fix: support keyless openai-compatible endpoints

Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>

Author: am

crates/buzz-agent/src/config.rs

@@ -752,6 +752,9 @@ const DEFAULT_SYSTEM_PROMPT: &str =
 pub enum Provider {
     Anthropic,
     OpenAi,
+    /// A custom OpenAI-compatible endpoint. Unlike official OpenAI, the base
+    /// URL is explicit and bearer authentication is optional.
+    OpenAiCompat,
     /// Databricks model serving. Routes to `{base_url}/serving-endpoints/{model}/invocations`
     /// with a dynamically-acquired bearer (OAuth 2.0 PKCE, or static `DATABRICKS_TOKEN`).
     /// Wire format is OpenAI-chat-compatible — reuses the same body builder and parser.
@@ -901,6 +904,16 @@ impl Config {
                 env_or("OPENAI_COMPAT_BASE_URL", "https://api.openai.com/v1"),
                 parse_openai_api(env("OPENAI_COMPAT_API").as_deref())?,
             ),
+            Provider::OpenAiCompat => (
+                env("OPENAI_COMPAT_API_KEY").unwrap_or_default(),
+                resolve_model(
+                    buzz_agent_model.as_deref(),
+                    env("OPENAI_COMPAT_MODEL").as_deref(),
+                )
+                .ok_or_else(|| "config: OPENAI_COMPAT_MODEL required".to_string())?,
+                parse_openai_compat_base_url(env("OPENAI_COMPAT_BASE_URL").as_deref())?,
+                parse_openai_api(env("OPENAI_COMPAT_API").as_deref())?,
+            ),
             Provider::Databricks | Provider::DatabricksV2 => (
                 env("DATABRICKS_TOKEN").unwrap_or_default(),
                 resolve_model(buzz_agent_model.as_deref(), databricks_model.as_deref())
@@ -1139,10 +1152,9 @@ fn resolve_provider(
                 "anthropic" => Err(
                     "config: ANTHROPIC_API_KEY required".into(),
                 ),
-                "openai" | "openai-compat" if present_nonempty(openai_key) => Ok(Provider::OpenAi),
-                "openai" | "openai-compat" => Err(
-                    "config: OPENAI_COMPAT_API_KEY required".into(),
-                ),
+                "openai" if present_nonempty(openai_key) => Ok(Provider::OpenAi),
+                "openai" => Err("config: OPENAI_COMPAT_API_KEY required".into()),
+                "openai-compat" => Ok(Provider::OpenAiCompat),
                 "databricks" => Ok(Provider::Databricks),
                 "databricks_v2" | "databricks-v2" => Ok(Provider::DatabricksV2),
                 "openrouter" if present_nonempty(openrouter_key) => Ok(Provider::OpenRouter),
@@ -1158,6 +1170,19 @@ fn resolve_provider(
     }
 }
 
+fn parse_openai_compat_base_url(raw: Option<&str>) -> Result<String, String> {
+    let value = raw
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| "config: OPENAI_COMPAT_BASE_URL required for openai-compat".to_string())?;
+    let parsed = url::Url::parse(value)
+        .map_err(|_| "config: OPENAI_COMPAT_BASE_URL must be a valid HTTP(S) URL".to_string())?;
+    if !matches!(parsed.scheme(), "http" | "https") || parsed.host_str().is_none() {
+        return Err("config: OPENAI_COMPAT_BASE_URL must be a valid HTTP(S) URL".to_string());
+    }
+    Ok(value.trim_end_matches('/').to_string())
+}
+
 /// Parse `OPENAI_COMPAT_API`. Pure (env-free) for testability; the
 /// caller hands in the raw value.
 fn parse_openai_api(raw: Option<&str>) -> Result<OpenAiApi, String> {
@@ -1450,13 +1475,31 @@ mod tests {
     }
 
     #[test]
-    fn resolve_provider_errors_when_requested_provider_key_missing() {
-        // No fallback — missing key returns an error regardless of Databricks availability.
+    fn resolve_provider_requires_only_official_openai_key() {
         let err = resolve_provider(Some("anthropic"), None, None, None).unwrap_err();
         assert!(err.contains("ANTHROPIC_API_KEY required"), "{err}");
 
-        let err = resolve_provider(Some("openai-compat"), None, Some("   "), None).unwrap_err();
+        let err = resolve_provider(Some("openai"), None, Some("   "), None).unwrap_err();
         assert!(err.contains("OPENAI_COMPAT_API_KEY required"), "{err}");
+
+        assert_eq!(
+            resolve_provider(Some("openai-compat"), None, None, None).unwrap(),
+            Provider::OpenAiCompat
+        );
+    }
+
+    #[test]
+    fn openai_compat_base_url_is_required_and_normalized() {
+        assert!(parse_openai_compat_base_url(None)
+            .unwrap_err()
+            .contains("required for openai-compat"));
+        assert!(parse_openai_compat_base_url(Some("ftp://localhost/v1"))
+            .unwrap_err()
+            .contains("valid HTTP(S) URL"));
+        assert_eq!(
+            parse_openai_compat_base_url(Some("  http://localhost:11434/v1///  ")).unwrap(),
+            "http://localhost:11434/v1"
+        );
     }
 
     #[test]

crates/buzz-agent/src/llm.rs

@@ -106,7 +106,7 @@ impl Llm {
                     .await
                     .and_then(parse_openai_with_reasoning_details)
             }
-            Provider::OpenAi | Provider::Databricks => {
+            Provider::OpenAi | Provider::OpenAiCompat | Provider::Databricks => {
                 self.openai_request(cfg, effective_model, |use_responses, request_model| {
                     // Normalize effort for model-specific availability. Startup no longer rejects
                     // `max` for pure OpenAI/Databricks; this per-model table is the single authority
@@ -246,7 +246,7 @@ impl Llm {
                     let v = self.post_openrouter(cfg, &body).await?;
                     Ok(parse_openai(v)?.text)
                 }
-                Provider::OpenAi | Provider::Databricks => {
+                Provider::OpenAi | Provider::OpenAiCompat | Provider::Databricks => {
                     let r = self
                         .openai_request(cfg, effective_model, |use_responses, request_model| {
                             if use_responses {
@@ -471,14 +471,19 @@ impl Llm {
         // statuses map to `LlmAuth` in `post`: a 403 is indistinguishable from
         // an expired-token 403 here, so we refresh once and let it propagate.
         let mut bearer = self.auth.bearer().await.map_err(PostError::from)?;
+        let use_bearer = cfg.provider != Provider::OpenAiCompat || !bearer.is_empty();
         let mut refreshed = false;
         loop {
-            match post(&self.http, &url, body_ref, cfg.llm_timeout, |r| {
-                r.bearer_auth(&bearer)
+            match post(&self.http, &url, body_ref, cfg.llm_timeout, |request| {
+                if use_bearer {
+                    request.bearer_auth(&bearer)
+                } else {
+                    request
+                }
             })
             .await
             {
-                Err(PostError::Agent(AgentError::LlmAuth(_))) if !refreshed => {
+                Err(PostError::Agent(AgentError::LlmAuth(_))) if use_bearer && !refreshed => {
                     refreshed = true;
                     bearer = self
                         .auth
@@ -2071,7 +2076,7 @@ pub(crate) fn databricks_pkce_config(host: &str) -> PkceOAuthConfig {
 ///   flow; subsequent requests use the cache + refresh transparently.
 pub(crate) fn build_token_source(cfg: &Config) -> Result<Arc<dyn TokenSource>, AgentError> {
     match cfg.provider {
-        Provider::Anthropic | Provider::OpenAi | Provider::OpenRouter => {
+        Provider::Anthropic | Provider::OpenAi | Provider::OpenAiCompat | Provider::OpenRouter => {
             Ok(Arc::new(StaticTokenSource::new(cfg.api_key.clone())))
         }
         Provider::Databricks | Provider::DatabricksV2 => {
@@ -2097,9 +2102,11 @@ pub(crate) fn build_token_source(cfg: &Config) -> Result<Arc<dyn TokenSource>, A
 pub(crate) fn summary_completion_cap(provider: Provider, max_output_tokens: u32) -> u32 {
     match provider {
         Provider::OpenRouter => max_output_tokens.saturating_mul(2),
-        Provider::Anthropic | Provider::OpenAi | Provider::Databricks | Provider::DatabricksV2 => {
-            max_output_tokens
-        }
+        Provider::Anthropic
+        | Provider::OpenAi
+        | Provider::OpenAiCompat
+        | Provider::Databricks
+        | Provider::DatabricksV2 => max_output_tokens,
     }
 }
 
@@ -5725,6 +5732,49 @@ mod tests {
         }
     }
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn post_openai_compat_omits_authorization_when_key_is_empty() {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+        use tokio::net::TcpListener;
+
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let base = format!("http://{}", listener.local_addr().unwrap());
+        let captured = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let mut bytes = Vec::new();
+            let mut buffer = [0u8; 4096];
+            while !bytes.windows(4).any(|window| window == b"\r\n\r\n") {
+                let count = socket.read(&mut buffer).await.unwrap();
+                if count == 0 {
+                    break;
+                }
+                bytes.extend_from_slice(&buffer[..count]);
+            }
+            let body = "{\"ok\":true}";
+            socket
+                .write_all(
+                    format!(
+                        "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+                        body.len(), body
+                    )
+                    .as_bytes(),
+                )
+                .await
+                .unwrap();
+            String::from_utf8_lossy(&bytes).to_ascii_lowercase()
+        });
+
+        let llm = llm_with(Arc::new(StaticTokenSource::new("")));
+        let mut config = cfg(Provider::OpenAiCompat);
+        config.base_url = base;
+        llm.post_openai(&config, "/v1/x", &json!({}), "model")
+            .await
+            .unwrap();
+
+        let headers = captured.await.unwrap();
+        assert!(!headers.contains("authorization:"), "{headers}");
+    }
+
     /// A single 401 forces exactly one refresh, the retry with the fresh
     /// token succeeds, and a *later* call gets its own refresh — proving the
     /// one-shot guard is per-call, not stored on the source.