fix(providers): OpenAI base_url (#222) + remove gemini runtime (#231) + Keycloak CI bootstrap (#218)

[RichardHightower]

Summary

Three fixes plus the research-graph plan doc, ahead of the 10.5.0 release.

fix(providers) — OpenAI base_url ignored (#222)

Both the OpenAI embedding and summarization providers built AsyncOpenAI(api_key=api_key) without passing the configured base_url, so every request went to api.openai.com regardless of config.yaml. This made Agent Brain unusable with OpenAI-compatible endpoints (LiteLLM, vLLM, LocalAI, Azure OpenAI, internal gateways) and failed with APIConnectionError where there's no direct OpenAI egress.

Both now pass base_url=config.get_base_url() or None, matching what the Ollama and Grok providers already did. With no base_url configured the client keeps the standard OpenAI endpoint.

Reported by @stevemju, who also proposed this fix.

TDD, RED→GREEN verified. 6 new tests. With the fix reverted, the two base_url tests fail with exactly the reported symptom (https://gateway.internal/v1 → https://api.openai.com/v1); with it, they pass.

refactor(cli)! — remove the deprecated Gemini CLI runtime (#231)

Google deprecated the Gemini CLI, so rather than extend --with-mcp to it, the runtime is removed: runtime/gemini_converter.py deleted, plus GEMINI_TOOLS, RuntimeType.GEMINI, and the gemini entries in RUNTIME_CHOICES / INSTALL_DIRS / CONVERTERS. --agent gemini is now rejected as an invalid choice, which lists the four supported runtimes.

Gemini remains fully supported as an LLM provider. This touches only the deprecated CLI as an install target; summarization.provider: gemini and GEMINI_API_KEY are untouched. The two concerns were carefully separated.

Test coverage updated across 5 files; the "unsupported runtime" MCP test was repointed from gemini to skill-runtime (the remaining runtime without an MCP registrar).

fix(ci) — Keycloak E2E: test user not fully set up (#218)

scripts/keycloak_bootstrap.sh created testuser with only a username and password. Keycloak >= 24 enables the declarative User Profile with the Verify Profile required action on by default, which leaves such an account carrying VERIFY_PROFILE and makes every Direct Access Grant fail with:

HTTP 400 {"error":"invalid_grant","error_description":"Account is not fully set up"}

That matches the reported failure exactly — all 8 external-IdP tests dying at setup against the token endpoint in ~3.75s, never reaching MCP logic. The user is now created with email, emailVerified, firstName, lastName, and an explicit empty requiredActions.

⚠️ Unverified locally — no container runtime available in this environment. The MCP Keycloak Integration job is the confirming run. Flagged as such in the changelog too.

docs — research-graph plan

Lands docs/plans/research-graph-make-it-real.md in-repo per the project's planning rule (cherry-picked from claude/research-graph-okf-plugins-bl2ye3). Its one Agent Brain-side dependency is now tracked as #235.

Validation

task before-push — all four packages green:

Package	Tests	Lint	Types
server	1414 passed, 28 skipped	✅	✅ 88 files
cli	612 passed, 5 skipped	✅	✅ 46 files
uds	32 passed	✅	✅ 5 files
mcp	1021 passed, 118 deselected	✅	✅ 47 files

YAML frontmatter: 53 files, 0 errors.

Notes for the reviewer

• The reporter's other problem — >= 10.3.0 failing with an mcp dependency conflict — is not reproducible from a clean environment (all package combinations resolve cleanly on Python 3.10, and no path deps leaked into published metadata). Split out to #236 pending reporter details.
• agent-brain-mcp's install task temporarily rewrites pyproject.toml to path dependencies and restores it only as its last statement. When it was interrupted by disk exhaustion during this work, it left publish-breaking path deps in the tree. Filed as #238, which also covers the lock guard not extending to the mcp/uds locks.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JtAMdptgnEFedoXJU9kqKQ