From 5577ae8a3915ddba8ee83ff1b41bbfa7f9385a18 Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 14:43:09 -0400
Subject: [PATCH 01/18] feat: Add comprehensive OpenAI base URL configuration
 support

This commit implements comprehensive support for custom OpenAI base URL
configuration throughout the entire Archon system, enabling users to route
OpenAI API calls through proxies like LiteLLM, Azure OpenAI, or other
OpenAI-compatible endpoints.

## Key Changes:

### Backend Services
- Enhanced credential_service.py to support OPENAI_BASE_URL setting
- Updated llm_provider_service.py to use custom base_url for AsyncOpenAI clients
- Modified code_storage_service.py to support base_url for sync OpenAI clients

### PydanticAI Agent Integration
- Created new agent_provider_config.py for centralized provider configuration
- Updated base_agent.py to support async initialization with custom providers
- Modified rag_agent.py and document_agent.py to use configured providers
- Updated agent server.py to handle async provider initialization

### Frontend UI
- Enhanced RAGSettings.tsx with conditional OpenAI base URL input field
- Added OPENAI_BASE_URL to TypeScript interface
- Field appears only when OpenAI is selected as provider

## Features:
- Optional configuration (backwards compatible)
- Consistent behavior across all OpenAI usage points
- Secure encrypted storage in database
- Comprehensive error handling and fallbacks
- Support for LiteLLM, Azure OpenAI, and other compatible endpoints

## Testing:
- All Python files compile without syntax errors
- Linting issues addressed
- No breaking changes to existing functionality

Resolves: https://github.com/coleam00/Archon/issues/584
---
 .../src/components/settings/RAGSettings.tsx   |  15 ++
 python/src/agents/agent_provider_config.py    | 131 ++++++++++++++++++
 python/src/agents/base_agent.py               |  39 +++++-
 python/src/agents/document_agent.py           |   7 +-
 python/src/agents/rag_agent.py                |   7 +-
 python/src/agents/server.py                   |   3 +-
 .../src/server/services/credential_service.py |   3 +
 .../server/services/llm_provider_service.py   |  11 +-
 .../services/storage/code_storage_service.py  |  30 ++--
 9 files changed, 224 insertions(+), 22 deletions(-)
 create mode 100644 python/src/agents/agent_provider_config.py

diff --git a/archon-ui-main/src/components/settings/RAGSettings.tsx b/archon-ui-main/src/components/settings/RAGSettings.tsx
index 3dfcd220f9..ee4540a3f3 100644
--- a/archon-ui-main/src/components/settings/RAGSettings.tsx
+++ b/archon-ui-main/src/components/settings/RAGSettings.tsx
@@ -17,6 +17,7 @@ interface RAGSettingsProps {
     USE_RERANKING: boolean;
     LLM_PROVIDER?: string;
     LLM_BASE_URL?: string;
+    OPENAI_BASE_URL?: string;
     EMBEDDING_MODEL?: string;
     // Crawling Performance Settings
     CRAWL_BATCH_SIZE?: number;
@@ -85,6 +86,20 @@ export const RAGSettings = ({
               />
             </div>
           )}
+          {ragSettings.LLM_PROVIDER === 'openai' && (
+            <div>
+              <Input
+                label="OpenAI Base URL (optional)"
+                value={ragSettings.OPENAI_BASE_URL || ''}
+                onChange={e => setRagSettings({
+                  ...ragSettings,
+                  OPENAI_BASE_URL: e.target.value
+                })}
+                placeholder="https://api.openai.com/v1"
+                accentColor="green"
+              />
+            </div>
+          )}
           <div className="flex items-end">
             <Button 
               variant="outline" 
diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
new file mode 100644
index 0000000000..0133a21535
--- /dev/null
+++ b/python/src/agents/agent_provider_config.py
@@ -0,0 +1,131 @@
+"""
+Agent Provider Configuration
+
+Handles OpenAI provider configuration for PydanticAI agents.
+Enables custom base_url configuration for OpenAI-compatible endpoints.
+"""
+
+import logging
+import os
+
+from pydantic_ai.models.openai import OpenAIChatModel
+from pydantic_ai.providers.openai import OpenAIProvider
+
+logger = logging.getLogger(__name__)
+
+
+async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
+    """
+    Get a configured OpenAI model for PydanticAI agents.
+    
+    If OPENAI_BASE_URL is configured in the system, returns an OpenAIChatModel
+    with a custom OpenAIProvider. Otherwise, returns the standard model string
+    format that PydanticAI handles automatically.
+    
+    Args:
+        model_name: The model name (e.g., "gpt-4o", "gpt-4o-mini")
+        
+    Returns:
+        Either an OpenAIChatModel with custom provider or a model string
+    """
+    try:
+        # Try to get base URL from credential service
+        base_url = await _get_openai_base_url()
+
+        if base_url:
+            # Get API key
+            api_key = await _get_openai_api_key()
+            if not api_key:
+                logger.warning("OPENAI_BASE_URL is configured but no API key found, falling back to default")
+                return f"openai:{model_name}"
+
+            # Create custom provider with base_url
+            provider = OpenAIProvider(
+                base_url=base_url,
+                api_key=api_key
+            )
+
+            logger.info(f"Creating OpenAI model {model_name} with custom base URL: {base_url}")
+            return OpenAIChatModel(model_name, provider=provider)
+        else:
+            # No custom base URL, use standard string format
+            logger.debug(f"Using default OpenAI configuration for model: {model_name}")
+            return f"openai:{model_name}"
+
+    except Exception as e:
+        logger.error(f"Error configuring OpenAI model: {e}")
+        # Fallback to standard string format
+        return f"openai:{model_name}"
+
+
+async def _get_openai_base_url() -> str | None:
+    """Get OpenAI base URL from credential service."""
+    try:
+        # Import here to avoid circular imports
+        from ..server.services.credential_service import credential_service
+
+        # Get RAG settings which contain OPENAI_BASE_URL
+        rag_settings = await credential_service.get_credentials_by_category("rag_strategy")
+        base_url = rag_settings.get("OPENAI_BASE_URL")
+
+        if base_url:
+            logger.debug(f"Found OPENAI_BASE_URL in settings: {base_url}")
+            return base_url
+        else:
+            # Check environment variable as fallback
+            env_base_url = os.getenv("OPENAI_BASE_URL")
+            if env_base_url:
+                logger.debug(f"Found OPENAI_BASE_URL in environment: {env_base_url}")
+                return env_base_url
+
+        return None
+
+    except Exception as e:
+        logger.debug(f"Could not get OPENAI_BASE_URL from settings: {e}")
+        # Try environment variable as fallback
+        return os.getenv("OPENAI_BASE_URL")
+
+
+async def _get_openai_api_key() -> str | None:
+    """Get OpenAI API key from credential service."""
+    try:
+        # Import here to avoid circular imports
+        from ..server.services.credential_service import credential_service
+
+        # Try to get from credential service first
+        api_key = await credential_service.get_credential("OPENAI_API_KEY", decrypt=True)
+        if api_key:
+            logger.debug("Found OPENAI_API_KEY in credential service")
+            return api_key
+
+        # Fallback to environment variable
+        env_api_key = os.getenv("OPENAI_API_KEY")
+        if env_api_key:
+            logger.debug("Found OPENAI_API_KEY in environment")
+            return env_api_key
+
+        return None
+
+    except Exception as e:
+        logger.debug(f"Could not get OPENAI_API_KEY from settings: {e}")
+        # Try environment variable as fallback
+        return os.getenv("OPENAI_API_KEY")
+
+
+def get_configured_openai_model_sync(model_name: str) -> str:
+    """
+    Synchronous version that returns model string format.
+    
+    Since we can't easily call async functions from sync contexts,
+    this returns the standard model string format and relies on
+    PydanticAI's automatic configuration.
+    
+    Args:
+        model_name: The model name (e.g., "gpt-4o", "gpt-4o-mini")
+        
+    Returns:
+        Model string in "openai:model" format
+    """
+    # For synchronous contexts, we use the standard format
+    # PydanticAI will handle OpenAI configuration automatically
+    return f"openai:{model_name}"
diff --git a/python/src/agents/base_agent.py b/python/src/agents/base_agent.py
index 7ea03c031f..f3873d654e 100644
--- a/python/src/agents/base_agent.py
+++ b/python/src/agents/base_agent.py
@@ -156,12 +156,14 @@ def __init__(
         name: str = None,
         retries: int = 3,
         enable_rate_limiting: bool = True,
+        use_custom_provider: bool = True,
         **agent_kwargs,
     ):
         self.model = model
         self.name = name or self.__class__.__name__
         self.retries = retries
         self.enable_rate_limiting = enable_rate_limiting
+        self.use_custom_provider = use_custom_provider
 
         # Initialize rate limiting
         if self.enable_rate_limiting:
@@ -169,16 +171,38 @@ def __init__(
         else:
             self.rate_limiter = None
 
