fix(indexer): forward extra_headers/timeout to PageIndex's llm_params

Header-only gateway auth (litellm.extra_headers, e.g. a proxy Bearer
token with no LLM_API_KEY) never reached PageIndex's own LLM calls,
only api_key/base_url did (see #219) - PageIndex's internal indexing
calls had no credentials at all in that setup and failed with
AuthenticationError.

Author: Sebastian Braun

openkb/indexer.py

@@ -163,14 +163,17 @@ def _build_index_config(config: dict[str, Any], bundle=None) -> IndexConfig:
     working against a pinned PageIndex that predates it (``IndexConfig``
     forbids unknown kwargs).
 
-    ``bundle``'s ``api_key``/``base_url`` (the same credentials ``compiler.py``'s
-    own LLM calls use — see :func:`openkb.config.resolve_credential_bundle`) are
-    forwarded as PageIndex's own per-call ``llm_params`` (see #219): without
-    this, PageIndex's internal indexing calls (TOC/tree/summary generation)
-    fall back to LiteLLM's default provider-key/env-var lookup, which doesn't
-    know about a KB's custom ``LLM_API_KEY``/gateway ``base_url``. Guarded by
-    the same ``model_fields`` check as ``max_concurrency`` above, so it
-    degrades gracefully against an older pinned PageIndex.
+    ``bundle``'s ``api_key``/``base_url``/``extra_headers``/``timeout`` (the
+    same credentials ``compiler.py``'s own LLM calls use — see
+    :func:`openkb.config.resolve_credential_bundle`) are forwarded as
+    PageIndex's own per-call ``llm_params`` (see #219): without this,
+    PageIndex's internal indexing calls (TOC/tree/summary generation) fall
+    back to LiteLLM's default provider-key/env-var lookup, which doesn't know
+    about a KB's custom ``LLM_API_KEY``/gateway ``base_url`` — or, for
+    gateways authenticated purely via a header (e.g. an ``Authorization:
+    Bearer`` proxy token in ``litellm.extra_headers``), has no credentials at
+    all. Guarded by the same ``model_fields`` check as ``max_concurrency``
+    above, so it degrades gracefully against an older pinned PageIndex.
     """
     kwargs: dict[str, Any] = {
         "if_add_node_text": True,
@@ -189,8 +192,13 @@ def _build_index_config(config: dict[str, Any], bundle=None) -> IndexConfig:
     if bundle is not None:
         llm_params = {
             key: value
-            for key, value in {"api_key": bundle.api_key, "base_url": bundle.base_url}.items()
-            if value
+            for key, value in {
+                "api_key": bundle.api_key,
+                "base_url": bundle.base_url,
+                "extra_headers": bundle.extra_headers,
+                "timeout": bundle.timeout,
+            }.items()
+            if value or (key == "timeout" and value is not None)
         }
         if llm_params:
             if "llm_params" in IndexConfig.model_fields:

tests/test_indexer.py

@@ -99,15 +99,18 @@ def test_no_warning_when_supported(self, monkeypatch, caplog):
 
 
 class _FakeBundle:
-    def __init__(self, api_key=None, base_url=None):
+    def __init__(self, api_key=None, base_url=None, extra_headers=None, timeout=None):
         self.api_key = api_key
         self.base_url = base_url
+        self.extra_headers = extra_headers or {}
+        self.timeout = timeout
 
 
 class TestBuildIndexConfigLlmParams:
-    """``bundle``'s api_key/base_url must reach PageIndex's own LLM calls via
-    ``IndexConfig(llm_params=...)`` (#219) — without this they silently fall
-    back to LiteLLM's default provider-key/env-var lookup."""
+    """``bundle``'s api_key/base_url/extra_headers/timeout must reach PageIndex's
+    own LLM calls via ``IndexConfig(llm_params=...)`` (#219) — without this they
+    silently fall back to LiteLLM's default provider-key/env-var lookup (or, for
+    header-only gateway auth, have no credentials at all)."""
 
     def test_forwards_api_key_and_base_url_when_supported(self, monkeypatch):
         monkeypatch.setattr("openkb.indexer.IndexConfig", _FakeIndexConfigWithConcurrency)
@@ -138,6 +141,35 @@ def test_does_not_forward_when_unsupported(self, monkeypatch, caplog):
         assert not hasattr(cfg, "llm_params")
         assert "llm_params" in caplog.text
 
+    def test_forwards_extra_headers_and_timeout_when_supported(self, monkeypatch):
+        monkeypatch.setattr("openkb.indexer.IndexConfig", _FakeIndexConfigWithConcurrency)
+        bundle = _FakeBundle(extra_headers={"Authorization": "Bearer proxy-token"}, timeout=30.0)
+        cfg = _build_index_config({}, bundle)
+        assert cfg.llm_params == {
+            "extra_headers": {"Authorization": "Bearer proxy-token"},
+            "timeout": 30.0,
+        }
+
+    def test_empty_extra_headers_is_not_forwarded(self, monkeypatch):
+        monkeypatch.setattr("openkb.indexer.IndexConfig", _FakeIndexConfigWithConcurrency)
+        cfg = _build_index_config({}, _FakeBundle(extra_headers={}))
+        assert not hasattr(cfg, "llm_params")
+
+    def test_zero_timeout_is_forwarded(self, monkeypatch):
+        # timeout=0 is falsy but a deliberately-set value — must not be filtered
+        # out the same way an unset (None) timeout is.
+        monkeypatch.setattr("openkb.indexer.IndexConfig", _FakeIndexConfigWithConcurrency)
+        cfg = _build_index_config({}, _FakeBundle(timeout=0))
+        assert cfg.llm_params == {"timeout": 0}
+
+    def test_header_only_gateway_auth_is_forwarded_without_api_key(self, monkeypatch):
+        # Regression: proxy/gateway setups that authenticate purely via a
+        # header (no LLM_API_KEY) must still reach PageIndex's LLM calls.
+        monkeypatch.setattr("openkb.indexer.IndexConfig", _FakeIndexConfigWithConcurrency)
+        bundle = _FakeBundle(extra_headers={"Authorization": "Bearer proxy-token"})
+        cfg = _build_index_config({}, bundle)
+        assert cfg.llm_params == {"extra_headers": {"Authorization": "Bearer proxy-token"}}
+
 
 class TestClosePageindexClient:
     """Best-effort close of PageIndex's local SQLite connection(s) — see #249."""