Commit graph

14483 commits

Author SHA1 Message Date
mateo-berri
91595780ec fix(gigachat): fold cached tokens back into prompt and total token counts
GigaChat reports prompt_tokens and total_tokens after subtracting cached
tokens (the docs example is prompt_tokens=1, precached_prompt_tokens=37,
total_tokens=5, so the fields are disjoint, not a subset). Map to the
OpenAI convention by adding precached_prompt_tokens back onto prompt and
total while still surfacing it as prompt_tokens_details.cached_tokens.
2026-08-31 15:16:44 -07:00
Mateo Wang
0c127caedb
Merge pull request #38940 from samtsai15/fix/anthropic-guardrail-image-sources
fix(guardrails): carry Anthropic url image sources through to guardrails
2026-08-31 15:16:04 -07:00
Yuneng Jiang
e7b7a2276f
test(e2e): cover SCIM token creation and SCIM API auth in the Admin UI suite 2026-08-31 15:11:50 -07:00
Mateo Wang
336269cfec
Merge pull request #38597 from BerriAI/litellm_fix_nova_sonic_realtime_user_asr_usage
fix(bedrock): surface Nova Sonic user transcripts, speech events, and usage in realtime API
2026-08-31 15:11:31 -07:00
mateo-berri
abbccd3fd6 Merge branch 'litellm_internal_staging' of https://github.com/BerriAI/litellm into friendli/glm-5.3
# Conflicts:
#	litellm/model_prices_and_context_window_backup.json
#	model_prices_and_context_window.json
2026-08-31 15:11:06 -07:00
Mateo Wang
b3a1dd1115
Merge pull request #38880 from Lee-Si-Yoon/friendli/glm-5.3-flash-v2
feat(friendli): add zai-org/GLM-5.3-Flash model pricing
2026-08-31 15:07:06 -07:00
Yuneng Jiang
a17339f19c
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_/jovial-archimedes-1d743b 2026-08-31 15:05:59 -07:00
Yuneng Jiang
fdc259077e
test(e2e/ui): automate 8 manual QA checklist flows
Adds Playwright coverage for the RC checklist items an audit marked
automatable today: Playground to Logs hand-off, public Agent/MCP hub
tabs, team models in the Playground dropdown via a team key, Add Model
with a stored credential, internal user team key creation, a second
admin account, team model deletion, and Presidio guardrail CRUD without
a live sidecar. Seeds e2e-team-keygen with the /key/generate member
permission so the internal user key flow avoids the team-list cache lag
2026-08-31 15:05:54 -07:00
mateo-berri
4d19a889fb Merge branch 'litellm_internal_staging' of https://github.com/BerriAI/litellm into litellm_decrease_anys_opus5_r2
# Conflicts:
#	basedpyright-code-budget.json
2026-08-31 15:05:34 -07:00
mateo-berri
613d0ef3fa test(gcs_pub_sub): expect router_metadata in the spend logs payload
The base added router_metadata to SpendLogsMetadata in #39001 without
updating this fixture, and its CI run never executed logging_testing,
so the job now fails on every branch merged with current staging.
2026-08-31 15:04:31 -07:00
Devin AI
cc078edd1f test(mcp): isolate global MCP server registry in discoverable endpoints tests
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-31 21:56:57 +00:00
Yuneng Jiang
cc258b5473
test(e2e): keep the placement guarantees the geometry rewrites dropped
The consolidated popup test only asserted the options never cover the
trigger, so opening above the trigger with room below it, the regression
PR #38554 fixed, would have passed. Split it back into a below-trigger
case and a cramped-viewport case. The header test accepted a single pixel
of vertical intersection; require the refresh control's centre to sit
within the tab row instead.
2026-08-31 14:54:11 -07:00
Yuneng Jiang
78e1c658b4
fix(e2e): assert sidebar expansion without a self-resolving locator
The migration smoke waited on `getByRole("button", { expanded: false })`
after clicking it. Playwright re-resolves that locator on every retry, so
once the clicked group flipped to expanded it matched the next collapsed
group instead, and the assertion could never pass. Count the remaining
collapsed groups and wait for that count to drop by one.
2026-08-31 14:45:11 -07:00
Devin AI
6809d537f0 merge: litellm_internal_staging into litellm_fix_nova_sonic_realtime_user_asr_usage
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-31 21:42:06 +00:00
Yuneng Jiang
6abb85155a
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_/flaky-e2e-tests-d022f6 2026-08-31 14:42:01 -07:00
Mateo Wang
b518be45fb
Merge pull request #38997 from BerriAI/litellm_add_responses_input_tokens_endpoint
feat(proxy): add /v1/responses/input_tokens token counting endpoint
2026-08-31 14:30:44 -07:00
mateo-berri
98b1e2e7b4 fix(gigachat): correct cached-token accounting, stream usage on all finish reasons, stop mutating cached request body
precached_prompt_tokens is a subset of prompt_tokens (OpenAI cached_tokens
semantics), so map it to prompt_tokens_details.cached_tokens instead of
adding it on top of prompt/total. Emit stream usage from any final chunk
carrying it rather than only finish_reason stop, which dropped tokens for
function_call and length streams. Merge auth metadata into a new dict in
the gigachat router handler instead of mutating the shared parsed-body
cache in place.
2026-08-31 14:28:30 -07:00
Yuneng Jiang
b8a56b6c6c
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_/flaky-e2e-tests-d022f6 2026-08-31 14:04:21 -07:00
Yuneng Jiang
9c577c6045
test(e2e): assert user-observable behavior instead of DOM structure
The UI e2e suite had a class of assertions that pin how the dashboard is
built rather than what it does, so an ordinary refactor turns them red
without any user-visible change.

