From d338d3f2d2f6529de70a273b6f0d622708209c9c Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Sun, 20 Sep 2026 09:40:46 +0000
Subject: [PATCH] style(agents): tidy typing and docstring in access group
 ceiling helpers

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/proxy/auth/auth_checks.py                            | 2 +-
 litellm/proxy/utils.py                                       | 2 +-
 .../proxy/agent_endpoints/test_agent_registry.py             | 5 ++++-
 tests/test_litellm/proxy/auth/test_auth_checks.py            | 3 ---
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py
index 5412a9d9f6a..b5e7ef73d36 100644
--- a/litellm/proxy/auth/auth_checks.py
+++ b/litellm/proxy/auth/auth_checks.py
@@ -4332,7 +4332,7 @@ async def _check_agent_access_group_model_access(
     llm_router: Router | None,
     resolve_ceiling: CeilingResolver = resolve_agent_access_group_ceiling,
 ) -> Literal[True]:
-    """Attached groups naming no model deny every model, unlike the empty allowlist ``_can_object_call_model`` allows."""
+    """Attached groups naming no model deny every model; the empty allowlist in ``_can_object_call_model`` allows."""
     if not model or valid_token is None or not valid_token.agent_id:
         return True
     ceiling: Final = await resolve_ceiling(valid_token.agent_id)
diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py
index e736f2fa1c4..a8e7d3232eb 100644
--- a/litellm/proxy/utils.py
+++ b/litellm/proxy/utils.py
@@ -8188,7 +8188,7 @@ async def _get_access_group_models(
 
 async def _agent_access_group_visible_models(
     user_api_key_dict: "UserAPIKeyAuth",
-    llm_router: Optional["Router"],
+    llm_router: "Router | None",
     include_model_access_groups: bool,
     return_wildcard_routes: bool,
     team_id: str | None,
diff --git a/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py b/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py
index d15a3adadbd..b036e0dac4d 100644
--- a/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py
+++ b/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py
@@ -15,6 +15,7 @@ from litellm.proxy.agent_endpoints.agent_registry import (
     _restore_redacted_litellm_params,
     redact_sensitive_agent_litellm_params,
 )
+from litellm.types.agents import PatchAgentRequest
 
 # Obviously-fake stand-ins for a real AWS credential pair (LIT-6736 regression
 # fixtures) -- never a real key shape, and must never appear in any response.
@@ -1052,7 +1053,9 @@ async def test_add_agent_to_db_without_access_group_ids_leaves_column_to_its_def
         ({"access_group_ids": None}, []),
     ],
 )
-async def test_patch_agent_in_db_replaces_access_group_ids_when_provided(patch_body: dict, expected: list[str]):
+async def test_patch_agent_in_db_replaces_access_group_ids_when_provided(
+    patch_body: PatchAgentRequest, expected: list[str]
+):
     registry: Final = AgentRegistry()
     mock_prisma: Final = MagicMock()
     mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py
index d8cd578d265..a1179617718 100644
--- a/tests/test_litellm/proxy/auth/test_auth_checks.py
+++ b/tests/test_litellm/proxy/auth/test_auth_checks.py
@@ -8900,9 +8900,6 @@ def test_request_skips_budget_checks_extends_route_rule_with_zero_cost_models()
     assert request_skips_budget_checks(route="/v1/chat/completions", model=None, llm_router=None) is False
 
 
-# Agent access group model ceiling
-
-
 def _agent_model_ceiling_resolver(
     models: frozenset[str] | None,
 ) -> tuple[CeilingResolver, list[str]]: