* refactor(ui): migrate auto router and credential forms to react-hook-form and shadcn
Moves four antd Form surfaces onto useZodForm plus the shared FormField and
FieldGroup primitives: the routing group modal, the auto router edit modal, the
add auto router tab, and the reuse credentials modal. Field labels that carried
an antd tooltip= keep it as a hover Tooltip on a help icon, and hardcoded greys
give way to semantic color tokens.
Two Base UI combobox wrappers come out of the two auto router surfaces that
shared the same antd controls: AccessGroupTagsCombobox replaces mode="tags" for
model access groups, and ModelChoiceCombobox replaces the searchable single
select for default and embedding models.
Payload building for the routing group modal moves to routingGroupPayload.ts so
the JSON args parsing and the four bound fields can be asserted directly
instead of through a render.
handle_add_auto_router_submit now takes a resetForm callback rather than an antd
form instance, which drops one any from its signature.
No change to what any of these forms submit. The reuse credentials payload keeps
the same key set, with the stored credential values rendered read-only and
merged back in at submit rather than copied into form state.
* refactor(ui): type the auto router create payload boundary
handleAddAutoRouterSubmit took its values as any, so a change to either side
of the auto router create payload passed static checking. It now takes an
exported AddAutoRouterValues, and add_auto_router_tab annotates the object it
builds with that same type, so the producer and the consumer cannot drift.
Its model_info is built in one shot rather than assigned into after the fact,
which drops the second any and keeps the two conditional keys exactly as they
were.
Adds a routing group case that saves an untouched edit of a group whose stored
arguments are null, which is the shape the proxy returns for an unset field.
* refactor(ui): migrate CloudZero and cost tracking forms to react-hook-form and shadcn
Moves four forms off antd Form onto react-hook-form with the shadcn field
primitives, keeping the request payloads byte identical.
The two CloudZero modals were near duplicates, so the payload builder and the
API key input now live in shared modules next to them. The Update modal keeps
its redaction behaviour: the key field arrives empty with a "leave empty to
keep existing" hint, and an untouched save omits api_key from the request so
the stored secret survives. There is a test that fails if that regresses.
add_provider_form had no Form instance of its own, and its Form.Item wrappers
carried no name, so nothing was registered in the parent store. The parent in
cost_tracking_settings still owns an antd Form element, which stays for now,
and the migrated button keeps type="submit" so the parent's onFinish path
behaves exactly as before.
Each unit got characterization tests written against the antd version first,
then re-run unedited against the migration. Payload parity was also checked
side by side with toStrictEqual across seven scenarios.
* test(ui): guard the CloudZero null connection id against a zod type error
The proxy returns connection_id as null rather than omitting it, and a plain
z.string() rejects null. The seeding coalesces it to "" so an untouched save
reports the friendly required message instead of "expected string, received
null". Dropping that coalesce fails this test.
* refactor(ui): migrate the regenerate key and team member forms to react-hook-form and shadcn
Moves RegenerateKeyModal and EditMembership off antd Form onto react-hook-form
plus the shadcn field kit, and onto semantic color tokens so both are dark-mode
ready. The antd Modal shell and Alert stay as they are.
The submitted payload is unchanged on both. Payload construction is extracted
into regenerateKeyPayload.ts and memberFormValues.ts and unit tested there, and
each component keeps an integration test that was written against the antd
original and proven green before any source changed.
RegenerateKeyModal keeps antd InputNumber's precision=2 rounding of max_budget.
The rounding is string-exact rather than float based, so 1.005 still submits as
1.01 the way antd did. Submission stays on the modal footer button, so Enter
still does nothing.
EditMembership omits noValidate. Its numeric fields are already native number
inputs carrying min and step, so browser constraint validation blocks a bad
submit today and continues to. That is pinned by tests.
* fix(ui): accept null-valued fields the proxy returns for keys and members
The proxy returns null rather than omitting the key for an unset
key_alias, user_email or user_id. antd had no schema and forwarded
whatever came back, but z.string().optional() accepts undefined and
rejects null, so regenerating an alias-less key or editing a member
with no email failed validation and silently never submitted.
Widen those three fields to nullish() and pin each with a test that
seeds null and submits without touching the field. Each test passes
against the pre-migration antd component and failed against the
migration before this commit, and the payloads it asserts are the
ones antd put on the wire.
* refactor(ui): migrate user, policy, and margin forms to shadcn
Move four dashboard forms off antd Form and Tremor onto the shadcn field
kit, with react-hook-form where the form owns its own submit. Submit
payloads are unchanged: edit_user still emits exactly six keys with spend
as a number and max_budget as a string, policy_test_panel still omits
empty context keys, and add_attachment_form still builds the same
attachment body.
add_margin_form had no Form of its own and no bound field names, so its
Form.Item rules were inert; it keeps its parent-owned state props and
only swaps the presentation.
Adds characterization tests for edit_user and policy_test_panel, both
proven green against the antd originals before the migration, plus a case
pinning the provider value add_margin_form reports upward. The existing
add_attachment_form and add_margin_form suites pass unedited.
Extracts TokenSelect for the tag and alias inputs shared across the
policy forms, keeping antd's token separators and blur-commit behavior.
* refactor(ui): seed the user edit form by remount instead of an effect
Key the form on the edited user so react-hook-form seeds from its
defaults on each user, replacing the effect that reset the form and the
exhaustive-deps suppression that came with it. Cancel and submit still
reset, so reopening the same user shows stored values.
* test(ui): pin that the user edit form forwards null fields unchanged
The proxy returns null rather than omitting unset fields, and antd
forwarded whatever it received. The only fixture seeded every field, so
nothing proved the migrated form still emits null instead of an empty
string. Proven against the antd original first, and it fails if
toFormValues coerces.
* fix(ui): stop the policy modal cancelling its own save
The Create Policy and Update Policy buttons are Tremor buttons rendered
inside an antd Form. Tremor does not set a type, so both default to
type="submit" and a click ran two things at once: handleSubmit's own
form.validateFields(), and rc-field-form's onSubmit, which calls
formInstance.submit() and validates a second time.
rc-field-form keeps only the newest validation promise, so the first one
resolved as outOfDate and rejected with an empty errorFields list.
handleSubmit read that as a failure, so it never called createPolicy or
updatePolicy and instead reported "Failed to save policy". Creating and
editing a simple policy from the UI could not succeed.
Marking both footer buttons type="button" leaves the submit path solely
with handleSubmit. The new test file pins the request bodies for create
and update, and fails without this change.
* refactor(ui): migrate user, logging and policy forms to react-hook-form and shadcn
Moves four antd Form units onto react-hook-form plus the shadcn kit and
semantic color tokens, keeping every submit payload byte-identical.
- Settings/AdminSettings/LoggingSettings
- CreateUserButton
- users/_components/user_edit_view
- policies/_components/add_policy_form
* chore(ui): drop the eslint suppressions the migrated forms no longer need
* fix(ui): keep users with null optional fields editable
The proxy returns null rather than omitting user_alias, user_role,
budget_duration and metadata, and the new zod shape only allowed
undefined, so opening any such user and saving failed validation.
* feat(proxy): add /team/daily/activity/aggregated and use it in the Usage UI
The Team Usage tab drained row-paginated pages client side, which painted
newest days first and drew duplicate bars when a day's rows straddled a
page boundary. Serve the whole range in one SQL GROUPING SETS pass instead:
the aggregated query gains optional per-entity rollup levels (entity as the
most-significant GROUPING bit) so breakdown.entities keeps per-team spend,
aliases, and per-key splits. The endpoint shares the paginated route's
scoping via _resolve_team_daily_activity_scope, accepts the timezone the UI
already sends, and the api_key filter now takes a list so non-admin member
scoping works. The dashboard tries the aggregated endpoint first and falls
back to page draining on failure.
* chore: ratchet B008 budget down by the endpoint converted to Annotated Depends
* chore: keep mutable-ok suppressions on their annotation lines after formatting
* fix(proxy): reject malformed or over-wide ranges on team aggregated activity
The aggregated endpoint has no pagination bounding its work, so validate
start_date and end_date as real dates and cap the span at 400 days. The
dashboard's widest presets fit well inside the cap, and an over-cap range
falls back to the paginated flow. Also trim implementation comments that
restated the grouping-set code.
* fix(proxy): parse aggregated range bounds as UTC to satisfy DTZ007
* refactor(proxy): fetch entity rollups with a companion query instead of extending the main one
The entity-as-extra-GROUPING-bit approach made the bitmask layout
mode-dependent: the same constant meant (date) for normal rows and
(date, entity) for entity rows, disambiguated by masking. Split it out:
the shared WHERE builder feeds both the untouched main query and a small
per-entity rollup query keyed by GROUPING(api_key), run concurrently, and
a fold writes breakdown.entities onto the built response.
* refactor(proxy): share the daily-activity error and entity-metadata shapes
The type-discipline ceiling for LIT002 ratcheted down on staging, so the new
aggregated endpoint had to stop hand-rolling collections the codebase already
builds elsewhere. Funnel the `{"error": ...}` detail through one construction
site, turn the range validator into an error-as-value, reuse a single
entity-metadata lookup for both breakdown paths, and widen
get_api_key_metadata to any set so callers stop copying frozensets.
MessageManager and NotificationManager were thin facades over lib/toast since #37207. This
rewrites their ~750 call sites (226 files) to import { toast } from @/lib/toast directly:
success/info/warning/error keep their names, fromBackend becomes fromError, destroy/clear
become dismiss. The one config-object caller (CreateMCPServer's admin-review branch) becomes
an explicit toast.success(message, { description }). Behaviour is unchanged: no production
caller passed a duration, so every toast keeps the same kind, title and default duration.
Tests: the global vitest mock now targets @/lib/toast (toast.test.ts opts back out with
vi.unmock), so the per-file vi.mock boilerplate for the facades is deleted and assertions read
toast.success / toast.fromError. The two facade files, their test and their filename-case
suppressions are removed, along with the commented-out facade calls left in networking.tsx
* feat(complexity_router): plan-mode tier floor for coding-agent clients
Claude Code and Copilot signal plan mode only through client-injected prompt
text, which the ask-extraction path deliberately strips, so the router could
never see it. Detect the sentinels on the raw wire body and route those
requests to at least plan_mode_min_tier.
The floor is raise-only and transient: classifier results above it still win,
it overrides a session-affinity pin only on turns carrying the sentinel
without rewriting the pin, and plan_mode decisions are not pinnable, so the
first turn after plan mode exits routes as if plan mode had never happened.
Classification is skipped when the floor is the top configured tier. On
adaptive routers the floor rides _soft_floor_pick as a hard_floor that
excludes below-floor candidates, closing the adaptive_eligible=all gap where
a request classified at or above the floor could still route below it.
Detection is staleness-aware: only leading system content and the newest-ask
tail count, so sentinels surviving in history after plan mode exits, built-in
or operator-supplied, never fire. Custom tier sets are supported with
severity from the tier_definitions list order, same as keyword_tier_rules.
Off by default; decisions are recorded with the new plan_mode cause and the
matched sentinel in matched_keyword
* fix(complexity_router): gate pin writes and the failure exit on sentinel presence, not the floor binding
A plan-mode turn classified at or above the floor keeps its ordinary cause,
but pinning it would carry a plan-mode-shaped choice past plan mode's exit
(on adaptive routers the hard floor constrained that pick), so no
sentinel-carrying turn writes the session pin. The default_model failure
exit is skipped for sentinel turns for the same reason: default_model's
placeholder tier can equal the floor while default_model itself sits in no
pool the floor can vouch for
Moves CreateTagModal, the tag detail editor and MemoryEditModal off antd Form
onto react-hook-form with the shadcn field kit, and onto semantic colour
tokens so the pages follow the dashboard theme.
Submitted payloads are unchanged and pinned by tests. The collapsible budget
sections keep values typed into them when collapsed and reopened, matching
what antd's store did, rather than reverting to the seeded default.
* refactor(ui): migrate budget and skill forms to react-hook-form and shadcn
Moves three dashboard forms off antd Form onto react-hook-form plus the shared
shadcn field kit, and onto semantic color tokens so they render correctly in dark
mode. The submitted request bodies are unchanged.
Budget create and edit previously relied on antd InputNumber precision={2}, which
rounds the submitted value rather than only the display. That rounding is now an
explicit shared helper so the wire payload stays identical, and the helper carries
unit tests covering key presence, null passthrough, negatives and non-finite input.