-        # Initialize the PydanticAI agent
-        self._agent = self._create_agent(**agent_kwargs)
-
         # Setup logging
         self.logger = logging.getLogger(f"agents.{self.name}")
+        
+        # Initialize the PydanticAI agent (this may be async now)
+        self._agent = None
+        self._agent_kwargs = agent_kwargs
 
     @abstractmethod
-    def _create_agent(self, **kwargs) -> Agent:
+    async def _create_agent(self, **kwargs) -> Agent:
         """Create and configure the PydanticAI agent. Must be implemented by subclasses."""
         pass
+    
+    async def _ensure_agent_initialized(self):
+        """Ensure the PydanticAI agent is initialized."""
+        if self._agent is None:
+            self._agent = await self._create_agent(**self._agent_kwargs)
+    
+    async def _get_configured_model(self):
+        """Get the configured model for this agent."""
+        if self.use_custom_provider and self.model.startswith("openai:"):
+            # Extract model name from "openai:model" format
+            model_name = self.model.replace("openai:", "")
+            
+            try:
+                from .agent_provider_config import get_configured_openai_model
+                return await get_configured_openai_model(model_name)
+            except Exception as e:
+                self.logger.warning(f"Failed to get custom OpenAI provider, falling back to default: {e}")
+                return self.model
+        else:
+            # Use the model string as-is
+            return self.model
 
     @abstractmethod
     def get_system_prompt(self) -> str:
@@ -208,6 +232,9 @@ async def run(self, user_prompt: str, deps: DepsT) -> OutputT:
     async def _run_agent(self, user_prompt: str, deps: DepsT) -> OutputT:
         """Internal method to run the agent."""
         try:
+            # Ensure agent is initialized
+            await self._ensure_agent_initialized()
+            
             # Add timeout to prevent hanging
             result = await asyncio.wait_for(
                 self._agent.run(user_prompt, deps=deps),
@@ -223,7 +250,7 @@ async def _run_agent(self, user_prompt: str, deps: DepsT) -> OutputT:
             self.logger.error(f"Agent {self.name} failed: {str(e)}")
             raise
 
-    def run_stream(self, user_prompt: str, deps: DepsT):
+    async def run_stream(self, user_prompt: str, deps: DepsT):
         """
         Run the agent with streaming output.
 
@@ -236,6 +263,8 @@ def run_stream(self, user_prompt: str, deps: DepsT):
         """
         # Note: Rate limiting not supported for streaming to avoid complexity
         # The async context manager pattern doesn't work well with rate limiting
+        await self._ensure_agent_initialized()
+        
         self.logger.info(f"Starting streaming for agent {self.name}")
         # run_stream returns an async context manager directly, not a coroutine
         return self._agent.run_stream(user_prompt, deps=deps)
diff --git a/python/src/agents/document_agent.py b/python/src/agents/document_agent.py
index 9e9c5fbfc7..1d2e9d19c3 100644
--- a/python/src/agents/document_agent.py
+++ b/python/src/agents/document_agent.py
@@ -70,11 +70,14 @@ def __init__(self, model: str = None, **kwargs):
             model=model, name="DocumentAgent", retries=3, enable_rate_limiting=True, **kwargs
         )
 
-    def _create_agent(self, **kwargs) -> Agent:
+    async def _create_agent(self, **kwargs) -> Agent:
         """Create the PydanticAI agent with tools and prompts."""
+        
+        # Get the configured model (may be custom provider or default)
+        configured_model = await self._get_configured_model()
 
         agent = Agent(
-            model=self.model,
+            model=configured_model,
             deps_type=DocumentDependencies,
             result_type=DocumentOperation,
             system_prompt="""You are a Document Management Assistant that helps users create, update, and modify project documents through conversation.
diff --git a/python/src/agents/rag_agent.py b/python/src/agents/rag_agent.py
index 3c1fac0ab6..2d6c6e2727 100644
--- a/python/src/agents/rag_agent.py
+++ b/python/src/agents/rag_agent.py
@@ -68,11 +68,14 @@ def __init__(self, model: str = None, **kwargs):
             model=model, name="RagAgent", retries=3, enable_rate_limiting=True, **kwargs
         )
 
-    def _create_agent(self, **kwargs) -> Agent:
+    async def _create_agent(self, **kwargs) -> Agent:
         """Create the PydanticAI agent with tools and prompts."""
+        
+        # Get the configured model (may be custom provider or default)
+        configured_model = await self._get_configured_model()
 
         agent = Agent(
-            model=self.model,
+            model=configured_model,
             deps_type=RagDependencies,
             system_prompt="""You are a RAG (Retrieval-Augmented Generation) Assistant that helps users search and understand documentation through conversation.
 
diff --git a/python/src/agents/server.py b/python/src/agents/server.py
index be665836b3..77fd5d9e97 100644
--- a/python/src/agents/server.py
+++ b/python/src/agents/server.py
@@ -251,7 +251,8 @@ async def generate() -> AsyncGenerator[str, None]:
 
             # Use PydanticAI's run_stream method
             # run_stream returns an async context manager directly
-            async with agent.run_stream(request.prompt, deps) as stream:
+            stream_cm = await agent.run_stream(request.prompt, deps)
+            async with stream_cm as stream:
                 # Stream text chunks as they arrive
                 async for chunk in stream.stream_text():
                     event_data = json.dumps({"type": "stream_chunk", "content": chunk})
diff --git a/python/src/server/services/credential_service.py b/python/src/server/services/credential_service.py
index 017c3b2af1..479ab8621e 100644
--- a/python/src/server/services/credential_service.py
+++ b/python/src/server/services/credential_service.py
@@ -458,6 +458,9 @@ def _get_provider_base_url(self, provider: str, rag_settings: dict) -> str | Non
             return rag_settings.get("LLM_BASE_URL", "http://localhost:11434/v1")
         elif provider == "google":
             return "https://generativelanguage.googleapis.com/v1beta/openai/"
+        elif provider == "openai":
+            # Allow custom OpenAI-compatible endpoint
+            return rag_settings.get("OPENAI_BASE_URL")
         return None  # Use default for OpenAI
 
     async def set_active_provider(self, provider: str, service_type: str = "llm") -> bool:
diff --git a/python/src/server/services/llm_provider_service.py b/python/src/server/services/llm_provider_service.py
index d7c834f9f2..dba1414f50 100644
--- a/python/src/server/services/llm_provider_service.py
+++ b/python/src/server/services/llm_provider_service.py
@@ -97,8 +97,15 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
             if not api_key:
                 raise ValueError("OpenAI API key not found")
 
-            client = openai.AsyncOpenAI(api_key=api_key)
-            logger.info("OpenAI client created successfully")
+            # Create client with optional base_url for custom OpenAI-compatible endpoints
+            client_kwargs = {"api_key": api_key}
+            if base_url:
+                client_kwargs["base_url"] = base_url
+                logger.info(f"OpenAI client created with custom base URL: {base_url}")
+            else:
+                logger.info("OpenAI client created with default URL")
+
+            client = openai.AsyncOpenAI(**client_kwargs)
 
         elif provider_name == "ollama":
             # Ollama requires an API key in the client but doesn't actually use it
diff --git a/python/src/server/services/storage/code_storage_service.py b/python/src/server/services/storage/code_storage_service.py
index cacc7d7d12..f220544c89 100644
--- a/python/src/server/services/storage/code_storage_service.py
+++ b/python/src/server/services/storage/code_storage_service.py
@@ -542,26 +542,36 @@ def generate_code_example_summary(
             import openai
 
             api_key = os.getenv("OPENAI_API_KEY")
-            if not api_key:
-                # Try to get from credential service with direct fallback
-                from ..credential_service import credential_service
+            base_url = None
 
-                if (
-                    credential_service._cache_initialized
-                    and "OPENAI_API_KEY" in credential_service._cache
-                ):
+            # Try to get from credential service with direct fallback
+            from ..credential_service import credential_service
+
+            if credential_service._cache_initialized:
+                # Get API key from cache if needed
+                if not api_key and "OPENAI_API_KEY" in credential_service._cache:
                     cached_key = credential_service._cache["OPENAI_API_KEY"]
                     if isinstance(cached_key, dict) and cached_key.get("is_encrypted"):
                         api_key = credential_service._decrypt_value(cached_key["encrypted_value"])
                     else:
                         api_key = cached_key
-                else:
-                    api_key = os.getenv("OPENAI_API_KEY", "")
+
+                # Get base URL from cache if available (check RAG settings cache)
+                if hasattr(credential_service, '_rag_settings_cache') and credential_service._rag_settings_cache:
+                    base_url = credential_service._rag_settings_cache.get("OPENAI_BASE_URL")
+
+            if not api_key:
+                api_key = os.getenv("OPENAI_API_KEY", "")
 
             if not api_key:
                 raise ValueError("No OpenAI API key available")
 
-            client = openai.OpenAI(api_key=api_key)
+            # Create client with optional base_url for custom OpenAI-compatible endpoints
+            client_kwargs = {"api_key": api_key}
+            if base_url:
+                client_kwargs["base_url"] = base_url
+
+            client = openai.OpenAI(**client_kwargs)
         except Exception as e:
             search_logger.error(
                 f"Failed to create LLM client fallback: {e} - returning default values"

