fix(tts): honor tts.openai.api_key and base_url from config.yaml

Salvaged from PR #26233 (@LeonSGP43), rebased onto the current 3-tuple
_resolve_openai_audio_client_config (is_managed flag, post-#73072 layout).
Same fix independently submitted earlier in PR #26209 (@zccyman) — credit
to both.

Resolution order now mirrors the STT resolver: tts.openai.api_key/base_url
from config.yaml -> VOICE_TOOLS_OPENAI_KEY/OPENAI_API_KEY env (still
honoring config base_url) -> managed gateway. _has_openai_audio_backend
also counts a config api_key as an available backend.

Fixes #26175

tests/tools/test_tts_openai_config.py

@@ -0,0 +1,94 @@
+"""tts.openai.api_key / base_url from config.yaml drive the OpenAI audio client.
+
+Regression coverage for issue #26175: the resolver was env-only
+(VOICE_TOOLS_OPENAI_KEY / OPENAI_API_KEY) and always returned the default
+OpenAI base URL, ignoring the tts.openai config block. Resolution order now
+mirrors the STT resolver: config -> env (still honoring config base_url) ->
+managed gateway.
+"""
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+from tools import tts_tool
+
+
+class TestResolveOpenaiAudioClientConfig:
+    def test_prefers_tts_config_credentials_and_base_url(self):
+        config = {
+            "provider": "openai",
+            "openai": {
+                "api_key": "cfg-key",
+                "base_url": "http://localhost:4003/v1",
+            },
+        }
+
+        with patch.object(tts_tool, "_load_tts_config", return_value=config), \
+             patch.object(tts_tool, "prefers_gateway", return_value=False), \
+             patch.object(tts_tool, "resolve_openai_audio_api_key", return_value="env-key"), \
+             patch.object(tts_tool, "resolve_managed_tool_gateway", return_value=None):
+            assert tts_tool._resolve_openai_audio_client_config() == (
+                "cfg-key",
+                "http://localhost:4003/v1",
+                False,
+            )
+
+    def test_config_without_base_url_falls_back_to_default_openai_base(self):
+        config = {"openai": {"api_key": "cfg-key"}}
+
+        with patch.object(tts_tool, "_load_tts_config", return_value=config), \
+             patch.object(tts_tool, "prefers_gateway", return_value=False):
+            assert tts_tool._resolve_openai_audio_client_config() == (
+                "cfg-key",
+                tts_tool.DEFAULT_OPENAI_BASE_URL,
+                False,
+            )
+
+    def test_env_key_still_honors_config_base_url(self):
+        config = {"openai": {"base_url": "http://localhost:4003/v1"}}
+
+        with patch.object(tts_tool, "_load_tts_config", return_value=config), \
+             patch.object(tts_tool, "prefers_gateway", return_value=False), \
+             patch.object(tts_tool, "resolve_openai_audio_api_key", return_value="env-key"):
+            assert tts_tool._resolve_openai_audio_client_config() == (
+                "env-key",
+                "http://localhost:4003/v1",
+                False,
+            )
+
+    def test_use_gateway_overrides_config_credentials(self):
+        config = {"openai": {"api_key": "cfg-key", "base_url": "http://localhost:4003/v1"}}
+        managed = SimpleNamespace(
+            nous_user_token="managed-token",
+            gateway_origin="https://openai-audio-gateway.nousresearch.com",
+        )
+
+        with patch.object(tts_tool, "_load_tts_config", return_value=config), \
+             patch.object(tts_tool, "prefers_gateway", return_value=True), \
+             patch.object(tts_tool, "resolve_openai_audio_api_key", return_value="env-key"), \
+             patch.object(tts_tool, "resolve_managed_tool_gateway", return_value=managed):
+            assert tts_tool._resolve_openai_audio_client_config() == (
+                "managed-token",
+                "https://openai-audio-gateway.nousresearch.com/v1",
+                True,
+            )
+
+    def test_missing_config_and_env_raises_updated_error(self):
+        with patch.object(tts_tool, "_load_tts_config", return_value={}), \
+             patch.object(tts_tool, "prefers_gateway", return_value=False), \
+             patch.object(tts_tool, "resolve_openai_audio_api_key", return_value=""), \
+             patch.object(tts_tool, "resolve_managed_tool_gateway", return_value=None), \
+             patch.object(tts_tool, "managed_nous_tools_enabled", return_value=False):
+            with pytest.raises(ValueError) as exc:
+                tts_tool._resolve_openai_audio_client_config()
+
+        assert (
+            str(exc.value)
+            == "Neither tts.openai.api_key in config nor VOICE_TOOLS_OPENAI_KEY/OPENAI_API_KEY is set"
+        )
+
+    def test_config_api_key_counts_as_available_backend(self):
+        config = {"openai": {"api_key": "cfg-key"}}
+        with patch.object(tts_tool, "_load_tts_config", return_value=config):
+            assert tts_tool._has_openai_audio_backend() is True

tools/tts_tool.py

@@ -2827,14 +2827,30 @@ def _resolve_openai_audio_client_config() -> tuple[str, str, bool]:
     gateway (a restricted proxy), so callers can coerce the request to what the
     gateway supports. When ``tts.use_gateway`` is set the gateway is preferred
     even if direct OpenAI credentials are present.
+
+    Resolution order (mirrors the STT resolver):
+    1. ``tts.openai.api_key`` / ``tts.openai.base_url`` from ``config.yaml``
+    2. ``VOICE_TOOLS_OPENAI_KEY`` / ``OPENAI_API_KEY`` environment variables
+       (still honoring ``tts.openai.base_url`` when set)
+    3. Managed OpenAI audio tool gateway
     """
+    tts_config = _load_tts_config()
+    openai_cfg = (tts_config.get("openai") if isinstance(tts_config, dict) else None) or {}
+    cfg_api_key = openai_cfg.get("api_key") or ""
+    cfg_base_url = openai_cfg.get("base_url") or ""
+    if cfg_api_key and not prefers_gateway("tts"):
+        return cfg_api_key, (cfg_base_url or DEFAULT_OPENAI_BASE_URL), False
+
     direct_api_key = resolve_openai_audio_api_key()
     if direct_api_key and not prefers_gateway("tts"):
-        return direct_api_key, DEFAULT_OPENAI_BASE_URL, False
+        return direct_api_key, (cfg_base_url or DEFAULT_OPENAI_BASE_URL), False
 
     managed_gateway = resolve_managed_tool_gateway("openai-audio")
     if managed_gateway is None:
-        message = "Neither VOICE_TOOLS_OPENAI_KEY nor OPENAI_API_KEY is set"
+        message = (
+            "Neither tts.openai.api_key in config nor "
+            "VOICE_TOOLS_OPENAI_KEY/OPENAI_API_KEY is set"
+        )
         if managed_nous_tools_enabled() or prefers_gateway("tts"):
             message += (
                 ". "
@@ -2852,7 +2868,10 @@ def _resolve_openai_audio_client_config() -> tuple[str, str, bool]:
 
 
 def _has_openai_audio_backend() -> bool:
-    """Return True when OpenAI audio can use direct credentials or the managed gateway."""
+    """Return True when OpenAI audio can use config/env credentials or the managed gateway."""
+    openai_cfg = (_load_tts_config().get("openai") or {})
+    if openai_cfg.get("api_key"):
+        return True
     return bool(resolve_openai_audio_api_key() or resolve_managed_tool_gateway("openai-audio"))