Geometry. The auto-router template select had two tests made of pixel
arithmetic plus a data-side="bottom" check, which is Base UI's own
positioner signal. The regression they guard (#38554) is a popup opening
on top of the control that spawned it, so both cases collapse to one
invariant: the options never cover the trigger. It now runs at both
viewport heights and reads the popup as role=listbox. The models header
test compared the tabs and refresh centers within 2px, which a padding
change flips; it now asserts the two share a row.

Structure. The logs drawer test walked xpath=../../.. from a text node
and read collapsed state off chevron icon classes. SectionHeader now
renders a real disclosure button with aria-expanded, and its two copy
buttons carry distinct names instead of both being "Copy". Sidebar group
toggles expose aria-expanded too, so the migration spec can ask for a
collapsed group by state rather than by nesting depth.

Positional lookups. keyRow.locator("button").first(), row.locator("td")
.first() and getByTestId(grid).locator("div").first() all named a
position where they meant an action; they now name the control. Table
scoping moves from "table tbody" to role=row.

Timing. Nine waitForTimeout calls are gone. Every assertion that followed
them already retried to its own timeout, so the sleeps only slowed the
run down.

Both files under tests/users/ were wrapped in test.skip("...", () => {}),
which registers one skipped test and never runs the body, so the four
tests inside had never executed and were written against a UI that has
since changed (the search placeholder is "Search by email…", the ID
filters moved into a drawer, pagination is labelled "Go to previous
page"). Rewritten against the current surface: the suite goes from 104
collected tests to 107.

Left in place deliberately: the chip and dialog-footer data-slot
selectors, because the accessible names they work around live in
components/ui/, which is shadcn CLI-managed and not hand-edited.
2026-08-31 14:04:15 -07:00
devin-ai-integration[bot]
40edeaaecb
fix(otel): emit cache token counts on OTel v2 LLM spans (#38716)
* fix(otel): emit cache token counts on OTel v2 LLM spans

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(otel): trim comment in LLMUsage adapter

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(otel): drop casts in LLMUsage cache token adapter

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(deps): bump restrictedpython to 8.3 for GHSA-ffg3-p8fm-mjx2

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-31 13:59:59 -07:00
mateo-berri
b7da471784 fix(count_tokens): price an inline file block instead of raising on it
`ChatCompletionFileObject` is in the union `_count_content_list` accepts, but
`file` was missing from its match, so every local count of a Responses
`input_file` raised `Invalid content item type: file`. On
/v1/responses/input_tokens that surfaced as an opaque 500 whenever the model's
provider counting API refused the block and the local tokenizer took over.

