* Exclude litellm 1.99.0 from allowed versions
litellm 1.99.0 (released 2026-09-01T00:42:41Z) now forwards the
prompt_cache_key argument to the OpenAI provider. The provider cache
contract test asserts the key is not passed through without verified
capture, so CI backend-tests (3/3) and the downstream backend-gate
went red on every branch right after the release, unrelated to any
code change.
Local capture server reproduction: with 1.98.0 the captured request
body carries no prompt_cache_key; with 1.99.0 it carries
prompt_cache_key=cache-key. This one-line exclusion follows the
existing quarantine pattern for 1.82.7 / 1.82.8 and keeps the tested
behaviour until the contract is adapted deliberately.
* Bound litellm below the 1.99.0 behavioral change
Pin the dependency window to a verified upper bound (latest 1.98.x)
instead of quarantining only 1.99.0, and sync every doc that hardcodes
the litellm constraint string so docs cannot drift from requirements.txt
again.
* Sync .env.example runtime constraint comment to the litellm upper bound
* fix: redact short credentials in CLI diagnostics
* fix(review-feedback-2111): Redact indented values under empty sensitive YAML fields and preserve
* fix: close structured diagnostic redaction gaps
* fix(review-feedback-2111): Treat comment-only YAML values as empty blocks and Redact indentless
* fix: redact YAML node property blocks
* fix: redact normalized proxy authorization fields
* fix: close multiline diagnostic redaction gaps
* fix: redact spaced credential labels
* fix(review-feedback-2111): Consume YAML blocks with node properties
* fix: include registered spaced credential labels
* fix: close remaining structured redaction gaps
* fix: redact shell words and explicit YAML mappings
* fix: redact single-quoted structured keys
* fix: redact shell append assignments
* fix: redact quoted YAML explicit keys
* fix(review-feedback-2111): add suffix text or drop segments from the env name, such as DeepSeek
* fix(review-feedback-2111): trimming the new docs/CHANGELOG
* fix(review-feedback-2111): update the PR description's verification counts/ranges to match the
* fix(review-feedback-2111): 评审结论 - 代码检查 ：当前整个 PR 仍有 1 个未关闭的高置信度代码 blocker。最新复核摘要：基于
* fix(review-feedback-2111): 补上 helper 级和 non-zero-exit preview 级回归用例，避免文档与运行时行为再次漂移
* fix(review-feedback-2111): add focused helper-level and non-zero-exit preview regressions for
* fix(review-feedback-2111): 评审结论 - 代码检查 ：当前整个 PR 仍有 1 个未关闭的高置信度代码 blocker。最新复核摘要：On the current
* fix(review-feedback-2111): update the PR description's reported current head from 27a013fbf to
* fix: redact sensitive env names embedded inside command substitutions across multi-segment diagnostics
- 覆盖 OPENAI_API_KEY=sk-12345 这种首段为非敏感赋值、值里又嵌敏感名的情况
- 当 $(...) 的前置赋值是敏感名时跳过尾扫避免双重改写，非敏感名仍需进入尾扫
- 新增测试覆盖多段 + 同函数敏感+非敏感赋值的复合诊断文本
- 使用 [A-Z][A-Z0-9_]* token 扫描找到 ALL 中的敏感 env 名引用
* fix(review-2111): redact export SENSITIVE=$(...) without dropping trailing fields
Round-3 review blocker closure for PR #2118 (issue #1784):
OR-COR-7c0a5d41 — the form
export SENSITIVE_ENV=$(printenv OTHER_SECRET) session_id=dup1 token_budget=1000
previously lost ``session_id=dup1`` (case 1) and ALL trailing fields
(case 2 with ``echo OPENAI_API_KEY=sk-12345``) because the second-pass
``$(...)`` scan re-added the same span that the first pass had already
replaced, and ``_replace_spans`` silently dropped the duplicated
region's width worth of trailing characters.
Two fixes:
1. Track first-pass sensitive-assignment replacement spans
(``first_pass_spans``) and skip any ``$(...)`` whose start lies
inside one of those spans. This is the principled guard against
the overlap regardless of where the leading assignment sits.