Characterization tests for both budget modals were written against the antd
implementation first and pass unchanged against the migrated components, which is
what pins the payload. They are named .integration.test.tsx per the dashboard test
tiers, with the pure rounding logic unit tested separately.
* fix(ui): keep collapsed Optional Settings values so reopening does not lose them
react-hook-form shouldUnregister deletes a field's value when its section
unmounts, so typing a budget, collapsing Optional Settings and reopening it
submitted the seeded default instead of what was typed. antd reported only
mounted fields in onFinish but preserved their values in its store, so the
two behaviours have to be reproduced separately.
Drop shouldUnregister, drive the section from controlled state, and blank the
section's fields at submit while it is closed. Seed the edit form from the
five form fields rather than the whole budget record, which shouldUnregister
had been masking.
The ChatUI playground test helper looked up the model combobox with a
synchronous getByPlaceholderText. That control renders its placeholder
from the model-loading flag, so the text is "Loading models..." until
the mocked fetch resolves, and the element the helper wants does not
exist yet. Under a loaded full-suite run the query could land inside
that window and fail with "Unable to find an element with the
placeholder text of: Select a Model", while the same test passed in
isolation every time.
Switch the helper to findByPlaceholderText so it waits for the control
to come back after loading.
Annotate _prime_oauth_metadata_discovery_for_servers and
_reconcile_oauth_discovery_slots_for_servers with Sequence and snapshot
registry views with tuple() at the call sites. This drops the Iterable
addition to the collections.abc import, restoring that line to its base
spelling so the branch merges cleanly with litellm_internal_staging,
which adds Mapping on the same line
* fix(proxy): strip callback credentials from the auth object stamped into request metadata
* style(proxy): drop the restating half of the stamp-site comment
* test(proxy): pin that the stamped auth copy carries header-derived identity
GET /guardrails/usage/overview and GET /guardrails/usage/detail/{id} 500ed on a
database that has not applied 20260817143646_add_daily_guardrail_usage_units yet
(pip installs on litellm-proxy-extras 0.4.86 with DISABLE_SCHEMA_UPDATE=true).
Both endpoints now return their metrics with empty units and log one warning
until the migration lands.
The daily guardrail metrics and usage-unit upserts are non-idempotent
increments, but the retry loop re-sent every failed row on any exception.
An ambiguous post-send failure such as a read timeout after the write had
already committed therefore stacked a second increment and inflated the
billable unit totals served by the guardrail usage endpoints.
Retry only DB_RETRY_SAFE_ERROR_TYPES (httpx.ConnectError), the same rule
the spend writer and autorouter rollup use for increment upserts, and log
any other failure once as terminal for that row while the rest of the
batch still lands.
Follows up #37225
* refactor(ui): move dashboard toasts from antd message/notification onto sonner
Add lib/toast.ts as the single toast surface (success/info/warning/error/
fromError/dismiss) backed by sonner, with a <Toaster /> in the root layout.
fromError titles a toast from the proxy error type or the HTTP status instead
of matching prose phrases, and shows the extracted proxy message as the
description.
MessageManager and NotificationManager become thin facades over lib/toast so
the ~250 existing call sites keep working; the mutable antd instance setters,
setMessageInstance/setNotificationInstance, and the antd App/message/
notification providers in AntdGlobalProvider are gone. Prunes the eslint
suppression baseline accordingly.
* test(ui): mock the MessageManager seam in the Fallbacks tests and drop toast doc comments
AddFallbacks and FallbackSelectionForm asserted on a mocked antd message spy
that MessageManager no longer calls; they now mock the facade the components
import. Also removes the explanatory comments Greptile flagged in lib/toast.ts
and both facades.
* fix(ui): keep NotificationManager's antd config-object contract on the sonner facade
success/info/warning/error accept the { message, description, duration } object
form again (CreateMCPServer's admin-review notice uses it) and fromBackend keeps
its extra.duration seconds argument, both mapped onto lib/toast. Prunes stale
suppressions picked up by the rebase.
