Three fixes from this review round, plus a CI shard registration and a comment-density pass.
A caller admitted through JWT or a custom auth path has no DB-backed key hash
(UserAPIKeyAuth.api_key is None or some other non-sk- value), which crashed the capability
token mint instead of leaving the tool_use untouched. _mint_caller_capability_token now
returns None for that case, and _endpoints_for_request treats it the same as an unreachable
base URL.
A resolved master-key caller carried the real master key as its own api_key, which
_worker_text later placed in the outbound request's metadata["user_api_key"] -- reachable by
any raw-metadata logging callback. Now substitutes LITELLM_PROXY_MASTER_KEY_ALIAS there,
matching what normal master-key auth already does for exactly this reason.
The worker call went straight to llm_router.acompletion, skipping every registered rate-limit
and budget callback (they run as async_pre_call_hook, which only proxy_logging_obj.pre_call_hook
walks). A caller already over budget or rate-limited could keep spending through this endpoint
indefinitely. _worker_text now calls pre_call_hook first and lets a block propagate.
Registers tests/test_litellm/proxy/shunt_endpoints in test-unit.yml's proxy-endpoints shard;
CI's shard-coverage assertion failed without it since the directory held tests but named no
owning shard.
Trims several docstrings/module comments in the shunt modules down to the non-obvious "why"
they were justified by, cutting repetition and one stale field name a rename had left behind.
b4b4f58a76