availability
• tests/tools/test_tts_streaming.py (+3) — streamer honors config base_url and api_key; availability reflects config key
• tests/tools/test_tts_provider_base_urls.py (5) — ElevenLabs environment plumbing (incl. derived wss), Mistral server_url passthrough/omission
• tests/tools/test_tts_response_body_cap.py (10) — cap enforcement, streaming reads, JSON fallback
• tests/tools/test_tts_model_cache_lru.py (3) — load/hit/evict/LRU-recency

All 65 targeted tests pass (pytest -o addopts="" -q tests/tools/test_tts_*); sabotage-verified (disabling the config branch fails the config tests). The two test_tts_xai_speech_tags failures under a combined -k tts run reproduce identically on origin/main (pre-existing test-isolation flake, not introduced here).

Post-merge

• Close TTS tool ignores tts.openai.api_key / tts.openai.base_url in config.yaml — config-only setups cannot reach self-hosted endpoints #26175 (fixed), Built-in TTS providers buffer unbounded upstream responses #55171 (fixed)
• Close fix(tts): read tts.openai.api_key/base_url from config.yaml before env vars #26209 with credit to @zccyman (earliest submitter of the openai config fix)
• Close fix(tts): honor config-only OpenAI audio endpoints #26233, fix(tts): support configurable ElevenLabs URLs #66311, fix(tts): honor OpenAI config for streaming #70307, fix(tts): bound upstream response bodies #55177 as merged-via-salvage
• Comment on fix(hindsight): bound the append-mode session turn buffer #62977: TTS half landed here; hindsight half remains for the memory-subsystem triage

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on bd4744c}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

1 visual diff.

_{inline evidence upload failed.}

Failed to upload diff-665a0833239e-onboarding-overlay-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-665a0833239e-onboarding-overlay-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso)