Six new cases — read-when-set, read-when-absent, drops non-strings on
read, PATCH sets, PATCH clears with empty list, and a single-write
test that pfp_url + mcp_servers in one PATCH body produces one DB
update with both keys present.
- delete_sandbox_template now runs deregister_task_definition through
asyncio.to_thread; the synchronous boto3 round-trip used to block the
event loop for ~100-500 ms.
- validate_repo_branch passes the git token via GIT_CONFIG_COUNT /
GIT_CONFIG_KEY_0 / GIT_CONFIG_VALUE_0 (http.extraheader Authorization
header) instead of embedding it in the URL netloc. The token no longer
appears in /proc/<PID>/cmdline or `ps aux`. authed_repo_url is kept as
an identity helper for backward compatibility.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three pfp_url cases on GET (set / absent / metadata-as-json-string)
plus six PATCH cases (set / clear-with-empty-string / rename /
404 / no-op / unknown-field-422).
- Encrypt litellm_api_key with encrypt_value_helper before storing it in
agent.metadata (key: litellm_api_key_encrypted), and decrypt at session
spawn before injecting into the harness env. Plaintext keys no longer
sit in the metadata JSONB column.
- Close the user_id-None bypass on list_sessions and list_agents:
non-admin callers without an associated user_id now get an empty list
instead of every row in the table.
- ensure_security_group now adds an ingress rule for the requested
container_port if the shared SG already exists but lacks one. Without
this, multi-port deployments produced unreachable harnesses on every
template after the first.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- delete_sandbox_template defaulted cluster to "litellm-managed-agents"
while every other call site uses "litellm-agents"; this caused
stop_sessions_for_template + ECS deregister to target a nonexistent
cluster, leaving orphan Fargate tasks on template delete. Use the
shared default.
- create_sandbox_template called validate_repo_branch synchronously,
blocking the asyncio event loop for up to 15s per request. Wrap in
asyncio.to_thread to mirror the agent path.
- create_agent skipped the visibility check, so any authenticated caller
who knew a private template UUID could attach an agent (and spawn
Fargate tasks) against it. Apply _template_visible_to after lookup.
- create_session now also asserts the caller owns the agent before
spawning a Fargate task on it.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Strip Authorization/cookie/api-key headers from raw passthrough so the
caller's LiteLLM key never reaches the untrusted sandbox container.
- Enforce ownership on get_session, delete_session, get_agent, and the
three passthrough endpoints (message, events, raw); non-owners get 404
to avoid ID enumeration. PROXY_ADMIN bypasses the check.
- Filter private templates from list/get unless caller is admin or
creator.
- Pool a module-level httpx client for the passthrough endpoints instead
of opening a new one per request; close on proxy shutdown.
- Document the v1 plain-HTTP-over-public-IP sandbox transport as a
known follow-up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the full v1 managed_agents stack under
`/v1/managed_agents/*`:
- Sandbox templates: `POST/GET/DELETE /v1/managed_agents/sandbox-templates`
Builds a Docker harness, pushes to ECR, registers a Fargate task definition.
- Agents: `POST/GET /v1/managed_agents/agents` with model + prompt + branch
override.
- Sessions: `POST /v1/managed_agents/agents/{id}/session`,
`GET/DELETE /v1/managed_agents/sessions/{id}`. Spawns a Fargate task,
waits for ready, seeds the harness chat session (and optional first
prompt) in one call.
- Passthrough: `POST /v1/managed_agents/sessions/{id}/message`,
SSE `/events`, raw `/raw/{path}` for direct opencode access.
Includes:
* Prisma schema for `LiteLLM_ManagedAgent{SandboxTemplate,,Session}Table`
plus migrations under litellm-proxy-extras.
* Background reconciler that stops orphaned Fargate tasks every 60s,
wired into proxy_server lifespan.
* Sample opencode Dockerfile + entrypoint under
`managed_agents_endpoints/sample_harnesses/opencode/`.
* Unit tests for templates, agents, sessions, lifecycle, bootstrap,
git validation, and dockerfile registry.
Schema-validated end-to-end against a real Postgres instance (round-trip
create→include→update→delete). All 60 unit tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
