hermes-agent/plugins/image_gen/openai/__init__.py

"""OpenAI GPT Image 2 and 2.5 Flare/Sunburst quality tiers;
base64 output → image cache. Selection: ``OPENAI_IMAGE_MODEL`` → ``image_gen.openai.model`` →
``image_gen.model`` → :data:`DEFAULT_MODEL`; an id outside the catalog is sent verbatim.
Endpoint: ``image_gen.openai.base_url`` → the named endpoint ``image_gen.openai.provider`` →
``OPENAI_BASE_URL`` → SDK default; key: env named by ``image_gen.openai.key_env`` → the named
endpoint's credential → ``OPENAI_API_KEY``."""

from __future__ import annotations

import io
import logging
import os
from typing import Any, Dict, List, Optional, Tuple

from agent.secret_scope import get_secret, get_secret_str
from agent.image_gen_provider import DEFAULT_ASPECT_RATIO, resolve_aspect_ratio, success_response
from plugins.image_gen._common import (
    GPT_IMAGE_2_API_MODEL as API_MODEL, GPT_IMAGE_2_DEFAULT as DEFAULT_MODEL, GPT_IMAGE_2_TIERS,
    StaticImageGenProvider, collect_source_images, error_factory, import_openai, load_image_gen_config,
    materialize_image, openai_importable, prompt_required_error, record_token_usage, resolve_static_model,
    size_for)

logger = logging.getLogger(__name__)

# Keep subscription routing independent: Codex does not verify explicit image model selection.
MODELS = {
    **{key: {**meta, "api_model": API_MODEL} for key, meta in GPT_IMAGE_2_TIERS.items()},
    **{
        model if quality == "auto" else f"{model}-{quality}": {
            "display": f"GPT Image 2.5 {name} ({quality.title()})",
            "speed": speed,
            "strengths": strengths,
            "api_model": model,
            "quality": quality,
        }
        for model, name, speed, strengths in (
            ("gpt-image-2.5-flare", "Flare", "Fast", "Everyday image generation and editing"),
            ("gpt-image-2.5-sunburst", "Sunburst", "Slower", "Precision generation and editing"),
        )
        for quality in ("auto", "low", "medium", "high", "xhigh", "max")
    },
}


def _resolve_model() -> Tuple[str, Dict[str, Any]]:
    return resolve_static_model(
        MODELS, DEFAULT_MODEL, env_var="OPENAI_IMAGE_MODEL", config_key="openai", passthrough=True)


def _named_endpoint(name: str) -> Tuple[str, str]:
    """``(base_url, api_key)`` of the user-declared custom endpoint *name* (``providers:`` /
    ``custom_providers:``), so image generation reuses a chat endpoint's URL and credential without
    duplicating the key into OpenAI variables (#83080). Unknown name → ``("", "")`` with a warning."""
    from hermes_cli.runtime_provider import _get_named_custom_provider

    entry = _get_named_custom_provider(name)
    if not entry:
        logger.warning("image_gen.openai.provider %r matches no custom endpoint in providers:", name)
        return "", ""
    key_env = str(entry.get("key_env") or "").strip()
    api_key = str(entry.get("api_key") or "").strip() or (get_secret(key_env) if key_env else None) or ""
    return str(entry.get("base_url") or "").strip().rstrip("/"), api_key


def _resolve_endpoint() -> Tuple[str, str]:
    """``(base_url, api_key)`` — ``image_gen.openai.base_url`` → ``OPENAI_BASE_URL`` → ``""`` (SDK default);
    the env var named by ``image_gen.openai.key_env`` → ``OPENAI_API_KEY``. Only the var NAME lives in
    config.yaml; ``is_available()`` and ``generate()`` share this so they cannot disagree (#65309)."""
    cfg = load_image_gen_config("openai")
    named = str(cfg.get("provider") or "").strip()
    named_base, named_key = _named_endpoint(named) if named else ("", "")
    base_url = (str(cfg.get("base_url") or "").strip().rstrip("/") or named_base
                or get_secret_str("OPENAI_BASE_URL").strip())
    key_env = str(cfg.get("key_env") or "").strip()
    api_key = (get_secret(key_env) if key_env else None) or named_key or get_secret("OPENAI_API_KEY") or ""
    return base_url, api_key


def _build_client(openai: Any, base_url: str, api_key: str) -> Any:
    """``openai.OpenAI`` on Hermes' env-only-proxy httpx client, so a local/custom endpoint never
    routes through a macOS system proxy whose ExceptionsList httpx cannot see (#64888). The project
    header is blanked: an ``OPENAI_PROJECT_ID`` set for chat makes ``/images/generations`` 403 on
    projects with a model allow-list, and the key already carries the project (#60748)."""
    from agent.process_bootstrap import build_keepalive_http_client

    kwargs: Dict[str, Any] = {"api_key": api_key, "default_headers": {"OpenAI-Project": ""}}
    if base_url:
        kwargs["base_url"] = base_url
    http_client = build_keepalive_http_client(base_url)
    if http_client is not None:
        kwargs["http_client"] = http_client
    return openai.OpenAI(**kwargs)


def _load_image_bytes(ref: str) -> Tuple[bytes, str]:
    """Load ``(data, filename)`` from a URL, data URI or local path; raises on IO/network error."""
    ref = ref.strip()
    lower = ref.lower()
    if lower.startswith(("http://", "https://")):
        from tools.url_safety import create_ssrf_safe_client, is_safe_url

        if not is_safe_url(ref):
            raise ValueError(f"Image reference URL failed the SSRF safety check: {ref}")
        with create_ssrf_safe_client(timeout=60, follow_redirects=True) as client:
            resp = client.get(ref)
        resp.raise_for_status()
        name = ref.split("?", 1)[0].rsplit("/", 1)[-1] or "image.png"
        return resp.content, name
    if lower.startswith("data:"):
        import base64

        header, _, b64 = ref.partition(",")
        ext = (header.split("image/", 1)[1].split(";", 1)[0] if "image/" in header else "") or "png"
        return base64.b64decode(b64), f"image.{ext}"
    from agent.file_safety import raise_if_read_blocked  # credential-read guard before local bytes

    raise_if_read_blocked(ref)
    with open(ref, "rb") as fh:
        data = fh.read()
    return data, os.path.basename(ref) or "image.png"


def _named_bytes_io(ref: str) -> io.BytesIO:
    """``images.edit()`` expects named file-like objects for correct multipart."""
    data, fname = _load_image_bytes(ref)
    bio = io.BytesIO(data)
    bio.name = fname
    return bio


class OpenAIImageGenProvider(StaticImageGenProvider):
    """OpenAI ``images.generate`` / ``images.edit`` backend with selectable API models."""

    provider_id = "openai"
    label = "OpenAI"
    models = MODELS
    default_model_id = DEFAULT_MODEL
    price = "varies"
    setup = dict(
        name="OpenAI", badge="paid",
        tag="GPT Image 2 / 2.5 Flare / 2.5 Sunburst — text-to-image & image editing",
        key="OPENAI_API_KEY", prompt="OpenAI API key", url="https://platform.openai.com/api-keys")

    def is_available(self) -> bool:
        return bool(_resolve_endpoint()[1]) and openai_importable()

    def capabilities(self) -> Dict[str, Any]:
        # images.edit() accepts up to 16 source images.
        return {"modalities": ["text", "image"], "max_reference_images": 16}

    def generate(
        self, prompt: str, aspect_ratio: str = DEFAULT_ASPECT_RATIO, *,
        image_url: Optional[str] = None, reference_image_urls: Optional[List[str]] = None,
        **kwargs: Any,
    ) -> Dict[str, Any]:
        prompt = (prompt or "").strip()
        aspect = resolve_aspect_ratio(aspect_ratio)
        if not prompt:
            return prompt_required_error("openai", aspect)
        base_url, api_key = _resolve_endpoint()
        if not api_key:
            return error_factory("openai", aspect)(
                "OPENAI_API_KEY not set (or the variable named by image_gen.openai.key_env is empty). "
                "Run `hermes tools` → Image Generation → OpenAI to configure, or `hermes setup` "
                "to add the key.",
                "auth_required")

        openai, err = import_openai("openai", aspect)
        if err:
            return err
        tier_id, meta = _resolve_model()
        size = size_for(aspect)
        sources = collect_source_images(image_url, reference_image_urls, limit=16)
        is_edit = bool(sources)
        fail = error_factory("openai", aspect, model=tier_id, prompt=prompt)
        client = _build_client(openai, base_url, api_key)

        # gpt-image-2 returns b64_json unconditionally and REJECTS
        # ``response_format`` as an unknown parameter. Don't send it.
        # A custom (non-catalog) model id carries no quality tier: gateways reject unknown enum values.
        request: Dict[str, Any] = dict(model=meta["api_model"], prompt=prompt, size=size, n=1)
        if meta["quality"] is not None:
            request["quality"] = meta["quality"]
        if is_edit:
            try:
                files = [_named_bytes_io(ref) for ref in sources]
            except Exception as exc:
                return fail(f"Could not load source image for editing: {exc}", "io_error")
            request["image"] = files if len(files) > 1 else files[0]
        verb, call = ("edit", client.images.edit) if is_edit else ("generation", client.images.generate)
        try:
            response = call(**request)
        except Exception as exc:
            logger.debug("OpenAI image %s failed", verb, exc_info=True)
            return fail(f"OpenAI image {'editing' if is_edit else 'generation'} failed: {exc}", "api_error")

        # gpt-image bills per text/image token; the tier id is a Hermes label, the API model prices.
        # Recorded before extraction/save: the tokens are billed whether or not an image came back.
        record_token_usage(getattr(response, "usage", None), model=meta["api_model"], provider="openai")
        data = getattr(response, "data", None) or []
        if not data:
            return fail("OpenAI returned no image data", "empty_response")
        first = data[0]
        image_ref, err = materialize_image(
            getattr(first, "b64_json", None), getattr(first, "url", None),
            prefix=f"openai_{tier_id}", label="OpenAI", provider="openai",
            model=tier_id, prompt=prompt, aspect=aspect, log=logger)
        if err:
            return err
        extra: Dict[str, Any] = {"size": size, "quality": meta["quality"]}
        if getattr(first, "revised_prompt", None):
            extra["revised_prompt"] = first.revised_prompt
        return success_response(
            image=image_ref, model=tier_id, prompt=prompt, aspect_ratio=aspect, provider="openai",
            modality="image" if is_edit else "text", extra=extra)


def register(ctx) -> None:
    """Plugin entry point — wire ``OpenAIImageGenProvider`` into the registry."""
    ctx.register_image_gen_provider(OpenAIImageGenProvider())