Previously the second-pass computed a "prior prefix" via three
independent regex branches (semicolon-separated / newline-
separated / head-of-string), each of which only matched bare
``NAME=`` — so ``export NAME=`` slipped through and the second
pass double-rewrote the same span.
2. Add ``(?:export[ \t]+)?`` to all three prior-prefix regexes so
that even if the first-pass span guard were ever evaded, the
leading ``export SENSITIVE=`` would still be recognised and the
second pass would skip the inner ``$(...)``.
Regression tests cover the two exact reproductions from the review
(``session_id=dup1 token_budget=1000`` and ``session_id=dup3``), plus
a non-``export`` control case to lock in the existing behaviour. Full
``tests/test_local_cli_backend.py`` passes 363/363; the ``tests/test_stock_*``
subset is unaffected (460 passed across the CLI + stock subset).
---------
Co-authored-by: zhulinsen <zhuls97@163.com>
Co-authored-by: xxiaoxiong <xxiaoxiong@nicholasxiong.cn>
* feat(issue-1172): dsa-后续开发规划：配置、通知告警、复盘红绿灯、bot-交互与-agent-增
* fix: address review feedback for MiniMax preset and agent timeout test
- Update MiniMax preset to official OpenAI-compatible base URL (api.minimaxi.com/v1)
and current model examples (MiniMax-M2.7), with official source links in
.env.example and docs/llm-providers.md.
- Add provenance + LiteLLM compatibility notes and rollback guidance in
docs/llm-providers.md.
- Fix flaky test_llm_call_receives_remaining_timeout_budget by patching
src.agent.runner.time.time so the remaining timeout budget is deterministic.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(review-feedback-1175): address latest review comments
* Update LLM provider defaults
* Fix agent model fallback test
* docs: add Ollama local model configuration guide (Fixes#690)
- Add Example 4 and channel mode example in LLM_CONFIG_GUIDE
- Add OLLAMA_API_BASE to .env.example and full-guide
- Add Ollama entry to litellm_config.example.yaml
- Add Q12b to FAQ (CN/EN)
- Add troubleshooting row for Ollama 404 / api/generate/api/show
- Update CHANGELOG
Made-with: Cursor
* docs: sync README with Ollama config per AGENTS.md (address review)
- Add Ollama to AI models list in README.md
- Add OLLAMA_API_BASE to Secrets table with link to config guide
- Add pitfall note: do not use OPENAI_BASE_URL for Ollama
- Sync docs/README_EN.md with same changes
- Update CHANGELOG to mention README sync
Made-with: Cursor
* docs: add OLLAMA_API_BASE to full-guide env table and note (address review)
* docs: remove duplicate OLLAMA_API_BASE entries in full-guide (address review)
* fix#692: decouple agent and analysis primary model selection
* fix#692: preserve yaml alias for agent primary model
* docs #692: sync agent primary model in EN/CHT readmes
* ci(workflow): support litellm_config.yaml in GitHub Actions
- add LITELLM_CONFIG, LITELLM_API_KEY, LITELLM_MODEL environment variables
- add LiteLLM configuration check in workflow diagnostics
- add siliconflow provider example in litellm_config.example.yaml
* feat(ci): support litellm_config.yaml in GitHub Actions
- add LITELLM_CONFIG, LITELLM_API_KEY, LITELLM_MODEL env vars to workflow
- enhance LiteLLM configuration status check in workflow diagnostics
- improve LITELLM_MODEL variable spacing for readability
- update CHANGELOG.md to document new GitHub Actions configuration support
* feat(ci): enable litellm_config.yaml injection from GitHub Actions Secrets
- add LITELLM_CONFIG_YAML environment variable support in workflow
- implement automatic config file creation from Secrets/Variables content
- update docs/LLM_CONFIG_GUIDE.md with GitHub Actions YAML configuration guide
- update README.md to mention YAML advanced configuration for GitHub Actions
- add explanatory comments to litellm_config.example.yaml
* docs: fix numbering and update model field requirements
- correct step numbers from 3 to 2 in configuration instructions
- move LITELLM_MODEL to required section and reorder in table
- update LITELLM_MODEL from optional to required field
* docs(changelog): clarify LiteLLM config injection methods
- add LITELLM_CONFIG_YAML variable description
- explain both file commit and secret injection methods
- provide more detailed configuration options
