@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/scripts/agentide_litellm_hooks_v1.py

@@ -1,5 +1,6 @@
 #---------------------------------------------------------------------------------------------
 # Copyright (c) AgentHippo.ai. All rights reserved.
+# Licensed under the MIT License. See LICENSE.txt in the project root for license information.
 #---------------------------------------------------------------------------------------------
 """
 AgentIDE LiteLLM proxy hooks - Clean structured assistant output with separate input/output
@@ -7,11 +8,27 @@ Mimics langfuse_otel style: gen_ai.input.messages (history) + gen_ai.output.mess
 
 Usage in litellm config.yaml:
   callbacks: ["agentide_litellm_hooks_v1.clean_separated_otel_output"]
+
+PRIVACY DEFAULT (PLAN/compliance-req.md §6 "data minimization"):
+  Prompt and completion CONTENT is NOT captured unless an operator opts in with
+
+      AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1
+
+  Without the opt-in every span carries metadata only — model, tokens, latency, status — plus a
+  sha256 + byte length of the content so a later disclosure can still be *matched* against a
+  span without the span holding the text. This is enforced here at span-write time, in addition
+  to `turn_off_message_logging: true` in the config, so a config that re-enables message logging
+  without the env opt-in still produces redacted spans (defence in depth: the config is edited by
+  hand far more often than this file).
 """
 
 from __future__ import annotations
 from typing import Any
+import hashlib
 import json
+import os
+import re
+import sys
 
 from litellm.integrations.custom_logger import CustomLogger
 from litellm.integrations.opentelemetry import OpenTelemetry
@@ -20,6 +37,109 @@ from opentelemetry.trace import Status, StatusCode
 _OTEL_TEXT_MAX_LEN = 4000           # per text block
 _OTEL_PREVIEW_LEN = 180             # short preview in event
 
+# -----------------------------------------------------------------------------
+# Content capture opt-in (fix: full capture used to be the default)
+# -----------------------------------------------------------------------------
+
+CONTENT_CAPTURE_ENV = "AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE"
+
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+
+# Span attributes that can carry prompt/completion text. Mirrors CONTENT_ATTRS in
+# @agenthippo-ai/evidence-ship so the two redaction points cannot drift silently.
+_CONTENT_ATTR_RE = re.compile(
+    r"^(gen_ai\.(input|output)\.messages"
+    r"|gen_ai\.(prompt|completion)"
+    r"|gen_ai\.system_instructions"
+    r"|llm\.(prompts|responses)"
+    r"|llm\.request\.functions\."
+    r"|error\.(message|stack_trace)"
+    r"|hidden_params"
+    r"|metadata\.requester_custom_headers)"
+)
+
+_capture_banner_printed = False
+
+
+def _content_capture_enabled() -> bool:
+    """True only when an operator explicitly opted in to prompt/completion capture."""
+    return (os.environ.get(CONTENT_CAPTURE_ENV, "") or "").strip().lower() in _TRUTHY
+
+
+def _announce_content_capture() -> None:
+    """Log loudly, once, whichever mode is in force — silence is how this got shipped on."""
+    global _capture_banner_printed
+    if _capture_banner_printed:
+        return
+    _capture_banner_printed = True
+    if _content_capture_enabled():
+        print(
+            "\n"
+            "!! AGENTHIPPO EVIDENCE: FULL PROMPT/COMPLETION CAPTURE IS ON !!\n"
+            f"!! {CONTENT_CAPTURE_ENV} is set. Every span will carry prompt and completion text.\n"
+            "!! Unset it to return to metadata-only (sha256 + length) spans.\n",
+            file=sys.stderr,
+            flush=True,
+        )
+    else:
+        print(
+            f"[agentide-otel] content capture OFF (metadata + sha256 only). "
+            f"Set {CONTENT_CAPTURE_ENV}=1 to record prompts/completions.",
+            file=sys.stderr,
+            flush=True,
+        )
+
+
+def _sha256(text: str) -> str:
+    return hashlib.sha256(text.encode("utf-8", "replace")).hexdigest()
+
+
+class _RedactingSpan:
+    """
+    Span proxy that drops content-bearing attributes and replaces them with a sha256 + length.
+
+    LiteLLM's own `set_attributes()` writes `gen_ai.input.messages` (the full history) and
+    friends. We cannot remove an attribute after the SDK has recorded it, so the only place to
+    stop it is between LiteLLM and the SDK — here. Everything that is not content passes through
+    untouched, so the span keeps model, tokens, latency, status, and the requester metadata the
+    evidence index reads.
+    """
+
+    def __init__(self, span: Any) -> None:
+        self._span = span
+
+    def __getattr__(self, name: str) -> Any:  # everything we do not override
+        return getattr(self._span, name)
+
+    def set_attribute(self, key: Any, value: Any) -> Any:
+        if isinstance(key, str) and _CONTENT_ATTR_RE.match(key):
+            text = value if isinstance(value, str) else json.dumps(value, ensure_ascii=False, default=str)
+            self._span.set_attribute(f"{key}.sha256", _sha256(text))
+            self._span.set_attribute(f"{key}.length", len(text))
+            self._span.set_attribute(f"{key}.redacted", True)
+            return None
+        return self._span.set_attribute(key, value)
+
+    def set_attributes(self, attributes: Any) -> Any:
+        if isinstance(attributes, dict):
+            for key, value in attributes.items():
+                self.set_attribute(key, value)
+            return None
+        return self._span.set_attributes(attributes)
+
+    def add_event(self, name: Any, attributes: Any = None, **kwargs: Any) -> Any:
+        if isinstance(attributes, dict):
+            filtered = {}
+            for key, value in attributes.items():
+                if isinstance(key, str) and _CONTENT_ATTR_RE.match(key):
+                    text = value if isinstance(value, str) else json.dumps(value, ensure_ascii=False, default=str)
+                    filtered[f"{key}.sha256"] = _sha256(text)
+                    filtered[f"{key}.length"] = len(text)
+                else:
+                    filtered[key] = value
+            attributes = filtered
+        return self._span.add_event(name, attributes, **kwargs)
+
 
 def _read_field(obj: Any, key: str, default: Any = None) -> Any:
     if isinstance(obj, dict):
@@ -103,9 +223,16 @@ def _is_anthropic_route(model: Any) -> bool:
     return "claude" in name or "anthropic" in name
 
 
+# Every model known to reject the Codex built-in web-search tools. Additive by policy: a
+# deployment that still routes to an older model keeps its sanitizer when a newer one is added,
+# because a dropped entry fails as upstream 400s on live traffic, not as a test failure.
+_WEB_SEARCH_UNSUPPORTED_MODELS = ("gpt-5.6-luna", "gpt-4.1-nano")
+
+
 def _is_web_search_unsupported_model(model: Any) -> bool:
     """True when the upstream model rejects Codex web-search tools."""
-    return "gpt-4.1-nano" in _model_name(model)
+    name = _model_name(model)
+    return any(m in name for m in _WEB_SEARCH_UNSUPPORTED_MODELS)
 
 
 # OpenAI Responses API fields that Anthropic (and some gateways) reject if forwarded verbatim.
@@ -360,7 +487,7 @@ def sanitize_messages(messages: Any) -> Any:
 
 
 class ReasoningParamsSanitizer(CustomLogger):
-    """LiteLLM proxy hook: strip reasoning controls for gpt-4.1-nano."""
+    """LiteLLM proxy hook: strip reasoning controls for gpt-5.6-luna."""
 
     async def async_pre_call_hook(
         self,
@@ -410,7 +537,7 @@ class CodexProxySanitizer(CustomLogger):
     LiteLLM proxy hook: strip Codex/OpenAI Responses fields/tools that break proxy routes.
 
     - Anthropic: drop client_metadata (OpenAI-only Responses telemetry).
-    - gpt-4.1-nano: drop web_search_preview and related built-in search tools.
+    - gpt-5.6-luna: drop web_search_preview and related built-in search tools.
     """
 
     def _sanitize(self, payload: dict, model: Any) -> dict:
@@ -548,8 +675,36 @@ class CleanSeparatedOtelOutput(OpenTelemetry):
     - gen_ai.input.messages  → full history (as set by LiteLLM)
     - gen_ai.output.messages → only the new assistant reply (stringified structured array)
     - Short preview event for quick visibility
+
+    Content (both directions) is recorded ONLY when AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE is set.
+    Otherwise every content attribute becomes `<key>.sha256` + `<key>.length` — enough to prove
+    which bytes a turn saw, without shipping the bytes.
     """
 
+    def set_attributes(self, span: Any, *args: Any, **kwargs: Any) -> Any:
+        """
+        Redaction chokepoint. Overriding here rather than at the call site covers every path in
+        the base class that sets attributes, including ones this subclass does not override.
+        """
+        _announce_content_capture()
+        if not _content_capture_enabled():
+            span = _RedactingSpan(span)
+        return super().set_attributes(span, *args, **kwargs)
+
+    def _get_span_name(self, kwargs: dict) -> str:
+        # Evidence pipeline indexes spans named litellm_request; main-stable semconv uses "chat …".
+        #
+        # The constant is a PRIVATE litellm symbol and this runs on the span-creation path, so an
+        # upstream rename would raise for every span — total evidence loss at layer 1, not a
+        # degraded span name. The literal is the same value; falling back to it keeps the pipeline
+        # indexing while the import is fixed.
+        try:
+            from litellm.integrations.opentelemetry import LITELLM_REQUEST_SPAN_NAME
+
+            return LITELLM_REQUEST_SPAN_NAME
+        except Exception:  # pragma: no cover - depends on the pinned litellm build
+            return "litellm_request"
+
     def _start_primary_span(
         self,
         kwargs: dict,
@@ -573,24 +728,30 @@ class CleanSeparatedOtelOutput(OpenTelemetry):
                _extract_assistant_text(response_obj)
 