From 39f753a0a38496c0005be7f298e17838ccaf64e9 Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 15:22:56 -0400
Subject: [PATCH 02/18] fix: Address PR review feedback for OpenAI base URL
 configuration

This commit addresses all review feedback from PR #585:

1. **Fail Fast on Missing API Key**:
   - Raise ValueError when OPENAI_BASE_URL is configured but API key is missing
   - Prevents traffic leaking to public endpoints when proxy is explicitly configured

2. **Thread-Safe Agent Initialization**:
   - Added asyncio.Lock to prevent race conditions in lazy initialization
   - Double-check pattern prevents double initialization in concurrent calls

3. **Improved Model Parsing**:
   - Use removeprefix() instead of replace() for safer model name extraction
   - Add validation for empty model names after prefix removal
   - Enhanced error logging with exc_info=True for full stack traces

4. **Better Credential Service Integration**:
   - Added environment variable fallback for OPENAI_BASE_URL
   - Improved error handling for credential retrieval
   - Added proper URL normalization (trim whitespace, handle empty strings)

5. **URL Validation and Security**:
   - Added comprehensive URL validation with proper scheme/hostname checks
   - Security warnings for non-HTTPS URLs in production
   - Fail-fast on invalid URL configurations

## Security Improvements:
- Prevents accidental traffic leakage to public APIs when proxy is configured
- Validates URL formats to prevent configuration errors
- Warns about non-HTTPS usage in production environments

## Robustness Improvements:
- Thread-safe initialization prevents race conditions
- Better error messages with full stack traces
- Graceful handling of credential retrieval failures
- Proper fallback chains for configuration sources

Addresses: https://github.com/coleam00/Archon/pull/585 review feedback
---
 python/src/agents/agent_provider_config.py    | 61 ++++++++++++++++++-
 python/src/agents/base_agent.py               | 22 +++++--
 .../services/storage/code_storage_service.py  | 44 +++++++++----
 3 files changed, 107 insertions(+), 20 deletions(-)

diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
index 0133a21535..ecb8222a46 100644
--- a/python/src/agents/agent_provider_config.py
+++ b/python/src/agents/agent_provider_config.py
@@ -7,6 +7,7 @@
 
 import logging
 import os
+from urllib.parse import urlparse
 
 from pydantic_ai.models.openai import OpenAIChatModel
 from pydantic_ai.providers.openai import OpenAIProvider
@@ -14,6 +15,49 @@
 logger = logging.getLogger(__name__)
 
 
+def _validate_base_url(base_url: str) -> str:
+    """
+    Validate and normalize a base URL.
+    
+    Args:
+        base_url: The base URL to validate
+        
+    Returns:
+        The validated and normalized base URL
+        
+    Raises:
+        ValueError: If the URL is invalid or unsafe
+    """
+    if not base_url or not base_url.strip():
+        raise ValueError("Base URL cannot be empty")
+
+    # Normalize the URL (trim whitespace)
+    url = base_url.strip()
+
+    # Parse the URL to validate its structure
+    try:
+        parsed = urlparse(url)
+    except Exception as e:
+        raise ValueError(f"Invalid URL format: {e}")
+
+    # Ensure it has a valid scheme
+    if not parsed.scheme:
+        raise ValueError("Base URL must include a scheme (http:// or https://)")
+
+    if parsed.scheme not in ['http', 'https']:
+        raise ValueError("Base URL must use http:// or https:// scheme")
+
+    # Ensure it has a valid hostname
+    if not parsed.hostname:
+        raise ValueError("Base URL must include a valid hostname")
+
+    # Log security consideration for non-HTTPS URLs
+    if parsed.scheme == 'http' and not parsed.hostname.startswith(('localhost', '127.0.0.1', '0.0.0.0')):
+        logger.warning(f"Using non-HTTPS URL for OpenAI base URL: {url}. Consider using HTTPS for production.")
+
+    return url
+
+
 async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
     """
     Get a configured OpenAI model for PydanticAI agents.
@@ -32,12 +76,25 @@ async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
         # Try to get base URL from credential service
         base_url = await _get_openai_base_url()
 
+        # Validate and normalize base URL
+        if base_url:
+            try:
+                base_url = _validate_base_url(base_url)
+            except ValueError as e:
+                logger.error(f"Invalid OPENAI_BASE_URL configuration: {e}")
+                # Don't fall back silently - re-raise the error to fail fast
+                raise ValueError(f"Invalid OPENAI_BASE_URL configuration: {e}")
+
         if base_url:
             # Get API key
             api_key = await _get_openai_api_key()
             if not api_key:
-                logger.warning("OPENAI_BASE_URL is configured but no API key found, falling back to default")
-                return f"openai:{model_name}"
+                # Fail fast when base URL is configured but API key is missing
+                # This prevents traffic from leaking to public endpoints when a proxy was explicitly configured
+                raise ValueError(
+                    f"OPENAI_BASE_URL is configured ({base_url}) but no OpenAI API key is available. "
+                    "When using a custom base URL, an API key must be provided for security reasons."
+                )
 
             # Create custom provider with base_url
             provider = OpenAIProvider(
diff --git a/python/src/agents/base_agent.py b/python/src/agents/base_agent.py
index f3873d654e..2bb72c1160 100644
--- a/python/src/agents/base_agent.py
+++ b/python/src/agents/base_agent.py
@@ -177,6 +177,7 @@ def __init__(
         # Initialize the PydanticAI agent (this may be async now)
         self._agent = None
         self._agent_kwargs = agent_kwargs
+        self._init_lock = asyncio.Lock()  # Thread-safe initialization lock
 
     @abstractmethod
     async def _create_agent(self, **kwargs) -> Agent:
@@ -184,21 +185,32 @@ async def _create_agent(self, **kwargs) -> Agent:
         pass
     
     async def _ensure_agent_initialized(self):
-        """Ensure the PydanticAI agent is initialized."""
+        """Ensure the PydanticAI agent is initialized in a thread-safe manner."""
         if self._agent is None:
-            self._agent = await self._create_agent(**self._agent_kwargs)
+            async with self._init_lock:
+                # Double-check after acquiring lock to prevent double initialization
+                if self._agent is None:
+                    self._agent = await self._create_agent(**self._agent_kwargs)
     
     async def _get_configured_model(self):
         """Get the configured model for this agent."""
         if self.use_custom_provider and self.model.startswith("openai:"):
-            # Extract model name from "openai:model" format
-            model_name = self.model.replace("openai:", "")
+            # Extract model name from "openai:model" format using removeprefix
+            model_name = self.model.removeprefix("openai:")
+            
+            # Guard against empty model names
+            if not model_name:
+                raise ValueError(f"Empty model name after removing 'openai:' prefix from '{self.model}'")
             
             try:
                 from .agent_provider_config import get_configured_openai_model
                 return await get_configured_openai_model(model_name)
             except Exception as e:
-                self.logger.warning(f"Failed to get custom OpenAI provider, falling back to default: {e}")
+                # Log with full stack trace for better debugging
+                self.logger.warning(
+                    f"Failed to get custom OpenAI provider, falling back to default: {e}",
+                    exc_info=True
+                )
                 return self.model
         else:
             # Use the model string as-is
diff --git a/python/src/server/services/storage/code_storage_service.py b/python/src/server/services/storage/code_storage_service.py
index f220544c89..f2d52a92e5 100644
--- a/python/src/server/services/storage/code_storage_service.py
+++ b/python/src/server/services/storage/code_storage_service.py
@@ -541,25 +541,43 @@ def generate_code_example_summary(
 
             import openai
 
+            # Get API key using proper credential service API
             api_key = os.getenv("OPENAI_API_KEY")
-            base_url = None
+            base_url = os.getenv("OPENAI_BASE_URL")  # Add environment variable fallback
 
-            # Try to get from credential service with direct fallback
+            # Try to get from credential service using proper async API
+            # Note: This is a sync context, so we'll try the sync fallback first
             from ..credential_service import credential_service
 
-            if credential_service._cache_initialized:
-                # Get API key from cache if needed
-                if not api_key and "OPENAI_API_KEY" in credential_service._cache:
-                    cached_key = credential_service._cache["OPENAI_API_KEY"]
-                    if isinstance(cached_key, dict) and cached_key.get("is_encrypted"):
-                        api_key = credential_service._decrypt_value(cached_key["encrypted_value"])
-                    else:
-                        api_key = cached_key
-
-                # Get base URL from cache if available (check RAG settings cache)
-                if hasattr(credential_service, '_rag_settings_cache') and credential_service._rag_settings_cache:
+            try:
+                # Try to get API key from credential service if not in env
+                if not api_key:
+                    # In sync context, we can only access already-cached credentials
+                    if credential_service._cache_initialized and "OPENAI_API_KEY" in credential_service._cache:
+                        cached_key = credential_service._cache["OPENAI_API_KEY"]
+                        if isinstance(cached_key, dict) and cached_key.get("is_encrypted"):
+                            try:
+                                api_key = credential_service._decrypt_value(cached_key["encrypted_value"])
+                            except Exception as e:
+                                search_logger.debug(f"Failed to decrypt API key from cache: {e}")
+                        else:
+                            api_key = cached_key
+
+                # Try to get base URL from RAG settings cache if not in env
+                # This is still accessing cache but with better error handling
+                if not base_url and hasattr(credential_service, '_rag_settings_cache') and credential_service._rag_settings_cache:
                     base_url = credential_service._rag_settings_cache.get("OPENAI_BASE_URL")
 