* feat(ui): read the proxy error type and code out of JSON envelopes embedded in string errors
Legacy networking helpers throw new Error(responseText) and callers prefix
that text, so the envelope arrives as a substring. fromError now parses the
first embedded JSON object for type/code and shows the unwrapped message in
its place, so those toasts get a status title (Request Error, Not Found) and
a readable description instead of raw JSON.
* feat(ui): configure the auto router's heuristic scorer from the Admin UI
The complexity router has always read tier_boundaries, token_thresholds and
dimension_weights from its config, and /model/new already persists them, but the
dashboard had no control for any of the three, so tuning the scorer meant editing
config.yaml by hand.
Adds an "Advanced scoring" panel to the classification section, shown whenever the
scorer actually runs: on a heuristic router, and on an LLM classifier that falls back
to the heuristic. An untouched knob is omitted from the payload, so a router keeps
tracking the shipped defaults instead of freezing today's numbers.
The three keys join MANAGED_COMPLEXITY_ROUTER_KEYS, so the edit modal now rebuilds
them from form state rather than carrying the stored copy through. That makes
hydration load-bearing, and it hydrates an absent knob to undefined rather than to
the defaults, so an untouched save cannot pin a router that was tracking them.
The "How Classification Works" card now reads the configured boundaries instead of
hardcoding 0.15 / 0.35 / 0.60, which would otherwise start lying the moment an
operator changed them.
* test(complexity_router): pin the dashboard scorer defaults against config.py
The Admin UI keeps its own copy of the boundary, threshold and weight defaults to
prefill its controls. The copy is display only, since an untouched knob is omitted
from the payload, so drift shows a stale placeholder rather than pinning a router.
Nothing caught that drift before, and a blank or dead control is worse, so the two
copies and the dimension key set are pinned against each other here.
* fix(ui): surface out-of-order scorer thresholds as an error, not a hint
Boundaries that decrease make the tiers between them unreachable, which silently
changes where traffic goes, so amber body text undersold it. Saving stays allowed:
a router configured this way in config.yaml would otherwise become uneditable in
the UI for every unrelated change.
* fix(test): search the default-model picker instead of trusting option order
The pinned model is appended after every model the presets contribute, and that list
has reached 11, so the option fell outside the virtualized dropdown's rendered slice
and the two default-model-pin cases failed on staging. CI only runs them when this
file is touched, which is why they went unnoticed. Searching for the model filters
the list to it, so the cases no longer depend on how long the preset list grows.
* revert(test): drop the dashboard scorer defaults parity test
It parsed TypeScript from Python with a hand-rolled brace matcher and a numeric
literal regex, which is not a mechanism this repo should carry: two review rounds
went into fixing the parser rather than the feature. The UI copy of the defaults is
display only, since an untouched knob is omitted from the payload, so drift shows a
stale placeholder and cannot pin a router.
* fix(ui): clamp the scorer inputs and drive the panel from one group spec
min and max are inert attributes on a text input, so the fields accepted a weight of
999, a boundary of -50, and Infinity, and persisted them into the router config.
Values are now clamped on commit and non-finite input is refused.
The three sections were near copies of each other, so they now render from a single
group spec, which also removes the triplicated warning logic.
Moves the scorer constants and types into heuristic_scoring_knobs, the leaf module.
Reading them back through ComplexityRouterConfig was a cycle, so the top-level
DIMENSION_KEYS.map in the panel ran while the constant was still undefined and every
test importing it failed to collect.
* feat(ui): serve the scorer defaults from the proxy instead of mirroring them
The dashboard kept its own copy of DEFAULT_TIER_BOUNDARIES, DEFAULT_TOKEN_THRESHOLDS
and DEFAULT_DIMENSION_WEIGHTS to prefill the Advanced scoring controls. Two copies of
one fact, and the earlier attempt to police the gap parsed TypeScript from a Python
test, which was worse than the problem.
GET /public/complexity_router/scorer_defaults now returns them, following the
/public/providers/fields pattern: a typed response model, the dashboard fetching it
through a react-query hook next to useProviderFields. The controls and the "How
Classification Works" card both read that, so a recalibration of the defaults can no
longer leave the form stating numbers the router stopped using.
The dimension set now comes from the proxy too, so a dimension added backend-side
renders without a dashboard change, under its raw key until it is given a label.
