feat(llm): add enterprise gateway and SSL verification support

[ak684]

---

Agent Server images for this PR

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant	Architectures	Base Image	Docs / Tags
java	amd64, arm64	eclipse-temurin:17-jdk	Link
python	amd64, arm64	nikolaik/python-nodejs:python3.12-nodejs22	Link
golang	amd64, arm64	golang:1.21-bookworm	Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:e357c90-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-e357c90-python \
  ghcr.io/openhands/agent-server:e357c90-python

All tags pushed for this build

ghcr.io/openhands/agent-server:e357c90-golang-amd64
ghcr.io/openhands/agent-server:e357c90-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:e357c90-golang-arm64
ghcr.io/openhands/agent-server:e357c90-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:e357c90-java-amd64
ghcr.io/openhands/agent-server:e357c90-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:e357c90-java-arm64
ghcr.io/openhands/agent-server:e357c90-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:e357c90-python-amd64
ghcr.io/openhands/agent-server:e357c90-nikolaik_s_python-nodejs_tag_python3.12-nodejs22-amd64
ghcr.io/openhands/agent-server:e357c90-python-arm64
ghcr.io/openhands/agent-server:e357c90-nikolaik_s_python-nodejs_tag_python3.12-nodejs22-arm64
ghcr.io/openhands/agent-server:e357c90-golang
ghcr.io/openhands/agent-server:e357c90-java
ghcr.io/openhands/agent-server:e357c90-python

About Multi-Architecture Support

• Each variant tag (e.g., e357c90-python) is a multi-arch manifest supporting both amd64 and arm64
• Docker automatically pulls the correct architecture for your platform
• Individual architecture tags (e.g., e357c90-python-amd64) are also available if needed

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
openhands-sdk/openhands/sdk/llm
llm.py	456	189	58%	324, 328, 333, 337, 341, 345–347, 351–352, 363–364, 366–367, 371, 388, 417, 422, 426, 431, 451, 480, 501, 505, 520, 526–527, 546–547, 557, 582–587, 608–609, 612, 616, 628, 633–636, 643, 646, 654–659, 663–666, 668, 683, 687–689, 691–692, 697–698, 700, 707, 710–715, 785–788, 793–797, 799–804, 806–808, 817–819, 822–823, 869–870, 873–876, 917, 931, 981, 984–986, 989–997, 1001–1003, 1006, 1009–1011, 1018–1019, 1028, 1035–1037, 1041–1042, 1044–1049, 1051–1059, 1061–1081, 1084–1088, 1090–1091, 1097–1106, 1119, 1133, 1138
openhands-sdk/openhands/sdk/llm/utils
telemetry.py	174	86	50%	109, 115, 124, 128, 131, 136–137, 172, 176, 183, 205, 209–210, 218–220, 226, 243–245, 247–249, 251, 259–260, 264–266, 269–272, 277, 282, 285, 290, 293, 299, 305, 307, 310–311, 316, 321–325, 329–336, 338–339, 343–347, 351–354, 358–362, 366–369, 373, 380–381, 384, 386, 389–392
TOTAL	12098	5590	53%

[enyst]

@OpenHands there's some monkeypatch env in pytest, which cleans up itself, for use in testing. You know what I mean. Adjust this test a bit to use it

[openhands-ai]

I'm on it! enyst can track my progress at all-hands.dev

[openhands-ai]

Summary of changes

What I updated

• File: tests/sdk/llm/test_llm.py
• Test updated: test_llm_ssl_verify_env_parsing
  • Switched from direct os.environ manipulation to pytest’s monkeypatch.setenv for environment variables.
  • Set LLM_MODEL once via monkeypatch for all load_from_env calls in the test.
  • Removed manual cleanup of environment variables and the now-unused os import.

Why

• Per the PR comment, this uses pytest’s monkeypatch fixture which automatically restores environment state after the test, improving isolation and avoiding side effects.

Verification

• Pre-commit on the changed file: passed (ruff format/lint, pycodestyle, pyright).
• Ran the specific test: uv run pytest -q tests/sdk/llm/test_llm.py::test_llm_ssl_verify_env_parsing → 1 passed.

Checklist

• Addressed the request to use pytest’s env monkeypatch.
• Kept the change minimal: only modified the relevant test and removed an unused import.
• Followed repo dev/test guidelines (pre-commit hooks, no mypy, minimal changes).
• Committed only the changed test file with Co-authored-by and pushed to the current branch.

Commit

• tests(llm): use pytest monkeypatch for env vars in ssl_verify parsing test
• Branch: alona/all-4119-add-enterprise-gateway-support-for-llm-providers-in-cli-v3

If you want, I can sweep other tests for os.environ usage and convert them to monkeypatch as well.

_{View full conversation}

[enyst]

Just to note, the docs check is not mandatory. It's there just to remind us to make a docs PR (the agent should know what to do if we tell it to do something similar to the other examples)

[blacksmith-sh]

[Automatic Post]: It has been a while since there was any activity on this PR. @ak684, are you still working on it? If so, please go ahead, if not then please request review, close it, or request that someone else follow up.

[openhands-ai]

Looks like there are a few issues preventing this PR from being merged!

• GitHub Actions are failing:
  • Check Documented Examples

If you'd like me to help, just leave a comment, like

@OpenHands please fix the failing actions on PR #1026 at branch `alona/all-4119-add-enterprise-gateway-support-for-llm-providers-in-cli-v3`

Feel free to include any additional details that might help me get this PR into a better state.

_{^{You can manage your notification settings}}

[blacksmith-sh]

[Automatic Post]: It has been a while since there was any activity on this PR. @ak684, are you still working on it? If so, please go ahead, if not then please request review, close it, or request that someone else follow up.