+            except Exception as e:
+                search_logger.debug(f"Failed to retrieve credentials from service: {e}")
+
+            # Normalize base URL (trim whitespace, convert empty strings to None)
+            if base_url:
+                base_url = base_url.strip()
+                if not base_url:
+                    base_url = None
+
+            # Final fallback for API key
             if not api_key:
                 api_key = os.getenv("OPENAI_API_KEY", "")
 

From e06fbc6de18cce7ca1f6747a6a8efcd9541b0c42 Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 15:35:55 -0400
Subject: [PATCH 03/18] Update python/src/agents/agent_provider_config.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 python/src/agents/agent_provider_config.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
index ecb8222a46..c92f4449a0 100644
--- a/python/src/agents/agent_provider_config.py
+++ b/python/src/agents/agent_provider_config.py
@@ -51,6 +51,10 @@ def _validate_base_url(base_url: str) -> str:
     if not parsed.hostname:
         raise ValueError("Base URL must include a valid hostname")
 
+    # Disallow embedding credentials in the URL
+    if parsed.username or parsed.password:
+        raise ValueError("Base URL must not embed credentials (userinfo)")
+
     # Log security consideration for non-HTTPS URLs
     if parsed.scheme == 'http' and not parsed.hostname.startswith(('localhost', '127.0.0.1', '0.0.0.0')):
         logger.warning(f"Using non-HTTPS URL for OpenAI base URL: {url}. Consider using HTTPS for production.")

From 6db9b195baaccea7287a37cf633571385706ff91 Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 15:36:21 -0400
Subject: [PATCH 04/18] Update python/src/agents/base_agent.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 python/src/agents/base_agent.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/python/src/agents/base_agent.py b/python/src/agents/base_agent.py
index 2bb72c1160..89b7831fe3 100644
--- a/python/src/agents/base_agent.py
+++ b/python/src/agents/base_agent.py
@@ -205,10 +205,17 @@ async def _get_configured_model(self):
             try:
                 from .agent_provider_config import get_configured_openai_model
                 return await get_configured_openai_model(model_name)
-            except Exception as e:
-                # Log with full stack trace for better debugging
+            except ValueError:
+                # Misconfiguration of OPENAI_BASE_URL or missing API key: fail fast to avoid leaking traffic.
+                self.logger.error(
+                    "Custom OpenAI provider misconfigured; refusing to fall back to default",
+                    exc_info=True
+                )
+                raise
+            except Exception:
+                # Non-configuration error: log and fall back.
                 self.logger.warning(
-                    f"Failed to get custom OpenAI provider, falling back to default: {e}",
+                    "Failed to get custom OpenAI provider, falling back to default",
                     exc_info=True
                 )
                 return self.model

From c4cf1c71e6c3e5d8ef2b5bd357253b8df9c4a5f7 Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 15:36:46 -0400
Subject: [PATCH 05/18] Update python/src/agents/agent_provider_config.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 python/src/agents/agent_provider_config.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
index c92f4449a0..901fcce2e6 100644
--- a/python/src/agents/agent_provider_config.py
+++ b/python/src/agents/agent_provider_config.py
@@ -113,12 +113,14 @@ async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
             logger.debug(f"Using default OpenAI configuration for model: {model_name}")
             return f"openai:{model_name}"
 
-    except Exception as e:
-        logger.error(f"Error configuring OpenAI model: {e}")
-        # Fallback to standard string format
+    except Exception:
+        logger.error("Error configuring OpenAI model", exc_info=True)
+        # If a custom base URL was configured, fail fast to avoid leaking traffic.
+        if "base_url" in locals() and base_url:
+            raise
+        # Otherwise, fall back to the default OpenAI configuration.
         return f"openai:{model_name}"
 
-
 async def _get_openai_base_url() -> str | None:
     """Get OpenAI base URL from credential service."""
     try:

From c462c181a62863c16a21188af6d2b77654bf2e34 Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 15:37:04 -0400
Subject: [PATCH 06/18] Update python/src/agents/agent_provider_config.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 python/src/agents/agent_provider_config.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
index 901fcce2e6..e60ff24b42 100644
--- a/python/src/agents/agent_provider_config.py
+++ b/python/src/agents/agent_provider_config.py
@@ -85,7 +85,7 @@ async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
             try:
                 base_url = _validate_base_url(base_url)
             except ValueError as e:
-                logger.error(f"Invalid OPENAI_BASE_URL configuration: {e}")
+                logger.error("Invalid OPENAI_BASE_URL configuration", exc_info=True)
                 # Don't fall back silently - re-raise the error to fail fast
                 raise ValueError(f"Invalid OPENAI_BASE_URL configuration: {e}")
 

From 1091e1b2c519dcbbed07011f40312c0c0cbe0add Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 15:40:36 -0400
Subject: [PATCH 07/18] docs: Add OpenAI base URL configuration documentation

- Add comprehensive OpenAI base URL configuration section to configuration.mdx
- Include UI and environment variable configuration examples
- Document LiteLLM, Azure OpenAI, and corporate proxy setups in rag.mdx
- Add security considerations for proxy usage including HTTPS requirements
- Update API reference with OPENAI_BASE_URL setting documentation
- Include practical examples for common proxy scenarios
---
 docs/docs/api-reference.mdx |   2 +
 docs/docs/configuration.mdx |  38 ++++++++++++
 docs/docs/rag.mdx           | 112 +++++++++++++++++++++++++++++++++++-
 3 files changed, 151 insertions(+), 1 deletion(-)

diff --git a/docs/docs/api-reference.mdx b/docs/docs/api-reference.mdx
index 5385830e5d..b95b82ed19 100644
--- a/docs/docs/api-reference.mdx
+++ b/docs/docs/api-reference.mdx
@@ -1466,6 +1466,7 @@ Retrieve all RAG configuration settings including LLM provider options.
     "USE_RERANKING": "true",
     "LLM_PROVIDER": "openai",
     "LLM_BASE_URL": null,
+    "OPENAI_BASE_URL": "http://localhost:8000/v1",
     "EMBEDDING_MODEL": null
   }
 }
@@ -1477,6 +1478,7 @@ Retrieve all RAG configuration settings including LLM provider options.
 |---------|------|-------------|
 | `LLM_PROVIDER` | string | Provider choice: `openai`, `ollama`, `google` |
 | `LLM_BASE_URL` | string | Custom base URL (required for Ollama) |
+| `OPENAI_BASE_URL` | string | Custom OpenAI endpoint for proxies (LiteLLM, Azure OpenAI) |
 | `EMBEDDING_MODEL` | string | Override default embedding model |
 | `MODEL_CHOICE` | string | Chat model for summaries and contextual embeddings |
 
diff --git a/docs/docs/configuration.mdx b/docs/docs/configuration.mdx
index e4fc371ade..cd6d28efaf 100644
--- a/docs/docs/configuration.mdx
+++ b/docs/docs/configuration.mdx
@@ -141,10 +141,48 @@ Configure in **Settings → RAG Settings → LLM Provider**
 
 <Admonition type="tip" title="Provider Setup">
 - **API Keys**: Add provider-specific keys in Settings → API Keys
+- **Custom Base URLs**: Configure custom endpoints for OpenAI-compatible proxies
 - **Ollama**: Requires local installation and custom base URL
 - **Models**: Each provider has different model naming conventions
 </Admonition>
 
+#### OpenAI Base URL Configuration
+
+For advanced use cases, you can configure a custom OpenAI base URL to route requests through:
+- **LiteLLM proxy** for multi-provider access
+- **Azure OpenAI** endpoints
+- **Corporate proxies** or custom gateways
+- **Local OpenAI-compatible servers**
+
+<Tabs>
+<TabItem value="ui" label="UI Configuration" default>
+
+1. Navigate to **Settings → RAG Settings**
+2. Select **OpenAI** as your LLM Provider
+3. Enter your custom **OpenAI Base URL** (optional)
+4. Examples:
+   - LiteLLM: `http://localhost:8000/v1`
+   - Azure OpenAI: `https://your-resource.openai.azure.com/openai/deployments/your-deployment`
+   - Custom proxy: `https://api.yourcompany.com/openai/v1`
+
+</TabItem>
+<TabItem value="env" label="Environment Variables">
+
+```bash
+# Optional - Custom OpenAI endpoint
+OPENAI_BASE_URL=http://localhost:8000/v1
+
+# Required when using custom base URL
+OPENAI_API_KEY=your-api-key-here
+```
+
+<Admonition type="warning" title="Security Requirements">
+When using a custom `OPENAI_BASE_URL`, an API key must be provided for security reasons. This prevents accidental traffic leaks to public endpoints when a proxy is explicitly configured.
+</Admonition>
+
+</TabItem>
+</Tabs>
+
 ### Socket.IO Configuration
 