Count it the way the module already counts the same thing in Anthropic's
dialect: the filename like a document title, the inline bytes through the
image pricer.
2026-08-31 13:53:22 -07:00
Mateo Wang
be3386f3ce
Merge pull request #38995 from BerriAI/litellm_openai_wif
feat(openai): support workload identity federation (OIDC token exchange)
2026-08-31 13:37:30 -07:00
mateo-berri
ec02c9a6d2 fix(router): bare authenticating-provider names declare nothing 2026-08-31 13:34:14 -07:00
mateo-berri
bd794f9f18 fix(friendli): track GLM-5.3 discounted live pricing and declare effort levels 2026-08-31 13:26:37 -07:00
mateo-berri
a90fb538bf fix(friendli): declare GLM-5.3-Flash reasoning efforts as explicit levels 2026-08-31 13:25:51 -07:00
Mateo Wang
66295e7da7
Merge pull request #34696 from cat0825/fix/34379-unblock-customer
fix(proxy): allow unblocking customers via /customer/update
2026-08-31 13:21:00 -07:00
mateo-berri
c9908ffabb fix(responses): count input_file tokens instead of silently dropping the file
The Responses-to-chat transform dropped the filename OpenAI requires next to
file_data, so a request carrying an inline PDF counted 13 tokens instead of 36
and a real completion through the chat bridge got a 400.
2026-08-31 13:17:43 -07:00
mateo-berri
c02c81452c fix(proxy): reassemble split SSE frames before restamping anthropic message_start 2026-08-31 13:16:48 -07:00
mateo-berri
59732f068b Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_gigachat_passthrough_25886 2026-08-31 13:16:41 -07:00
mateo-berri
ed5ee51dd2 fix(passthrough): map sync streaming errors, keep router streaming responses unwrapped, and resolve gigachat from api base
- sync llm_passthrough_route: read and close an error-status streaming
  response before mapping it, so upstream 4xx/5xx surface as the provider
  error instead of httpx.ResponseNotRead
- AsyncPassthroughStreamingResponse: expose aiter_bytes() and carry
  _hidden_params so the router attaches headers in place instead of
  wrapping the stream in HiddenParamsAsyncIteratorWrapper, which 500'd
  every streaming azure router-model passthrough request
- logging: swap the passthrough httpx result for the transformed
  ModelResponse/EmbeddingResponse when firing success callbacks
- get_llm_provider: resolve gigachat from its api base and drop the dead
  gigachat_models elif branch
- constants: register the gigachat api base in openai_compatible_endpoints
2026-08-31 13:16:40 -07:00
mateo-berri
97e2aa9e7f Merge origin/litellm_internal_staging into litellm_anthropic_stream_model_alias
Adapts streaming_model_restamp.py to the LIT001/LIT010 gates that landed
on staging since this branch was cut (Final annotations, Mapping in
annotations instead of dict).
2026-08-31 13:09:37 -07:00
mateo-berri
fe90c6f6fc fix(count_tokens): keep assistant turns on the provider counting API
Assistant list content was forwarded to /v1/responses/input_tokens as chat
`text` blocks, which the Responses API rejects (it accepts only output_text
and refusal inside an assistant turn). The 400 sent the whole request to the
local tokenizer, so any conversation with an assistant turn silently lost
provider-exact counting, including the image counting added in 73ab647b1c.

Assistant content now collapses to the plain string the Responses API counts
identically, and image parts are kept to user turns where they are legal.
2026-08-31 12:59:40 -07:00
devin-ai-integration[bot]
1249f84b10
fix(vertex_ai): graft default vertex path when api_base has a version-only path (#38986)
* fix(vertex_ai): graft default vertex path when api_base has a version-only path

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(vertex_ai): keep query and fragment placement when grafting vertex path

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(vertex_ai): merge alt=sse into existing query when streaming

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: yassin <yassin@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-31 12:56:34 -07:00
Cursor Agent
ae83444a3e
fix(openai): treat empty api_key as unset for WIF resolution 2026-08-31 19:55:29 +00:00
mateo-berri
e7dc0213bd fix(openai): treat empty api key values as unset for workload identity 2026-08-31 12:52:55 -07:00
Mateo Wang
0c21b30cb7
feat(spend_tracking): persist router metadata in spend logs for internal router models (#39001)
* feat(spend_tracking): persist router metadata in spend logs for internal router models

