faet: add base-url for custom providers (#15)

Author: Gusarich

README.md

@@ -176,6 +176,26 @@ Some plugins (e.g., Claude Code) validate model aliases via `models.yaml`. If an
 - Plugins default to `pitaya-agents:latest`; override per run with `--docker-image <repo/name:tag>`
 - Full isolation per instance: dedicated container, workspace mount, and session volume
 
+### OpenAI‑Compatible Providers (Codex)
+
+- Pass `--api-key` and `--base-url` to target any OpenAI‑compatible endpoint. Pitaya configures the Codex CLI provider under the hood.
+- Example (OpenRouter):
+
+  ```bash
+  pitaya "hello" \
+    --plugin codex \
+    --model "openai/gpt-5" \
+    --api-key "$OPENROUTER_API_KEY" \
+    --base-url https://openrouter.ai/api/v1
+  ```
+
+- This works with any OpenAI‑compatible API (self‑hosted or proxy). The API key is provided to the container via `OPENAI_API_KEY`.
+
+### Anthropic (Claude Code)
+
+- Use `--oauth-token` (subscription) or `--api-key` (API mode). Optional `--base-url` is respected as `ANTHROPIC_BASE_URL`.
+- Env alternatives: `CLAUDE_CODE_OAUTH_TOKEN`, `ANTHROPIC_API_KEY`, and `ANTHROPIC_BASE_URL`.
+
 ## Logs & Artifacts
 
 - Logs: `logs/<run_id>/events.jsonl` and structured component logs

src/cli.py

@@ -237,6 +237,10 @@ def create_parser(cls) -> argparse.ArgumentParser:
             "--api-key",
             help="API key (or set ANTHROPIC_API_KEY / OPENAI_API_KEY)",
         )
+        g_auth.add_argument(
+            "--base-url",
+            help="Custom API base URL (e.g., OpenAI/Anthropic proxy)",
+        )
 
         # Execution & limits group
         g_limits = parser.add_argument_group("Execution & Limits")
@@ -363,6 +367,8 @@ def _get_auth_config(
             cli_config.setdefault("runner", {})["oauth_token"] = args.oauth_token
         if hasattr(args, "api_key") and args.api_key:
             cli_config.setdefault("runner", {})["api_key"] = args.api_key
+        if hasattr(args, "base_url") and args.base_url:
+            cli_config.setdefault("runner", {})["base_url"] = args.base_url
         # Include plugin selection at top-level for strategy-agnostic wiring
         if hasattr(args, "plugin") and args.plugin:
             cli_config["plugin_name"] = args.plugin
@@ -372,10 +378,24 @@ def _get_auth_config(
             cli_config, env_config, dotenv_config, config or {}, defaults
         )
 
-        # Extract auth values from merged config
-        oauth_token = full_config.get("runner", {}).get("oauth_token")
-        api_key = full_config.get("runner", {}).get("api_key")
-        base_url = full_config.get("runner", {}).get("base_url")
+        # Extract auth values from merged config; select by plugin for consistency
+        runner_cfg = full_config.get("runner", {})
+        plugin_name = full_config.get("plugin_name") or getattr(
+            args, "plugin", "claude-code"
+        )
+
+        if str(plugin_name) == "codex":
+            # Prefer OpenAI keys; allow CLI overrides via generic api_key/base_url
+            api_key = runner_cfg.get("api_key") or runner_cfg.get("openai_api_key")
+            base_url = runner_cfg.get("base_url") or runner_cfg.get("openai_base_url")
+            oauth_token = None
+        else:
+            # Claude Code: prefer OAuth, then Anthropic API key
+            oauth_token = runner_cfg.get("oauth_token")
+            api_key = runner_cfg.get("api_key") or runner_cfg.get("anthropic_api_key")
+            base_url = runner_cfg.get("base_url") or runner_cfg.get(
+                "anthropic_base_url"
+            )
 
         # Apply mode selection logic per spec section 6.1
         # 1. If --mode api specified, use API key
@@ -412,15 +432,25 @@ def _get_auth_config(
         elif api_key:
             # API mode when only API key is available
             pass
-        # 5. Otherwise, error with clear message
+        # 5. Otherwise, error with clear message (fail fast for both providers)
         else:
-            # Do not hard-fail: non-Anthropic plugins (e.g., Codex) may use OPENAI_API_KEY
-            # or run in OSS mode. Warn and proceed with empty AuthConfig.
-            self.console.print(
-                "[yellow]Warning: No provider credentials found.\n"
-                "- For Anthropic, set CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY.\n"
-                "- For OpenAI, ensure OPENAI_API_KEY is set (and OPENAI_BASE_URL if applicable).[/yellow]"
-            )
+            if str(plugin_name) == "codex":
+                self.console.print(
+                    "[red]Error: Missing credentials for OpenAI‑compatible provider.[/red]\n"
+                    "Set OPENAI_API_KEY in:\n"
+                    "  - .env file (OPENAI_API_KEY=...)\n"
+                    "  - Environment variables (export OPENAI_API_KEY=...)\n"
+                    "  - Command line: --api-key\n"
+                    "Optionally set --base-url (or OPENAI_BASE_URL) for non-default endpoints."
+                )
+            else:
+                self.console.print(
+                    "[red]Error: Missing credentials for Anthropic.[/red]\n"
+                    "Set CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY in:\n"
+                    "  - .env file\n"
+                    "  - Environment variables\n"
+                    "  - Command line: --oauth-token or --api-key"
+                )
             return AuthConfig(oauth_token=None, api_key=None, base_url=None)
 
         return AuthConfig(oauth_token=oauth_token, api_key=api_key, base_url=base_url)
@@ -1601,6 +1631,8 @@ async def run_orchestrator(self, args: argparse.Namespace) -> int:
             cli_config.setdefault("runner", {})["oauth_token"] = args.oauth_token
         if hasattr(args, "api_key") and args.api_key:
             cli_config.setdefault("runner", {})["api_key"] = args.api_key
+        if hasattr(args, "base_url") and args.base_url:
+            cli_config.setdefault("runner", {})["base_url"] = args.base_url
 
         # Apply proxy flags to environment early so downstream components observe them
         # Proxy environment mapping removed
@@ -1766,29 +1798,38 @@ def _red(k, v):
 
         retry_config = RetryConfig(max_attempts=3)
 
-        # Create auth config from merged configuration
-        oauth_token = full_config.get("runner", {}).get("oauth_token")
-        api_key = full_config.get("runner", {}).get("api_key")
-        base_url = full_config.get("runner", {}).get("base_url")
-
-        if not oauth_token and not api_key:
-            # Allow non-Anthropic plugins to continue (e.g., Codex with OPENAI_API_KEY)
-            plugin_name = full_config.get("plugin_name") or getattr(
-                args, "plugin", "claude-code"
-            )
-            if str(plugin_name) == "claude-code":
+        # Create auth config from merged configuration (plugin-aware)
+        plugin_name = full_config.get("plugin_name") or getattr(
+            args, "plugin", "claude-code"
+        )
+        rcfg = full_config.get("runner", {})
+        if str(plugin_name) == "codex":
+            api_key = rcfg.get("api_key") or rcfg.get("openai_api_key")
+            base_url = rcfg.get("base_url") or rcfg.get("openai_base_url")
+            oauth_token = None
+            if not api_key:
                 self.console.print(
-                    "[red]Error: Missing credentials for the selected provider.[/red]\n"
+                    "[red]Error: Missing credentials for OpenAI‑compatible provider.[/red]\n"
+                    "Set OPENAI_API_KEY in:\n"
+                    "  - .env file (OPENAI_API_KEY=...)\n"
+                    "  - Environment variables (export OPENAI_API_KEY=...)\n"
+                    "  - Command line: --api-key\n"
+                    "Optionally set --base-url (or OPENAI_BASE_URL) for non-default endpoints."
+                )
+                return 1
+        else:
+            oauth_token = rcfg.get("oauth_token")
+            api_key = rcfg.get("api_key") or rcfg.get("anthropic_api_key")
+            base_url = rcfg.get("base_url") or rcfg.get("anthropic_base_url")
+            if not oauth_token and not api_key:
+                self.console.print(
+                    "[red]Error: Missing credentials for Anthropic.[/red]\n"
                     "Set CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY in:\n"
                     "  - .env file\n"
                     "  - Environment variables\n"
                     "  - Command line: --oauth-token or --api-key"
                 )
                 return 1
-            else:
-                self.console.print(
-                    "[yellow]Warning: No provider credentials set. Proceeding with selected plugin.[/yellow]"
-                )
 
         auth_config = AuthConfig(
             oauth_token=oauth_token, api_key=api_key, base_url=base_url

src/config.py

@@ -147,8 +147,8 @@ def load_dotenv_config(dotenv_path: Optional[Path] = None) -> Dict[str, Any]:
 
     Supports standard environment variables:
     - CLAUDE_CODE_OAUTH_TOKEN
-    - ANTHROPIC_API_KEY
-    - ANTHROPIC_BASE_URL
+    - ANTHROPIC_API_KEY / ANTHROPIC_BASE_URL
+    - OPENAI_API_KEY / OPENAI_BASE_URL
 
     Args:
         dotenv_path: Path to .env file (default: .env in current directory)
@@ -178,12 +178,22 @@ def load_dotenv_config(dotenv_path: Optional[Path] = None) -> Dict[str, Any]:
     if "ANTHROPIC_API_KEY" in env_values:
         if "runner" not in config:
             config["runner"] = {}
-        config["runner"]["api_key"] = env_values["ANTHROPIC_API_KEY"]
+        config["runner"]["anthropic_api_key"] = env_values["ANTHROPIC_API_KEY"]
 
     if "ANTHROPIC_BASE_URL" in env_values:
         if "runner" not in config:
             config["runner"] = {}
-        config["runner"]["base_url"] = env_values["ANTHROPIC_BASE_URL"]
+        config["runner"]["anthropic_base_url"] = env_values["ANTHROPIC_BASE_URL"]
+
+    if "OPENAI_API_KEY" in env_values:
+        if "runner" not in config:
+            config["runner"] = {}
+        config["runner"]["openai_api_key"] = env_values["OPENAI_API_KEY"]
+
+    if "OPENAI_BASE_URL" in env_values:
+        if "runner" not in config:
+            config["runner"] = {}
+        config["runner"]["openai_base_url"] = env_values["OPENAI_BASE_URL"]
 
     return config
 
@@ -192,7 +202,7 @@ def load_env_config() -> Dict[str, Any]:
     """
     Load environment variables into a config dict.
 
-    Supports standard names (CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY).
+    Supports standard names (CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_*, OPENAI_*).
     """
     config: Dict[str, Any] = {}
 
@@ -205,12 +215,22 @@ def load_env_config() -> Dict[str, Any]:
     if "ANTHROPIC_API_KEY" in os.environ:
         if "runner" not in config:
             config["runner"] = {}
-        config["runner"]["api_key"] = os.environ["ANTHROPIC_API_KEY"]
+        config["runner"]["anthropic_api_key"] = os.environ["ANTHROPIC_API_KEY"]
 
     if "ANTHROPIC_BASE_URL" in os.environ:
         if "runner" not in config:
             config["runner"] = {}
-        config["runner"]["base_url"] = os.environ["ANTHROPIC_BASE_URL"]
+        config["runner"]["anthropic_base_url"] = os.environ["ANTHROPIC_BASE_URL"]
+
+    if "OPENAI_API_KEY" in os.environ:
+        if "runner" not in config:
+            config["runner"] = {}
+        config["runner"]["openai_api_key"] = os.environ["OPENAI_API_KEY"]
+
+    if "OPENAI_BASE_URL" in os.environ:
+        if "runner" not in config:
+            config["runner"] = {}
+        config["runner"]["openai_base_url"] = os.environ["OPENAI_BASE_URL"]
 
     # No Pitaya-specific env variables; use CLI or config file
 

src/instance_runner/plugins/codex.py

@@ -45,7 +45,7 @@ def capabilities(self) -> PluginCapabilities:
             supports_streaming=True,
             supports_cost_limits=False,
             requires_auth=False,  # allow OSS mode; OpenAI auth optional
-            auth_methods=["api_key", "oauth", "oss"],
+            auth_methods=["api_key", "oss"],  # reflect actual supported auth paths
         )
 
     async def validate_environment(
@@ -84,22 +84,7 @@ async def prepare_environment(
         if "OPENAI_BASE_URL" in os.environ:
             env.setdefault("OPENAI_BASE_URL", os.environ["OPENAI_BASE_URL"])
 
-        # Fallback to .env file for OPENAI_* if not present in process environment
-        if "OPENAI_API_KEY" not in env or not env.get("OPENAI_API_KEY"):
-            try:
-                from dotenv import dotenv_values  # type: ignore
-
-                values = dotenv_values()
-                if values and values.get("OPENAI_API_KEY"):
-                    env["OPENAI_API_KEY"] = str(values.get("OPENAI_API_KEY"))
-                if (
-                    values
-                    and values.get("OPENAI_BASE_URL")
-                    and "OPENAI_BASE_URL" not in env
-                ):
-                    env["OPENAI_BASE_URL"] = str(values.get("OPENAI_BASE_URL"))
-            except Exception:
-                pass
+        # .env fallback is handled globally by the CLI/config merger; avoid plugin-level dotenv reads
 
         # Proxy passthrough will be handled in DockerManager based on network_egress
         return env
@@ -140,6 +125,24 @@ async def build_command(
         if model:
             cmd += ["-m", model]
 
+        # Custom provider wiring: when a base URL is provided (via runner), configure
+        # Codex CLI provider using -c flags. This is required for non-default endpoints.
+        provider_base_url = kwargs.get("provider_base_url")
+        provider_env_key = kwargs.get("provider_env_key") or "OPENAI_API_KEY"
+        if provider_base_url:
+            # Select a custom provider key and map model + provider config
+            cmd += ["-c", "model_provider=pitaya_custom"]
+            if model:
+                cmd += ["-c", f'model="{model}"']
+            # Brace escaping for f-string: double {{ }} to emit literal braces
+            cmd += [
+                "-c",
+                (
+                    f"model_providers.pitaya_custom="
+                    f'{{ name="CustomProvider", base_url="{provider_base_url}", env_key="{provider_env_key}" }}'
+                ),
+            ]
+
         # Resume/reattach: experimental; accept session_id when provided
         # (Codex may expect a rollout path; we pass session id to be safe if supported)
         if session_id:

src/instance_runner/runner.py

@@ -615,6 +615,21 @@ def emit_event(event_type: str, data: Dict[str, Any]) -> None:
             )
 
             # Execute via plugin interface
+            # Provide provider hints to Codex when custom base URL is configured
+            codex_provider_kwargs = {}
+            try:
+                if getattr(plugin, "name", "") == "codex":
+                    purl = None
+                    if auth_config and getattr(auth_config, "base_url", None):
+                        purl = auth_config.base_url
+                    if not purl:
+                        purl = (env_vars or {}).get("OPENAI_BASE_URL")
+                    if purl:
+                        codex_provider_kwargs["provider_base_url"] = purl
+                        codex_provider_kwargs["provider_env_key"] = "OPENAI_API_KEY"
+            except Exception:
+                pass
+
             result_data = await plugin.execute(
                 docker_manager=docker_manager,
                 container=container,
@@ -630,6 +645,7 @@ def emit_event(event_type: str, data: Dict[str, Any]) -> None:
                 operator_resume=operator_resume,
                 max_turns=max_turns,
                 stream_log_path=log_path,
+                **codex_provider_kwargs,
             )
 
             agent_session_id = result_data.get("session_id")