Hydration keeps a stored dict exactly as stored rather than filling it from a local
copy, since the backend already defaults any key omitted at scoring time.
* fix(types): type the scorer defaults response as Mapping, not dict
LIT001 gates mutable collections in annotations, and the three dict fields tripped it.
Mapping is what the codebase already uses for a read-only map on a response model, and
the endpoint hands the config constants over directly rather than copying them into a
fresh dict, which would have traded the LIT001 hit for a LIT002 one.
* test(ui): stub the scorer defaults request for the auto-router tree
The Advanced scoring panel and the classification card read the shipped defaults over
the network, so every render of that tree in a test paid for a request jsdom cannot
serve. That was enough to push the slowest default-model-pin case past its 30s timeout
on CI, where the suite runs 14 forks in parallel.
One fixture in tests/mocks, pulled in by a single vi.mock line per test file, rather
than the same stub pasted into each of the seven that render the tree.
* fix(ui): tell a failed scorer-defaults load apart from a slow one
The panel read only the query's data, so a permanent failure was indistinguishable
from a request still in flight and it sat on "Loading the shipped defaults..." for
good. It now branches on the query state: pending says loading, an error says so and
offers a retry, and the values the router already overrides stay visible and editable
either way.
Two more places had the same flaw. The classification card silently dropped the tier
ranges it used to always show, and now says they could not be loaded. The weight total
was summed over whatever keys were present, so a failed load made it state a total
built from the overrides alone; a total is only shown when the dimension set is known.
A pass that raises (a missing Slack webhook, say) now waits the daily interval instead of logging the
same exception every 30 seconds, and the Admin UI alerting settings list the new alert type so it can be
toggled like the others
The trailing-slash normalization test used gateway.litellm-sandbox.ai as
its base URL. Swap it for gateway.example.com so the test file does not
reference a real-looking hostname. The test is fully mocked, so the host
value has no effect on what is exercised.
Co-authored-by: yuneng-jiang <yuneng@berri.ai>
A transient DB error during the spend log flush dropped that batch's guardrail
metrics and usage unit rows for good. Retry only the rows that failed, up to 3
times with 1s/2s/4s backoff, mirroring the daily spend writer, and inject the
sleep so tests stay fast. Lowers the lint budgets the refactor freed up
An empty pass no longer holds the daily lock, a False lock claim (held or redis
error) is retried on the next 30 second poll instead of sleeping a day, and a
sent alert is stamped in the shared cache for a day so sibling pods and restarts
stay quiet
The flush and the usage endpoints summed units with a scan per distinct key,
quadratic in rows times keys; group sorted rows instead. Skip payloads without
a request_id like the metrics path, type the flush key as a NamedTuple, and drop
the (guardrail_id, date) index that the primary key already covers
* fix(shadow_eval): copy messages before router call and raise judge output cap
* fix(shadow_eval): lead failure detail with location and pin post-failure continuation
Config-driven pass_through_endpoints pointed at a comprehendmedical.*.amazonaws.com
target were being claimed by the Comprehend Medical logging handler through the
hostname arm, which overrode their operator-set cost_per_request and relabeled
their spend rows. Only the built-in /comprehendmedical routes tag the provider,
so match on that alone.
Also mirror /comprehendmedical into the helm ingress and terraform gateway
prefix lists that hand-copy gateway/routes/allowlist.py
Regenerates the guardrails and policy_engine fragments of the lazy OpenAPI
snapshot for the usage-unit fields, regenerates schema.d.ts from it, and
exports DailyGuardrailUsageUnitsRepository next to its sibling repositories
Per-row guards in the daily metrics and usage unit flush so a single DB error no longer drops the rest of the batch, plus removal of narrating comments flagged in review
Both loading tests mock searchToolQueryCall as a promise that resolves on a
timer, assert the loading affordance, then return with that promise still in
flight. When the worker outlives the file's jsdom environment, the component's
setIsLoading(false) runs against a torn-down window, and React reports
"ReferenceError: window is not defined" as an unhandled rejection. Vitest counts
that as an error, so ui-unit-tests fails the job while reporting every one of
its 7351 tests as passed.
Awaiting the settled state keeps both assertions and leaves nothing pending at
teardown.
