Summary
A per-job NIM API key supplied in the web UI is silently dropped for TXT, SRT, and DOCX jobs — only EPUB forwards it. The factory then falls back to the .env value, and if .env has no NIM key the job errors despite a valid key having been provided.
Where
src/core/adapters/translate_file.py:277-286 (TXT/SRT adapter path: llm_config omits nim_api_key)src/core/adapters/translate_file.py:204-215 (DOCX create_llm_provider call omits nim_api_key)- Fallback:
src/core/llm/factory.py:157-159
Details
translate_file accepts nim_api_key and forwards it for the EPUB path, but the adapter path (TXT/SRT) and the DOCX path don't include it in the config passed to the provider factory. The factory falls back to the .env NIM key; with no .env key the job fails even though the user provided one.
Suggested fix
Thread nim_api_key into the llm_config for the TXT/SRT adapter path and into the DOCX create_llm_provider call, matching the EPUB path. Check whether any other per-job keys share the same gap.
Found during the June 2026 repo audit. Severity: low-medium. Confidence: certain.
Summary
A per-job NIM API key supplied in the web UI is silently dropped for TXT, SRT, and DOCX jobs — only EPUB forwards it. The factory then falls back to the
.envvalue, and if.envhas no NIM key the job errors despite a valid key having been provided.Where
src/core/adapters/translate_file.py:277-286(TXT/SRT adapter path:llm_configomitsnim_api_key)src/core/adapters/translate_file.py:204-215(DOCXcreate_llm_providercall omitsnim_api_key)src/core/llm/factory.py:157-159Details
translate_fileacceptsnim_api_keyand forwards it for the EPUB path, but the adapter path (TXT/SRT) and the DOCX path don't include it in the config passed to the provider factory. The factory falls back to the.envNIM key; with no.envkey the job fails even though the user provided one.Suggested fix
Thread
nim_api_keyinto thellm_configfor the TXT/SRT adapter path and into the DOCXcreate_llm_providercall, matching the EPUB path. Check whether any other per-job keys share the same gap.Found during the June 2026 repo audit. Severity: low-medium. Confidence: certain.