 Archon uses Socket.IO for all real-time features. The default configuration works out of the box:
diff --git a/docs/docs/rag.mdx b/docs/docs/rag.mdx
index a77167c12e..7c572792fd 100644
--- a/docs/docs/rag.mdx
+++ b/docs/docs/rag.mdx
@@ -303,10 +303,78 @@ USE_RERANKING=true
 LLM_PROVIDER=openai
 MODEL_CHOICE=gpt-4o-mini
 EMBEDDING_MODEL=text-embedding-3-small
-# Pros: Best accuracy, reliable API
+
+# Optional: Custom OpenAI endpoint
+OPENAI_BASE_URL=https://api.openai.com/v1
+
+# Pros: Best accuracy, reliable API, proxy support
 # Cons: Cost per query
 ```
 
+#### OpenAI Proxy Configuration
+
+Configure custom endpoints for advanced routing scenarios:
+
+<Tabs>
+<TabItem value="litellm" label="LiteLLM Proxy" default>
+
+```bash
+# LiteLLM proxy for multi-provider access
+LLM_PROVIDER=openai
+OPENAI_BASE_URL=http://localhost:8000/v1
+MODEL_CHOICE=gpt-4o-mini  # Route through LiteLLM
+OPENAI_API_KEY=your-litellm-key
+
+# Benefits:
+# - Multi-provider routing (OpenAI, Anthropic, etc.)
+# - Cost tracking and rate limiting
+# - Centralized API management
+```
+
+**LiteLLM Setup:**
+```bash
+# Install LiteLLM
+pip install litellm[proxy]
+
+# Start proxy server
+litellm --port 8000 --config litellm_config.yaml
+```
+
+</TabItem>
+<TabItem value="azure" label="Azure OpenAI">
+
+```bash
+# Azure OpenAI endpoint
+LLM_PROVIDER=openai
+OPENAI_BASE_URL=https://your-resource.openai.azure.com/openai/deployments/your-deployment
+MODEL_CHOICE=gpt-4o-mini
+OPENAI_API_KEY=your-azure-api-key
+
+# Benefits:
+# - Enterprise compliance and security
+# - Data residency control  
+# - Integrated with Azure services
+```
+
+</TabItem>
+<TabItem value="corporate" label="Corporate Proxy">
+
+```bash
+# Corporate gateway/proxy
+LLM_PROVIDER=openai
+OPENAI_BASE_URL=https://api.yourcompany.com/openai/v1
+MODEL_CHOICE=gpt-4o-mini
+OPENAI_API_KEY=your-internal-key
+
+# Benefits:
+# - Centralized billing and monitoring
+# - Security and compliance enforcement
+# - Custom authentication and authorization
+```
+
+</TabItem>
+</Tabs>
+
 ### Google Gemini
 ```bash
 LLM_PROVIDER=google
@@ -368,6 +436,48 @@ EMBEDDING_MODEL=nomic-embed-text
 3. Use caching more aggressively
 4. Consider switching to local models (Ollama)
 
+## 🔒 Security Considerations for Proxy Usage
+
+When configuring custom OpenAI base URLs, follow these security best practices:
+
+<Admonition type="danger" title="Security Requirements">
+**Always provide an API key** when using custom base URLs. This prevents accidental traffic from being sent to unintended endpoints when a proxy is explicitly configured.
+</Admonition>
+
+### Network Security
+```bash
+# ✅ Use HTTPS endpoints in production
+OPENAI_BASE_URL=https://secure-proxy.example.com/v1
+
+# ⚠️ HTTP only for local development  
+OPENAI_BASE_URL=http://localhost:8000/v1  # Development only
+```
+
+### API Key Management
+- **Separate Keys**: Use different API keys for proxy vs direct OpenAI access
+- **Key Rotation**: Regularly rotate API keys, especially for proxy endpoints
+- **Environment Variables**: Never hardcode keys in configuration files
+- **Least Privilege**: Proxy keys should have minimal required permissions
+
+### Proxy Validation
+Before deploying with a custom proxy:
+1. **Verify SSL/TLS certificates** for HTTPS endpoints
+2. **Test connectivity** and authentication
+3. **Validate response formats** match OpenAI API standards
+4. **Monitor for unexpected behavior** or response changes
+
+### Corporate Environments
+```bash
+# Corporate proxy with additional security headers
+OPENAI_BASE_URL=https://api-gateway.corp.com/openai/v1
+
+# Consider:
+# - Certificate pinning for additional security
+# - Network policies restricting outbound traffic
+# - Audit logging for all API requests
+# - Rate limiting and quota management
+```
+
 ## 🎯 Best Practices
 
 ### Content Optimization

From f7fcf77987f2031baec992abc3bf4e993917806d Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 15:49:23 -0400
Subject: [PATCH 08/18] feat: Centralize OpenAI client configuration across all
 services

- Add get_openai_client_config() function to agent_provider_config.py
  - Provides centralized OpenAI configuration for all openai.AsyncOpenAI clients
  - Honors OPENAI_BASE_URL settings with same validation as PydanticAI agents
  - Maintains fail-fast behavior for security (requires API key when base URL configured)

- Update llm_provider_service.py to use centralized configuration
  - Replace direct openai.AsyncOpenAI instantiation with centralized config
  - Ensures all OpenAI API calls honor custom base URLs (LiteLLM, Azure OpenAI, etc.)
  - Maintain backward compatibility with existing provider-specific configuration

- Maintain consistent behavior across all OpenAI usage:
  - PydanticAI agents (via get_configured_openai_model)
  - LLM provider service (via get_openai_client_config)
  - Same security checks and validation logic applied everywhere

Fixes issue where llm_provider_service bypassed centralized OPENAI_BASE_URL configuration
---
 python/src/agents/agent_provider_config.py    | 86 ++++++++++++++++---
 .../server/services/llm_provider_service.py   | 28 ++++--
 2 files changed, 97 insertions(+), 17 deletions(-)

diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
index e60ff24b42..059003c1b7 100644
--- a/python/src/agents/agent_provider_config.py
+++ b/python/src/agents/agent_provider_config.py
@@ -18,13 +18,13 @@
 def _validate_base_url(base_url: str) -> str:
     """
     Validate and normalize a base URL.
-    
+
     Args:
         base_url: The base URL to validate
-        
+
     Returns:
         The validated and normalized base URL
-        
+
     Raises:
         ValueError: If the URL is invalid or unsafe
     """
@@ -38,7 +38,7 @@ def _validate_base_url(base_url: str) -> str:
     try:
         parsed = urlparse(url)
     except Exception as e:
-        raise ValueError(f"Invalid URL format: {e}")
+        raise ValueError(f"Invalid URL format: {e}") from e
 
     # Ensure it has a valid scheme
     if not parsed.scheme:
@@ -65,14 +65,14 @@ def _validate_base_url(base_url: str) -> str:
 async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
     """
     Get a configured OpenAI model for PydanticAI agents.
-    
+
     If OPENAI_BASE_URL is configured in the system, returns an OpenAIChatModel
     with a custom OpenAIProvider. Otherwise, returns the standard model string
     format that PydanticAI handles automatically.
-    
+
     Args:
         model_name: The model name (e.g., "gpt-4o", "gpt-4o-mini")
-        
+
     Returns:
         Either an OpenAIChatModel with custom provider or a model string
     """
@@ -87,7 +87,7 @@ async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
             except ValueError as e:
                 logger.error("Invalid OPENAI_BASE_URL configuration", exc_info=True)
                 # Don't fall back silently - re-raise the error to fail fast
-                raise ValueError(f"Invalid OPENAI_BASE_URL configuration: {e}")
+                raise ValueError(f"Invalid OPENAI_BASE_URL configuration: {e}") from e
 
         if base_url:
             # Get API key
@@ -175,17 +175,81 @@ async def _get_openai_api_key() -> str | None:
         return os.getenv("OPENAI_API_KEY")
 
