Support optional bearer authentication in benchmark clients

[alenperic]

What this changes

Adds optional bearer authentication to tools/bench_openai.py and tools/bench_concurrent.py through --api-key-env NAME, allowing benchmarks against authenticated OpenAI-compatible endpoints. Authentication is enabled only when the option is supplied, and the credential is read from the selected environment variable.

• Passes authentication through warm-up, measured, concurrent, staggered, solo, and serial-reference requests.
• Rejects missing, empty, or invalid credentials before sending requests.
• Keeps credentials out of request bodies and URLs, redacts literal credentials from reports and response samples, and prevents exception messages from exposing them in CLI errors.
• Uses an unredirected authorization header so redirects do not forward the bearer credential.
• Adds nine regression tests, including local HTTP authentication and redirect checks.

Receipt

• Commit: 0d3ad792fd4bc0774bfa714eadf0d943bdb0f209, based on c7137bb31a7dad924fb541a7068422127b9a94b2.
• Environment: Tests passed locally on macOS and independently on Linux x86_64 with Python 3.12.14. The macOS Python version was not recorded in the supplied test output. Standard-library tests with fictional credentials and local HTTP fixtures; no GPU, MLX, PyTorch, or model checkpoint required.
• Exactness: n/a. Native token generation, draft verification, cache behavior, and model arithmetic are unchanged.
• Decode speed before and after: Not measured. This change adds client-side authentication and report sanitization; no inference performance improvement is claimed.
• Prompt speed before and after: n/a. Server-side prompt processing is unchanged.
• Tests run: python -m unittest discover -s tools/tests -v — 26 passed, 0 failed, 0 errors, 0 skipped, on both tested environments. The authentication regression cases fail against the parent implementation.
• Diff checks: git diff --check and git diff --cached --check passed.
• Lean checker: 1,375 files checked; baseline 527 findings, candidate 527 findings; zero added or removed findings. Both runs exit 1 due to inherited findings.
• Not run, and why: Native host/golden suites, Metal M1–M5 and CUDA model checks, and live model benchmarks were not run because the changes are confined to Python benchmark clients. Local HTTP fixtures exercise authentication without requiring a deployed model.

Checklist

• Lane rounds and serial/draft execution paths are unchanged.
• Drafted/plain, resumed/fresh, and concurrent/solo model exactness checks — not run; native inference is unchanged.
• No precision or reduction-order changes.
• Prompt performance against the last release — not measured; server-side prompt processing is unchanged.
• Tested and untested platforms are identified above.
• Authentication regression cases fail before the change and pass afterward; tests require no optional dependencies.
• Added comments/docstrings are single-line; no measurements or history were added to source.
• Lean checker run; baseline and candidate findings recorded, with zero new findings.
• The four changed files and outgoing commit metadata were reviewed; fixtures use fictional credentials, and author and committer use GitHub noreply.

[ashhart]

Thank you, @alenperic, for adding bearer authentication and output redaction to the benchmark clients.

#890 is included in 1.0.12 as merge b9289d6, at 0d3ad79. The clients read the key from the variable named by --api-key-env, send it to the requested endpoint and refuse to forward it on redirects. They redact the configured key from client output.

The merge retains #862/#863's full digests. Our a83a85d adds matching token_sha256 values to the authentication fixtures.

The client tests pass under Python 3.12 on macOS and Linux. The concurrency checks used the updated clients and compared complete replies by full digest.

Posted by Ash's AI Assistant Synthena