fix(secrets): scope image_gen plugin credential reads (openai/deepinfra/krea)

OPENAI_API_KEY, DEEPINFRA_API_KEY and KREA_API_KEY now resolve via get_secret; the OpenAI client is constructed with the scoped key explicitly instead of relying on the SDK's implicit environ read.

plugins/image_gen/deepinfra/__init__.py

@@ -31,6 +31,7 @@ import logging
 import os
 from typing import Any, Dict, List, Optional
 
+from agent.secret_scope import get_secret
 from agent.image_gen_provider import (
     DEFAULT_ASPECT_RATIO,
     ImageGenProvider,
@@ -138,7 +139,7 @@ class DeepInfraImageGenProvider(ImageGenProvider):
         return "DeepInfra"
 
     def is_available(self) -> bool:
-        return bool(os.environ.get("DEEPINFRA_API_KEY", "").strip())
+        return bool((get_secret("DEEPINFRA_API_KEY", "") or "").strip())
 
     def list_models(self) -> List[Dict[str, Any]]:
         live = _live_models()
@@ -199,7 +200,7 @@ class DeepInfraImageGenProvider(ImageGenProvider):
                 aspect_ratio=aspect,
             )
 
-        api_key = os.environ.get("DEEPINFRA_API_KEY", "").strip()
+        api_key = (get_secret("DEEPINFRA_API_KEY", "") or "").strip()
         if not api_key:
             return error_response(
                 error=(

plugins/image_gen/krea/__init__.py

@@ -30,6 +30,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 import requests
 
+from agent.secret_scope import get_secret
 from agent.image_gen_provider import (
     DEFAULT_ASPECT_RATIO,
     ImageGenProvider,
@@ -177,7 +178,7 @@ def _resolve_managed_krea_gateway():
         logger.debug("Managed Krea gateway resolution unavailable: %s", exc)
         return None
 
-    if os.environ.get("KREA_API_KEY") and not prefers_gateway("image_gen"):
+    if get_secret("KREA_API_KEY") and not prefers_gateway("image_gen"):
         return None
 
     try:
@@ -233,7 +234,7 @@ class KreaImageGenProvider(ImageGenProvider):
         # Available with a direct Krea key OR via the managed Nous gateway
         # (Nous Subscription), so portal users with no Krea key can still
         # reach Krea 2 through the gateway.
-        return bool(os.environ.get("KREA_API_KEY")) or _managed_krea_gateway_ready()
+        return bool(get_secret("KREA_API_KEY")) or _managed_krea_gateway_ready()
 
     def list_models(self) -> List[Dict[str, Any]]:
         return [
@@ -338,7 +339,7 @@ class KreaImageGenProvider(ImageGenProvider):
             auth_token = managed.nous_user_token
         else:
             base_url = BASE_URL
-            auth_token = os.environ.get("KREA_API_KEY")
+            auth_token = get_secret("KREA_API_KEY")
             if not auth_token:
                 return error_response(
                     error=(

plugins/image_gen/openai/__init__.py

@@ -27,6 +27,7 @@ import logging
 import os
 from typing import Any, Dict, List, Optional, Tuple
 
+from agent.secret_scope import get_secret
 from agent.image_gen_provider import (
     DEFAULT_ASPECT_RATIO,
     ImageGenProvider,
@@ -173,7 +174,7 @@ class OpenAIImageGenProvider(ImageGenProvider):
         return "OpenAI"
 
     def is_available(self) -> bool:
-        if not os.environ.get("OPENAI_API_KEY"):
+        if not get_secret("OPENAI_API_KEY"):
             return False
         try:
             import openai  # noqa: F401
@@ -235,7 +236,8 @@ class OpenAIImageGenProvider(ImageGenProvider):
                 aspect_ratio=aspect,
             )
 
-        if not os.environ.get("OPENAI_API_KEY"):
+        api_key = get_secret("OPENAI_API_KEY")
+        if not api_key:
             return error_response(
                 error=(
                     "OPENAI_API_KEY not set. Run `hermes tools` → Image "
@@ -270,7 +272,7 @@ class OpenAIImageGenProvider(ImageGenProvider):
         is_edit = bool(sources)
         modality = "image" if is_edit else "text"
 
-        client = openai.OpenAI()
+        client = openai.OpenAI(api_key=api_key)
 
         if is_edit:
             # images.edit() expects file-like objects. Download/read each