BYOK for cli

[jdchawla29]

Note

Adds a remote-only --byok option that propagates to rollout requests, hides local creds on remote, auto-injects HUD_API_KEY for gateway calls, and guards against passing provider api_key to the HUD Gateway.

• CLI/Eval (hud/cli/eval.py):
  • Add --byok flag and [eval].byok config; validate as remote-only; show in settings table.
  • Strip api_key/model_client when submitting remote jobs; pass use_byok to submissions.
  • Auto-inject HUD_API_KEY for OPENAI_COMPATIBLE when base_url is the HUD Gateway.
• Datasets (hud/datasets/utils.py):
  • Extend SingleTaskRequest with use_byok; plumb use_byok through submit_rollouts and batch payloads.
• Agents (hud/agents/openai_chat.py):
  • Enforce gateway auth: reject api_key when base_url targets HUD Gateway and differs from HUD_API_KEY; direct users to HUD_API_KEY/BYOK.

^{Written by Cursor Bugbot for commit c6963de. This will update automatically on new commits. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".