* test(spend_tracking): expect router_metadata key in exact-payload tests, type the routed-kwargs helper
2026-08-31 12:52:34 -07:00
Ashton Sidhu
9f9236e8d5
fix(guardrails): exclude images from HiddenLayer v1 scans (#29210)
* Don't scan images

* Fix failing tests

* Fix lint: typed image-part filter, restore monkeypatch-based tests

---------

Co-authored-by: Yucheng Zhu <yucheng@berri.ai>
2026-08-31 12:50:42 -07:00
mateo-berri
46e090d2f3 fix(anthropic_messages): bill partial spend when a queued pump error is never consumed
When the upstream errors while the client is still connected, the pump
forwards the exception through the relay queue so the proxy's failure
handling re-raises it. If the client disconnects before consuming that
queued exception, neither the failure hook nor billing ran and the spend
row was lost. The pump now waits for client detach and, if the exception
was never consumed, salvages partial spend like the post-disconnect
error path.

Also rewrites the bedrock disconnect logging test to the detached-pump
contract: billing fires after the upstream drain completes, not
synchronously at aclose().
2026-08-31 12:47:26 -07:00
mateo-berri
73ab647b1c fix(count_tokens): preserve image inputs when counting Responses API tokens
The chat-to-Responses reverse transform kept only text blocks, so an image
input was dropped before the count went to OpenAI. A 256x256 image request
counted 13 tokens instead of 268.
2026-08-31 12:43:17 -07:00
mateo-berri
ef72e7b37d fix(openai): require https for workload identity api_base targets 2026-08-31 12:32:00 -07:00
mateo-berri
6b7159323b fix(proxy): match OpenAI on empty input and skip budget reservation for token counting
/v1/responses/input_tokens returned 200 with a count for an empty
"input" ("" or []), while OpenAI returns a 400 missing_required_parameter.
The route also went through optimistic budget reservation, which is only
released by LLM success/failure callbacks that a token count never
reaches, so every call leaked a reservation until TTL expiry and could
429 real traffic. Both routes plus the /openai alias now join
/utils/token_counter in the reservation exemption set.
2026-08-31 12:25:45 -07:00
mateo-berri
b134dbfe73 test: exempt _resolved_provider in router_code_coverage gate 2026-08-31 12:19:51 -07:00
Mateo Wang
a73e770798
Merge pull request #38993 from BerriAI/litellm_fix_converse_duplicate_guardrailconfig
fix(bedrock): stop duplicating Converse config blocks inside inferenceConfig
2026-08-31 12:19:41 -07:00
mateo-berri
72adeda9ce fix(openai): scope workload identity to the openai provider and env-resolved base/key 2026-08-31 12:15:52 -07:00
mateo-berri
779b3010d4 fix(proxy): never run OAuth device flows when resolving model names
Resolving github_copilot/chatgpt names through get_llm_provider runs the
provider's OAuth device flow synchronously on the event loop. Adopt the
declared provider in PatternMatchRouter.get_pattern, which the auth
layer's zero-cost budget check walks on every request against wildcard
routers, and in /utils/supported_openai_params.
2026-08-31 12:06:35 -07:00
davida-ps
9f67a58198
fix(guardrails): configure Prompt Security file timeout policy (#38083)
* fix(guardrails): fail open on Prompt Security file timeouts

* fix(guardrails): configure Prompt Security timeout policy
2026-08-31 12:05:57 -07:00
mateo-berri
c7c382402a feat(proxy): add /v1/responses/input_tokens token counting endpoint 2026-08-31 12:04:44 -07:00
mateo-berri
ae945f4fa3 feat(openai): support workload identity federation (OIDC token exchange) 2026-08-31 11:54:04 -07:00
mateo-berri
cf1b431d58 fix(bedrock): stop duplicating Converse config blocks inside inferenceConfig 2026-08-31 11:50:45 -07:00
mateo-berri
6b2ada2a78 fix(bedrock): per-response realtime usage deltas, spend-log event filter, single transcript completed 2026-08-31 11:49:09 -07:00