This commit is contained in:
shrey 2026-11-04 17:24:40 +00:00 • committed by GitHub
commit 8d68d73ff8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 9 additions and 1 deletions

View file

@ -251,7 +251,7 @@ def _redact_agent_params_tree(value: object, _depth: int) -> object:
return {
key: (
REDACTED_BY_LITELM_STRING
if _AGENT_PARAMS_MASKER.is_sensitive_key(key)
if nested_value not in (None, "") and _AGENT_PARAMS_MASKER.is_sensitive_key(key)
else _redact_agent_params_tree(nested_value, _depth + 1)
)
for key, nested_value in typed_params.items()

View file

@ -578,6 +578,14 @@ def test_redact_sensitive_agent_litellm_params_handles_none_and_json_string():
assert json.loads(redacted)["model"] == "gpt-4"
def test_redact_sensitive_agent_litellm_params_shows_an_unset_secret_as_unset() -> None:
redacted: Final = redact_sensitive_agent_litellm_params(
{"api_key": None, "aws_secret_access_key": "", "client_secret": SENTINEL_AWS_SECRET_ACCESS_KEY}
)
assert redacted == {"api_key": None, "aws_secret_access_key": "", "client_secret": REDACTED_BY_LITELM_STRING}
def test_redact_sensitive_agent_litellm_params_recurses_into_lists_of_dicts():
"""A secret nested inside a list of provider sub-configs (a shape a
non-sensitively-named key can legitimately hold) must also be redacted,