diff --git a/litellm/proxy/agent_endpoints/agent_registry.py b/litellm/proxy/agent_endpoints/agent_registry.py index 7929f67720d..cf540554d58 100644 --- a/litellm/proxy/agent_endpoints/agent_registry.py +++ b/litellm/proxy/agent_endpoints/agent_registry.py @@ -251,7 +251,7 @@ def _redact_agent_params_tree(value: object, _depth: int) -> object: return { key: ( REDACTED_BY_LITELM_STRING - if _AGENT_PARAMS_MASKER.is_sensitive_key(key) + if nested_value not in (None, "") and _AGENT_PARAMS_MASKER.is_sensitive_key(key) else _redact_agent_params_tree(nested_value, _depth + 1) ) for key, nested_value in typed_params.items() diff --git a/tests/unit/proxy/agent_endpoints/test_agent_registry.py b/tests/unit/proxy/agent_endpoints/test_agent_registry.py index 7663f1d30e6..e8354f10e1e 100644 --- a/tests/unit/proxy/agent_endpoints/test_agent_registry.py +++ b/tests/unit/proxy/agent_endpoints/test_agent_registry.py @@ -578,6 +578,14 @@ def test_redact_sensitive_agent_litellm_params_handles_none_and_json_string(): assert json.loads(redacted)["model"] == "gpt-4" +def test_redact_sensitive_agent_litellm_params_shows_an_unset_secret_as_unset() -> None: + redacted: Final = redact_sensitive_agent_litellm_params( + {"api_key": None, "aws_secret_access_key": "", "client_secret": SENTINEL_AWS_SECRET_ACCESS_KEY} + ) + + assert redacted == {"api_key": None, "aws_secret_access_key": "", "client_secret": REDACTED_BY_LITELM_STRING} + + def test_redact_sensitive_agent_litellm_params_recurses_into_lists_of_dicts(): """A secret nested inside a list of provider sub-configs (a shape a non-sensitively-named key can legitimately hold) must also be redacted,