PR #71995: feat(extension): add new portkey extension

• Repository: openclaw/openclaw
• Author: Priyank295
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/71995

Description (problem / solution / changelog)

Summary

• Problem: OpenClaw has no Portkey provider extension — users cannot route LLM requests through Portkey's AI gateway.
• Why it matters: Portkey provides a unified gateway to 250+ LLM providers with observability, caching, fallbacks, and load balancing — a popular alternative to LiteLLM.
• What changed: Added a new extensions/portkey/ bundled provider plugin with chat completions and image generation support, following the same pattern as the existing litellm extension. Added GitHub labeler entry for extensions: portkey.
• What did NOT change (scope boundary): No core code modified. No changes to the plugin SDK, gateway, or any other extension. No docs page added (can follow separately).

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #72008
• This PR fixes a bug or regression

Root Cause (if applicable)

N/A — new feature.

Regression Test Plan (if applicable)

N/A — new feature. Tests added:

• extensions/portkey/onboard.test.ts — verifies config merge preserves existing baseUrl/api key
• extensions/portkey/image-generation-provider.test.ts — 8 tests covering provider registration, auth header format (x-portkey-api-key), base URL, count/size forwarding, edit endpoint routing, missing key error, dispatcher policy
• extensions/portkey/portkey.live.test.ts — live API test (requires PORTKEY_API_KEY)

User-visible / Behavior Changes

• New provider portkey available in provider selection and onboarding wizard
• New CLI flag --portkey-api-key for authentication
• New env var PORTKEY_API_KEY for authentication
• New image generation provider portkey registered

Diagram (if applicable)

N/A

Security Impact (required)

• New permissions/capabilities? Yes — new provider plugin with API key auth
• Secrets/tokens handling changed? No — uses existing plugin SDK auth patterns
• New/changed network calls? Yes — calls https://api.portkey.ai/v1 for chat completions and image generation
• Command/tool execution surface changed? No
• Data access scope changed? No
• If any Yes, explain risk + mitigation: API key sent via x-portkey-api-key header (Portkey's standard auth). Key storage follows the same credential patterns as all other providers. No private-network auto-allow — Portkey is a public cloud endpoint.

Repro + Verification

Environment

• OS: macOS (Darwin 25.2.0)
• Runtime/container: Node 22+
• Model/provider: Portkey gateway → Claude Opus 4.6
• Integration/channel: N/A
• Relevant config: PORTKEY_API_KEY env var

Steps

1. pnpm install
2. pnpm test extensions/portkey — run unit tests (9 tests)
3. PORTKEY_API_KEY=<key> pnpm test:live -- extensions/portkey/portkey.live.test.ts — run live test

Expected

• All 9 unit tests pass
• Live test completes a chat request through Portkey and receives a valid response

Actual

• 9/9 unit tests pass
• 2/2 live tests pass (chat completion returned "OK" in ~4s)

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Unit tests: Test Files 2 passed (2) | Tests 9 passed (9) Live tests: Test Files 1 passed (1) | Tests 2 passed (2) | Duration 7.26s

Human Verification (required)

• Verified scenarios: unit tests pass, live API call through Portkey succeeds, pnpm install registers the workspace package
• Edge cases checked: missing API key throws clear error, custom baseUrl overrides work, dispatcher policy forwarding
• What you did not verify: image generation live API call (only registration tested), docs page

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? Yes — purely additive, no existing code changed
• Config/env changes? Yes — new PORTKEY_API_KEY env var (optional, only used if provider is selected)
• Migration needed? No

Risks and Mitigations

• Risk: Portkey API changes auth header format or base URL in the future.
  • Mitigation: allowExplicitBaseUrl: true lets users override. Auth follows standard plugin SDK patterns that are easy to update.

Changed files

• .github/labeler.yml (modified, +5/-0)
• extensions/portkey/api.ts (added, +8/-0)
• extensions/portkey/image-generation-provider.test.ts (added, +231/-0)
• extensions/portkey/image-generation-provider.ts (added, +178/-0)
• extensions/portkey/index.ts (added, +45/-0)
• extensions/portkey/onboard.test.ts (added, +21/-0)
• extensions/portkey/onboard.ts (added, +55/-0)
• extensions/portkey/openclaw.plugin.json (added, +32/-0)
• extensions/portkey/package.json (added, +15/-0)
• extensions/portkey/portkey.live.test.ts (added, +56/-0)
• extensions/portkey/provider-catalog.ts (added, +10/-0)
• extensions/portkey/tsconfig.json (added, +16/-0)
• pnpm-lock.yaml (modified, +6/-0)