The route test only resolved route names. It now sends every method through
the proxy with a virtual key and asserts the upstream receives that method,
the proxy's TypeSafe key and the caller's body
Non-admin keys may only start transcription jobs whose media and transcript output live in the S3 buckets listed in general_settings.transcribe_media_buckets, and may not supply DataAccessRoleArn or JobExecutionSettings. The setting is editable from the Admin UI general settings table (new List editor) and DB values load into the running proxy when config.yaml does not set it
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The OIDC branch of the agent token mint handed a missing tenant_id or
client_id to the shared helper, which fills them from the host's
AZURE_TENANT_ID and AZURE_CLIENT_ID, so an agent carrying only an
oidc/ token could be authenticated with the host's identity. The
branch now needs both ids on the agent and otherwise fails with the
credential help, which names the requirement
#41607 registered the typesafe pass-through with a route that only accepted
GET and POST, so a PUT, DELETE or PATCH to /typesafe/... came back 405
before reaching the upstream. CircleCI's pass-through method test caught it,
but that lane does not run on the PR gate, so the mapped unit test now
covers the same invariant for typesafe
The same CircleCI run also failed test_models_by_provider because typesafe
is not a key of models_by_provider. Registering it there would satisfy the
assertion without changing behaviour: typesafe has no LlmProviders member,
so a typesafe/* deployment never loads and get_valid_models returns nothing,
and its spend is priced straight from model_cost. The test already skips
search-mode providers for that reason, so it now skips evaluation mode too
Adds an admin-only DELETE /v1/mcp/sessions that terminates stateful MCP gateway sessions on the current worker by session id prefix and/or by the LiteLLM user that opened them, tombstones the terminated ids so a client reusing one gets 404 instead of a silently recreated stateless session, and lets PROXY_ADMIN name a user_id on the BYOK and OAuth credential delete routes. Full and view-only admins can list every user's stored credential metadata for a server (never the secret). The dashboard gains Disconnect controls on the Live Connections tab and a User Credentials tab with Revoke controls, both hidden from read-only admins.
Resolves LIT-8001
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Bridge OpenAI Realtime transcription sessions on vertex_ai/chirp_* models to
Google Speech-to-Text v2 StreamingRecognize over gRPC, so partial and final
transcripts stream back while audio is still being sent. Interim results become
delta events, finals become completed events carrying billed seconds, the gRPC
stream rotates at 240 s under Google's five-minute cap with billed time chained
across rotations, and audio is split into 25 KB requests.
The OpenAI transcription protocol helpers move into a shared module that Meta
Muse now uses too, google-cloud-speech ships behind a new stt-vertex-chirp extra
bundled into the proxy runtime, and the cost map lists /v1/realtime for chirp_3.
Turning Cache Control off on the model edit screen omitted the field from the
PATCH body, which the backend reads as leave unchanged, so the stored
cache_control_injection_points list survived the save. The dashboard now sends
an explicit null when a stored list is being disabled, and update_db_model
clears that field on null the same way it already clears the mirrored pricing
fields. Omitted keys keep the stored value
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
A permanent database fault (a missing or version-skewed query engine)
in the subject_token check was answered with the same "retry" wording
as a transient outage. The status stays 503 temporarily_unavailable,
the only OAuth error a client reads as the server's fault and what the
mint path already answers to the same fault, but the description now
says retrying will not help until the deployment is repaired, using
PrismaDBExceptionHandler.is_permanent_database_fault the way the mint
path does.
Restrict signed media fetches to https URLs, treat a job AWS no longer knows as
priceable from the media named in its StartTranscriptionJob response instead of
polling to the eight hour maximum, and read the media length with libsndfile
headers instead of decoding the whole file into memory
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