 
+async def get_openai_client_config() -> dict[str, str | None]:
+    """
+    Get OpenAI client configuration for creating openai.AsyncOpenAI instances.
+
+    This provides centralized configuration that honors OPENAI_BASE_URL settings
+    and applies the same validation and security checks as the PydanticAI agents.
+
+    Returns:
+        Dict with 'api_key' and 'base_url' keys. Both may be None if not configured.
+
+    Raises:
+        ValueError: If OPENAI_BASE_URL is configured but invalid or missing API key
+    """
+    try:
+        # Get base URL using same logic as get_configured_openai_model
+        base_url = await _get_openai_base_url()
+
+        # Validate and normalize base URL
+        if base_url:
+            try:
+                base_url = _validate_base_url(base_url)
+            except ValueError as e:
+                logger.error("Invalid OPENAI_BASE_URL configuration", exc_info=True)
+                # Don't fall back silently - re-raise the error to fail fast
+                raise ValueError(f"Invalid OPENAI_BASE_URL configuration: {e}") from e
+
+        # Get API key
+        api_key = await _get_openai_api_key()
+
+        # Apply same security check as in get_configured_openai_model
+        if base_url and not api_key:
+            # Fail fast when base URL is configured but API key is missing
+            # This prevents traffic from leaking to public endpoints when a proxy was explicitly configured
+            raise ValueError(
+                f"OPENAI_BASE_URL is configured ({base_url}) but no OpenAI API key is available. "
+                "When using a custom base URL, an API key must be provided for security reasons."
+            )
+
+        logger.debug(f"OpenAI client config: base_url={base_url}, has_api_key={bool(api_key)}")
+
+        return {
+            "api_key": api_key,
+            "base_url": base_url,
+        }
+
+    except Exception:
+        logger.error("Error getting OpenAI client configuration", exc_info=True)
+        # If a custom base URL was configured, fail fast to avoid leaking traffic.
+        base_url = None
+        try:
+            base_url = await _get_openai_base_url()
+        except Exception:
+            pass
+
+        if base_url:
+            raise
+
+        # Otherwise, return default configuration
+        return {
+            "api_key": None,
+            "base_url": None,
+        }
+
+
 def get_configured_openai_model_sync(model_name: str) -> str:
     """
     Synchronous version that returns model string format.
-    
+
     Since we can't easily call async functions from sync contexts,
     this returns the standard model string format and relies on
     PydanticAI's automatic configuration.
-    
+
     Args:
         model_name: The model name (e.g., "gpt-4o", "gpt-4o-mini")
-        
+
     Returns:
         Model string in "openai:model" format
     """
diff --git a/python/src/server/services/llm_provider_service.py b/python/src/server/services/llm_provider_service.py
index dba1414f50..d25363586f 100644
--- a/python/src/server/services/llm_provider_service.py
+++ b/python/src/server/services/llm_provider_service.py
@@ -94,14 +94,30 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
         logger.info(f"Creating LLM client for provider: {provider_name}")
 
         if provider_name == "openai":
-            if not api_key:
+            # Use centralized OpenAI configuration that honors OPENAI_BASE_URL
+            from ...agents.agent_provider_config import get_openai_client_config
+
+            try:
+                openai_config = await get_openai_client_config()
+                config_api_key = openai_config["api_key"]
+                config_base_url = openai_config["base_url"]
+            except Exception as e:
+                logger.error(f"Failed to get centralized OpenAI configuration: {e}")
+                raise ValueError(f"OpenAI configuration error: {e}") from e
+
+            # Use centralized API key if available, fall back to provider-specific key
+            final_api_key = config_api_key or api_key
+            if not final_api_key:
                 raise ValueError("OpenAI API key not found")
 
-            # Create client with optional base_url for custom OpenAI-compatible endpoints
-            client_kwargs = {"api_key": api_key}
-            if base_url:
-                client_kwargs["base_url"] = base_url
-                logger.info(f"OpenAI client created with custom base URL: {base_url}")
+            # Use centralized base URL if configured, otherwise use provider-specific base URL
+            final_base_url = config_base_url or base_url
+
+            # Create client with centralized configuration
+            client_kwargs = {"api_key": final_api_key}
+            if final_base_url:
+                client_kwargs["base_url"] = final_base_url
+                logger.info(f"OpenAI client created with custom base URL: {final_base_url}")
             else:
                 logger.info("OpenAI client created with default URL")
 

From a4e1689f3e255374c6897637850324c675008eec Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 16:03:41 -0400
Subject: [PATCH 09/18] docs: Update documentation to reflect centralized
 OpenAI configuration

- Clarify that OPENAI_BASE_URL applies system-wide to all services
- Emphasize consistent proxy routing across PydanticAI agents and LLM service
- Update configuration.mdx to highlight centralized behavior
- Update rag.mdx to clarify proxy settings apply to all OpenAI usage
- Update api-reference.mdx to indicate system-wide application
- Improve security documentation to cover all OpenAI API usage
---
 docs/docs/api-reference.mdx |  2 +-
 docs/docs/configuration.mdx | 11 ++++++++++-
 docs/docs/rag.mdx           |  4 ++--
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/docs/docs/api-reference.mdx b/docs/docs/api-reference.mdx
index b95b82ed19..f70f4c1926 100644
--- a/docs/docs/api-reference.mdx
+++ b/docs/docs/api-reference.mdx
@@ -1478,7 +1478,7 @@ Retrieve all RAG configuration settings including LLM provider options.
 |---------|------|-------------|
 | `LLM_PROVIDER` | string | Provider choice: `openai`, `ollama`, `google` |
 | `LLM_BASE_URL` | string | Custom base URL (required for Ollama) |
-| `OPENAI_BASE_URL` | string | Custom OpenAI endpoint for proxies (LiteLLM, Azure OpenAI) |
+| `OPENAI_BASE_URL` | string | Custom OpenAI endpoint for proxies (LiteLLM, Azure OpenAI) - applies system-wide |
 | `EMBEDDING_MODEL` | string | Override default embedding model |
 | `MODEL_CHOICE` | string | Chat model for summaries and contextual embeddings |
 
diff --git a/docs/docs/configuration.mdx b/docs/docs/configuration.mdx
index cd6d28efaf..c7d93fcd38 100644
--- a/docs/docs/configuration.mdx
+++ b/docs/docs/configuration.mdx
@@ -148,12 +148,21 @@ Configure in **Settings → RAG Settings → LLM Provider**
 
 #### OpenAI Base URL Configuration
 
-For advanced use cases, you can configure a custom OpenAI base URL to route requests through:
+For advanced use cases, you can configure a custom OpenAI base URL to route **all OpenAI API requests** through:
 - **LiteLLM proxy** for multi-provider access
 - **Azure OpenAI** endpoints
 - **Corporate proxies** or custom gateways
 - **Local OpenAI-compatible servers**
 
+<Admonition type="info" title="Centralized Configuration">
+The `OPENAI_BASE_URL` setting applies consistently across **all services**:
+- PydanticAI agents (RAG, document processing, task management)
+- LLM provider service (embeddings, contextual processing)
+- Background tasks and batch operations
+
+This ensures consistent proxy routing for all OpenAI API usage throughout the system.
+</Admonition>
+
 <Tabs>
 <TabItem value="ui" label="UI Configuration" default>
 
diff --git a/docs/docs/rag.mdx b/docs/docs/rag.mdx
index 7c572792fd..d2dfb9e7af 100644
--- a/docs/docs/rag.mdx
+++ b/docs/docs/rag.mdx
@@ -313,7 +313,7 @@ OPENAI_BASE_URL=https://api.openai.com/v1
 
 #### OpenAI Proxy Configuration
 
-Configure custom endpoints for advanced routing scenarios:
+Configure custom endpoints for advanced routing scenarios. These settings apply to **all OpenAI API usage** including RAG queries, embeddings, and background processing:
 
 <Tabs>
 <TabItem value="litellm" label="LiteLLM Proxy" default>
@@ -438,7 +438,7 @@ EMBEDDING_MODEL=nomic-embed-text
 
 ## 🔒 Security Considerations for Proxy Usage
 
-When configuring custom OpenAI base URLs, follow these security best practices:
+When configuring custom OpenAI base URLs, follow these security best practices. These security measures apply to **all OpenAI API usage** throughout the system:
 
 <Admonition type="danger" title="Security Requirements">
 **Always provide an API key** when using custom base URLs. This prevents accidental traffic from being sent to unintended endpoints when a proxy is explicitly configured.

From 9da7379bf624ee8c79bb8da1eaebebcaf111fbae Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 17:28:10 -0400
Subject: [PATCH 10/18] Update docs/docs/api-reference.mdx

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 docs/docs/api-reference.mdx | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/docs/docs/api-reference.mdx b/docs/docs/api-reference.mdx
index f70f4c1926..8cc0d40a20 100644
--- a/docs/docs/api-reference.mdx
+++ b/docs/docs/api-reference.mdx
@@ -1476,12 +1476,11 @@ Retrieve all RAG configuration settings including LLM provider options.
 
 | Setting | Type | Description |
 |---------|------|-------------|
-| `LLM_PROVIDER` | string | Provider choice: `openai`, `ollama`, `google` |
-| `LLM_BASE_URL` | string | Custom base URL (required for Ollama) |
-| `OPENAI_BASE_URL` | string | Custom OpenAI endpoint for proxies (LiteLLM, Azure OpenAI) - applies system-wide |
-| `EMBEDDING_MODEL` | string | Override default embedding model |
-| `MODEL_CHOICE` | string | Chat model for summaries and contextual embeddings |
-
+| `LLM_PROVIDER`     | string | Provider choice: `openai`, `ollama`, `google` |
+| `LLM_BASE_URL`     | string | Custom base URL (required for Ollama) |
+| `OPENAI_BASE_URL`  | string | Custom OpenAI endpoint for proxies (LiteLLM, Azure OpenAI) — applies system-wide |
+| `EMBEDDING_MODEL`  | string | Override default embedding model |
+| `MODEL_CHOICE`     | string | Chat model for summaries and contextual embeddings |
 ## 💬 Agent Chat API
 
 <Admonition type="warning" title="Integration Note">

From 8b716339cdc3c7964f232176ff222f5c19eb53df Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 17:28:35 -0400
Subject: [PATCH 11/18] Update docs/docs/rag.mdx

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 docs/docs/rag.mdx | 37 +------------------------------------
 1 file changed, 1 insertion(+), 36 deletions(-)

diff --git a/docs/docs/rag.mdx b/docs/docs/rag.mdx
index d2dfb9e7af..9b3a91bc01 100644
--- a/docs/docs/rag.mdx
+++ b/docs/docs/rag.mdx
@@ -436,47 +436,12 @@ EMBEDDING_MODEL=nomic-embed-text
 3. Use caching more aggressively
 4. Consider switching to local models (Ollama)
 
-## 🔒 Security Considerations for Proxy Usage
-
-When configuring custom OpenAI base URLs, follow these security best practices. These security measures apply to **all OpenAI API usage** throughout the system:
-
-<Admonition type="danger" title="Security Requirements">
-**Always provide an API key** when using custom base URLs. This prevents accidental traffic from being sent to unintended endpoints when a proxy is explicitly configured.
-</Admonition>
-
-### Network Security
-```bash
-# ✅ Use HTTPS endpoints in production
-OPENAI_BASE_URL=https://secure-proxy.example.com/v1
-
-# ⚠️ HTTP only for local development  
-OPENAI_BASE_URL=http://localhost:8000/v1  # Development only
-```
-
 ### API Key Management
 - **Separate Keys**: Use different API keys for proxy vs direct OpenAI access
 - **Key Rotation**: Regularly rotate API keys, especially for proxy endpoints
 - **Environment Variables**: Never hardcode keys in configuration files
 - **Least Privilege**: Proxy keys should have minimal required permissions
-
-### Proxy Validation
-Before deploying with a custom proxy:
-1. **Verify SSL/TLS certificates** for HTTPS endpoints
-2. **Test connectivity** and authentication
-3. **Validate response formats** match OpenAI API standards
-4. **Monitor for unexpected behavior** or response changes
-
-### Corporate Environments
-```bash
-# Corporate proxy with additional security headers
-OPENAI_BASE_URL=https://api-gateway.corp.com/openai/v1
-
-# Consider:
-# - Certificate pinning for additional security
-# - Network policies restricting outbound traffic
-# - Audit logging for all API requests
-# - Rate limiting and quota management
-```
+- **No Secrets in Logs**: Disable logging of Authorization headers and redact API keys in all logs.
 
 ## 🎯 Best Practices
 

From 54d29a3b0659baa07325222c8c449b8faa074c1a Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 17:28:59 -0400
Subject: [PATCH 12/18] Update python/src/agents/agent_provider_config.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 python/src/agents/agent_provider_config.py | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
index 059003c1b7..3de0553da8 100644
--- a/python/src/agents/agent_provider_config.py
+++ b/python/src/agents/agent_provider_config.py
@@ -127,20 +127,16 @@ async def _get_openai_base_url() -> str | None:
         # Import here to avoid circular imports
         from ..server.services.credential_service import credential_service
 
-        # Get RAG settings which contain OPENAI_BASE_URL
-        rag_settings = await credential_service.get_credentials_by_category("rag_strategy")
-        base_url = rag_settings.get("OPENAI_BASE_URL")
-
+        # Prefer direct credential lookup (handles decryption and consistent typing)
+        base_url = await credential_service.get_credential("OPENAI_BASE_URL", decrypt=True)
         if base_url:
-            logger.debug(f"Found OPENAI_BASE_URL in settings: {base_url}")
-            return base_url
-        else:
-            # Check environment variable as fallback
-            env_base_url = os.getenv("OPENAI_BASE_URL")
-            if env_base_url:
-                logger.debug(f"Found OPENAI_BASE_URL in environment: {env_base_url}")
-                return env_base_url
-
+            logger.debug("Found OPENAI_BASE_URL in credential service")
+            return str(base_url)
+        # Check environment variable as fallback
+        env_base_url = os.getenv("OPENAI_BASE_URL")
+        if env_base_url:
+            logger.debug(f"Found OPENAI_BASE_URL in environment: {env_base_url}")
+            return env_base_url
         return None
 
     except Exception as e:

From efb5f20be19520882e327872edbd4be22d4ff41c Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 17:29:16 -0400
Subject: [PATCH 13/18] Update
 python/src/server/services/llm_provider_service.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 python/src/server/services/llm_provider_service.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/python/src/server/services/llm_provider_service.py b/python/src/server/services/llm_provider_service.py
index d25363586f..4c016318b2 100644
--- a/python/src/server/services/llm_provider_service.py
+++ b/python/src/server/services/llm_provider_service.py
@@ -102,9 +102,8 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
                 config_api_key = openai_config["api_key"]
                 config_base_url = openai_config["base_url"]
             except Exception as e:
-                logger.error(f"Failed to get centralized OpenAI configuration: {e}")
-                raise ValueError(f"OpenAI configuration error: {e}") from e
-
+                logger.error("Failed to get centralized OpenAI configuration", exc_info=True)
+                raise ValueError("OpenAI configuration error") from e
             # Use centralized API key if available, fall back to provider-specific key
             final_api_key = config_api_key or api_key
             if not final_api_key:

From 2f26bf64cdf0033a6f404ee1e5af836baad9ecd5 Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 17:34:38 -0400
Subject: [PATCH 14/18] fix: Improve error logging in LLM provider service

- Add exc_info=True to error logging for better observability
- Use proper logging format strings instead of f-strings
- Remove unused exception variable after switching to exc_info
- Provides full stack trace for debugging provider creation failures
---
 python/src/server/services/llm_provider_service.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/python/src/server/services/llm_provider_service.py b/python/src/server/services/llm_provider_service.py
index 4c016318b2..3c2403d18c 100644
--- a/python/src/server/services/llm_provider_service.py
+++ b/python/src/server/services/llm_provider_service.py
@@ -145,9 +145,11 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
 
         yield client
 
-    except Exception as e:
+    except Exception:
         logger.error(
-            f"Error creating LLM client for provider {provider_name if 'provider_name' in locals() else 'unknown'}: {e}"
+            "Error creating LLM client for provider %s",
+            provider_name if 'provider_name' in locals() else 'unknown',
+            exc_info=True,
         )
         raise
     finally:

From 1a770ce6f79c991def0415c41719a08c7fae56df Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 17:38:53 -0400
Subject: [PATCH 15/18] feat: Improve error handling and observability in base
 agent

- Add custom exception classes: RateLimitExceededError and AgentExecutionError
- Update rate limit error handling to use specific exception type
- Improve agent execution error logging with exc_info for better observability
- Make agent property safe with proper None checking and clear error message
- Use proper exception chaining and avoid bare except clauses
- Enhance debugging capabilities with better error context and stack traces
---
 python/src/agents/base_agent.py | 40 +++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 14 deletions(-)

diff --git a/python/src/agents/base_agent.py b/python/src/agents/base_agent.py
index 89b7831fe3..34cf9db0ab 100644
--- a/python/src/agents/base_agent.py
+++ b/python/src/agents/base_agent.py
@@ -17,6 +17,16 @@
 logger = logging.getLogger(__name__)
 
 
+class RateLimitExceededError(Exception):
+    """Raised when rate limit is exceeded after all retries."""
+    pass
+
+
+class AgentExecutionError(Exception):
+    """Raised when agent execution fails."""
+    pass
+
+
 @dataclass
 class ArchonDependencies:
     """Base dependencies for all Archon agents."""
@@ -89,9 +99,9 @@ async def execute_with_rate_limit(self, func, *args, progress_callback=None, **k
                                 "step": "ai_generation",
                                 "log": f"❌ Rate limit exceeded after {self.max_retries} retries",
                             })
-                        raise Exception(
+                        raise RateLimitExceededError(
                             f"Rate limit exceeded after {self.max_retries} retries: {full_error}"
-                        )
+                        ) from None
 
                     # Extract wait time from error message if available
                     wait_time = self._extract_wait_time(full_error)
@@ -133,7 +143,7 @@ def _extract_wait_time(self, error_message: str) -> float | None:
             match = re.search(r"try again in (\d+(?:\.\d+)?)s", error_message)
             if match:
                 return float(match.group(1))
-        except:
+        except Exception:
             pass
         return None
 
