fix(agents): read an unset agent secret back as unset

The agent read path redacted every sensitive litellm_params key, even
one set to null or "", so clearing an agent's api_key still read back
as REDACTED_BY_LITELM and looked set. An unset secret now reads back as
it was saved, and a set one is still redacted.

litellm/proxy/agent_endpoints/agent_registry.py

@@ -251,7 +251,7 @@ def _redact_agent_params_tree(value: object, _depth: int) -> object:
     return {
         key: (
             REDACTED_BY_LITELM_STRING
-            if _AGENT_PARAMS_MASKER.is_sensitive_key(key)
+            if nested_value not in (None, "") and _AGENT_PARAMS_MASKER.is_sensitive_key(key)
             else _redact_agent_params_tree(nested_value, _depth + 1)
         )
         for key, nested_value in typed_params.items()

tests/unit/proxy/agent_endpoints/test_agent_registry.py

@@ -578,6 +578,14 @@ def test_redact_sensitive_agent_litellm_params_handles_none_and_json_string():
     assert json.loads(redacted)["model"] == "gpt-4"
 
 
+def test_redact_sensitive_agent_litellm_params_shows_an_unset_secret_as_unset() -> None:
+    redacted: Final = redact_sensitive_agent_litellm_params(
+        {"api_key": None, "aws_secret_access_key": "", "client_secret": SENTINEL_AWS_SECRET_ACCESS_KEY}
+    )
+
+    assert redacted == {"api_key": None, "aws_secret_access_key": "", "client_secret": REDACTED_BY_LITELM_STRING}
+
+
 def test_redact_sensitive_agent_litellm_params_recurses_into_lists_of_dicts():
     """A secret nested inside a list of provider sub-configs (a shape a
     non-sensitively-named key can legitimately hold) must also be redacted,