mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-10 03:28:53 +00:00
a71dd731f2
Addresses the review findings on this PR.
The generated commands escaped only double quotes, so a model-supplied path, question, spec,
reference, or target containing $(...) or backticks was command-substituted and ran on the
developer's machine. Every interpolated value now goes through shlex.quote, and the size-check
line reports the path with printf instead of a double-quoted echo. Confirmed against a real
bash: the payload used to create its marker file, and no longer does.
The commands also carried the caller's Authorization header verbatim, which put the key in the
model's response, the conversation history, and the next upstream turn. They now reference
${ANTHROPIC_AUTH_TOKEN:-$ANTHROPIC_API_KEY} and the shell resolves it locally, so the secret
never leaves the client. That also fixes clients authenticating with x-api-key, which were
skipped entirely because only the authorization header was read.
Files were uploaded as paths[] while the endpoint binds them under paths. FastAPI matches the
form name exactly, so every delegated read returned 422 and the feature never actually worked.
The worker endpoints resolved the marker with no tags, so a marker armed only under a tag
returned 400 even though the rewrite had matched it; the tags now ride along in the query
string. They also sent only a team id to the router, so worker spend was not attributed to the
calling key. They now reuse the proxy's own key-metadata builder.
An unset worker model could fall through to an empty string. It now falls back to the SIMPLE
tier, then the default model, and refuses to arm rather than naming no model at all.
A caller that already defines its own bulk_read or code_write got a duplicate definition
injected and its own tool calls rewritten into shunt's curl. Shunt now leaves those requests
alone in all three hooks.
The allow rules only matched commands starting with curl, but the bounded read starts with the
wc -l size check, so the main large-file path still prompted. Added a rule for that shape.
Registers the new routes in the gateway allowlist, which the component-coverage test requires.
|
||
|---|---|---|
| .. | ||
| routes | ||
| Dockerfile | ||
| main.py | ||