@@ -173,7 +183,7 @@ def __init__(
 
         # Setup logging
         self.logger = logging.getLogger(f"agents.{self.name}")
-        
+
         # Initialize the PydanticAI agent (this may be async now)
         self._agent = None
         self._agent_kwargs = agent_kwargs
@@ -183,7 +193,7 @@ def __init__(
     async def _create_agent(self, **kwargs) -> Agent:
         """Create and configure the PydanticAI agent. Must be implemented by subclasses."""
         pass
-    
+
     async def _ensure_agent_initialized(self):
         """Ensure the PydanticAI agent is initialized in a thread-safe manner."""
         if self._agent is None:
@@ -191,17 +201,17 @@ async def _ensure_agent_initialized(self):
                 # Double-check after acquiring lock to prevent double initialization
                 if self._agent is None:
                     self._agent = await self._create_agent(**self._agent_kwargs)
-    
+
     async def _get_configured_model(self):
         """Get the configured model for this agent."""
         if self.use_custom_provider and self.model.startswith("openai:"):
             # Extract model name from "openai:model" format using removeprefix
             model_name = self.model.removeprefix("openai:")
-            
+
             # Guard against empty model names
             if not model_name:
                 raise ValueError(f"Empty model name after removing 'openai:' prefix from '{self.model}'")
-            
+
             try:
                 from .agent_provider_config import get_configured_openai_model
                 return await get_configured_openai_model(model_name)
@@ -253,7 +263,7 @@ async def _run_agent(self, user_prompt: str, deps: DepsT) -> OutputT:
         try:
             # Ensure agent is initialized
             await self._ensure_agent_initialized()
-            
+
             # Add timeout to prevent hanging
             result = await asyncio.wait_for(
                 self._agent.run(user_prompt, deps=deps),
@@ -262,12 +272,12 @@ async def _run_agent(self, user_prompt: str, deps: DepsT) -> OutputT:
             self.logger.info(f"Agent {self.name} completed successfully")
             # PydanticAI returns a RunResult with data attribute
             return result.data
-        except asyncio.TimeoutError:
+        except TimeoutError:
             self.logger.error(f"Agent {self.name} timed out after 120 seconds")
-            raise Exception(f"Agent {self.name} operation timed out - taking too long to respond")
+            raise AgentExecutionError(f"Agent {self.name} operation timed out - taking too long to respond") from None
         except Exception as e:
-            self.logger.error(f"Agent {self.name} failed: {str(e)}")
-            raise
+            self.logger.error("Agent %s failed", self.name, exc_info=True)
+            raise AgentExecutionError(f"Agent {self.name} failed") from e
 
     async def run_stream(self, user_prompt: str, deps: DepsT):
         """
@@ -283,7 +293,7 @@ async def run_stream(self, user_prompt: str, deps: DepsT):
         # Note: Rate limiting not supported for streaming to avoid complexity
         # The async context manager pattern doesn't work well with rate limiting
         await self._ensure_agent_initialized()
-        
+
         self.logger.info(f"Starting streaming for agent {self.name}")
         # run_stream returns an async context manager directly, not a coroutine
         return self._agent.run_stream(user_prompt, deps=deps)
@@ -310,4 +320,6 @@ def add_system_prompt_function(self, func):
     @property
     def agent(self) -> Agent:
         """Get the underlying PydanticAI agent instance."""
+        if self._agent is None:
+            raise RuntimeError("Agent not initialized; call await _ensure_agent_initialized() first")
         return self._agent

From 3c53fdeb65188ca48cc43b14efb872e3539c3c48 Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 17:41:18 -0400
Subject: [PATCH 16/18] feat: Improve private host detection for HTTP URL
 warnings

- Add ipaddress import for robust IP address validation
- Expand private host detection to include RFC1918 private networks:
  - IPv4: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
  - IPv6: loopback (::1) and unique local addresses (fc00::/7)
- Include Docker-specific hostnames (host.docker.internal)
- Reduce noisy warnings for legitimate corporate proxy deployments
- Use ipaddress.is_loopback and is_private for accurate detection
- Maintain security warnings for genuinely public HTTP endpoints

This prevents false warnings for internal development environments,
Docker deployments, and corporate networks while still alerting
for potentially insecure public HTTP endpoints.
---
 python/src/agents/agent_provider_config.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
index 3de0553da8..fe7311bac8 100644
--- a/python/src/agents/agent_provider_config.py
+++ b/python/src/agents/agent_provider_config.py
@@ -5,6 +5,7 @@
 Enables custom base_url configuration for OpenAI-compatible endpoints.
 """
 
+import ipaddress
 import logging
 import os
 from urllib.parse import urlparse
@@ -56,7 +57,14 @@ def _validate_base_url(base_url: str) -> str:
         raise ValueError("Base URL must not embed credentials (userinfo)")
 
     # Log security consideration for non-HTTPS URLs
-    if parsed.scheme == 'http' and not parsed.hostname.startswith(('localhost', '127.0.0.1', '0.0.0.0')):
+    is_private = False
+    try:
+        host_ip = ipaddress.ip_address(parsed.hostname)
+        is_private = host_ip.is_loopback or host_ip.is_private
+    except ValueError:
+        # Not an IP literal; accept common local hostnames
+        is_private = parsed.hostname in ('localhost', 'host.docker.internal')
+    if parsed.scheme == 'http' and not is_private:
         logger.warning(f"Using non-HTTPS URL for OpenAI base URL: {url}. Consider using HTTPS for production.")
 
     return url

From 58a9e13242ce50c8cf27723175f720b32df14b71 Mon Sep 17 00:00:00 2001
From: Orestes Garcia <dev@setsero.com>
Date: Thu, 4 Sep 2025 17:47:55 -0400
Subject: [PATCH 17/18] feat: Add configurable timeouts and retries to OpenAI
 clients

- Add environment variable configuration for OpenAI client behavior:
  - OPENAI_TIMEOUT_SECONDS (default: 60) - Request timeout in seconds
  - OPENAI_MAX_RETRIES (default: 5) - Maximum retry attempts
- Apply consistent timeout and retry configuration across all providers:
  - OpenAI (including custom base URLs)
  - Ollama (OpenAI-compatible client)
  - Google Gemini (OpenAI-compatible client)
- Improve reliability and control over API behavior
- Allow environment-specific tuning for production vs development
- Aligns with backoff guideline by setting defaults at client construction
- Downstream calls inherit retry/timeout behavior automatically
---
 python/src/server/services/llm_provider_service.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/python/src/server/services/llm_provider_service.py b/python/src/server/services/llm_provider_service.py
index 3c2403d18c..fe55e1ca44 100644
--- a/python/src/server/services/llm_provider_service.py
+++ b/python/src/server/services/llm_provider_service.py
@@ -5,6 +5,7 @@
 Supports OpenAI, Ollama, and Google Gemini.
 """
 
+import os
 import time
 from contextlib import asynccontextmanager
 from typing import Any
@@ -113,7 +114,11 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
             final_base_url = config_base_url or base_url
 
             # Create client with centralized configuration
-            client_kwargs = {"api_key": final_api_key}
+            client_kwargs = {
+                "api_key": final_api_key,
+                "timeout": float(os.getenv("OPENAI_TIMEOUT_SECONDS", "60")),
+                "max_retries": int(os.getenv("OPENAI_MAX_RETRIES", "5")),
+            }
             if final_base_url:
                 client_kwargs["base_url"] = final_base_url
                 logger.info(f"OpenAI client created with custom base URL: {final_base_url}")
@@ -127,6 +132,8 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
             client = openai.AsyncOpenAI(
                 api_key="ollama",  # Required but unused by Ollama
                 base_url=base_url or "http://localhost:11434/v1",
+                timeout=float(os.getenv("OPENAI_TIMEOUT_SECONDS", "60")),
+                max_retries=int(os.getenv("OPENAI_MAX_RETRIES", "5")),
             )
             logger.info(f"Ollama client created successfully with base URL: {base_url}")
 
@@ -137,6 +144,8 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
             client = openai.AsyncOpenAI(
                 api_key=api_key,
                 base_url=base_url or "https://generativelanguage.googleapis.com/v1beta/openai/",
+                timeout=float(os.getenv("OPENAI_TIMEOUT_SECONDS", "60")),
+                max_retries=int(os.getenv("OPENAI_MAX_RETRIES", "5")),
             )
             logger.info("Google Gemini client created successfully")
 

From 86042528ec1aefcd837300dd8edd7622385f4463 Mon Sep 17 00:00:00 2001
From: orestesgarcia <garcia.orestes@gmail.com>
Date: Thu, 4 Sep 2025 17:49:32 -0400
Subject: [PATCH 18/18] Update docs/docs/rag.mdx

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 docs/docs/rag.mdx | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/docs/docs/rag.mdx b/docs/docs/rag.mdx
index 9b3a91bc01..bb7db572e2 100644
--- a/docs/docs/rag.mdx
+++ b/docs/docs/rag.mdx
@@ -343,18 +343,6 @@ litellm --port 8000 --config litellm_config.yaml
 </TabItem>
 <TabItem value="azure" label="Azure OpenAI">
 
-```bash
-# Azure OpenAI endpoint
-LLM_PROVIDER=openai
-OPENAI_BASE_URL=https://your-resource.openai.azure.com/openai/deployments/your-deployment
-MODEL_CHOICE=gpt-4o-mini
-OPENAI_API_KEY=your-azure-api-key
-
-# Benefits:
-# - Enterprise compliance and security
-# - Data residency control  
-# - Integrated with Azure services
-```
 
 </TabItem>
 <TabItem value="corporate" label="Corporate Proxy">