         if text.strip():
-            # Structured output (separate from input history)
-            structured_msgs = _make_output_messages_structured(text)
-            span.set_attribute(
-                "gen_ai.output.messages",
-                json.dumps(structured_msgs, ensure_ascii=False)
-            )
-
-            # Short preview event - easy to spot, low noise
-            preview = text[:_OTEL_PREVIEW_LEN] + ("..." if len(text) > _OTEL_PREVIEW_LEN else "")
-            span.add_event(
-                name="gen_ai.output.generated",
-                attributes={
-                    "gen_ai.output.preview": preview,
-                    "gen_ai.output.length": len(text),
-                    "gen_ai.output.truncated": len(text) > _OTEL_TEXT_MAX_LEN,
-                    "gen_ai.response.model": _read_field(kwargs, "model", "unknown")
-                }
-            )
+            capture = _content_capture_enabled()
+            event_attrs: dict[str, Any] = {
+                # Always present: proves a reply of exactly these bytes was produced, and lets a
+                # disclosed transcript be matched back to the span without storing the text.
+                "gen_ai.output.sha256": _sha256(text),
+                "gen_ai.output.length": len(text),
+                "gen_ai.output.truncated": len(text) > _OTEL_TEXT_MAX_LEN,
+                "gen_ai.output.captured": capture,
+                "gen_ai.response.model": _read_field(kwargs, "model", "unknown"),
+            }
+
+            if capture:
+                # Structured output (separate from input history) — opt-in only.
+                structured_msgs = _make_output_messages_structured(text)
+                span.set_attribute(
+                    "gen_ai.output.messages",
+                    json.dumps(structured_msgs, ensure_ascii=False)
+                )
+                # Short preview event - easy to spot, low noise
+                event_attrs["gen_ai.output.preview"] = (
+                    text[:_OTEL_PREVIEW_LEN] + ("..." if len(text) > _OTEL_PREVIEW_LEN else "")
+                )
+
+            span.add_event(name="gen_ai.output.generated", attributes=event_attrs)
 
         span.end(end_time=self._to_ns(end_time))
         return span

package/out/scripts/analytics/agentide-litellm-otel.config.yaml

@@ -1,4 +1,7 @@
-
+#---------------------------------------------------------------------------------------------
+# Copyright (c) AgentHippo.ai. All rights reserved.
+# Licensed under the MIT License. See LICENSE.txt in the project root for license information.
+#---------------------------------------------------------------------------------------------
 
 # AgentIDE LiteLLM configuration with OpenTelemetry
 # Use this instead of agentide-litellm.config.yaml for lightweight analytics
@@ -19,6 +22,20 @@
 #   OTEL_SERVICE_NAME=agentide-litellm   # Service name in traces
 #   DEBUG_OTEL=true                      # Enable OTEL debug logging
 
+#
+# PRIVACY DEFAULT — metadata only. See "Content capture" below.
+# AUTHENTICATION — general_settings.master_key is REQUIRED; the proxy fails to start without it.
+# ROUTES — consumer/subscription-credential routes are NOT in this file. See
+#          agentide-litellm-consumer-routes.local-dev-only.config.yaml.
+#
+
+general_settings:
+  # Without a master key LiteLLM accepts unauthenticated POST /v1/chat/completions from anything
+  # that can reach the port — on a serve host that is every colocated container, and the proxy
+  # holds provider credentials. No default is supplied on purpose: an unset LITELLM_MASTER_KEY
+  # must fail closed at startup rather than quietly open the proxy.
+  master_key: os.environ/LITELLM_MASTER_KEY
+
 litellm_settings:
   telemetry: false  # Disables sending data to LiteLLM's remote servers
   drop_params: true
@@ -36,139 +53,84 @@ litellm_settings:
   # callbacks: ["agentide_litellm_hooks_v1.structured_genai_otel"]  # , "agentide_litellm_hooks.tool_order_sanitizer"]
   # callbacks: ["agentide_litellm_hooks_v1.structured_genai_otel", "agentide_litellm_hooks_v1.reasoning_params_sanitizer"]
   callbacks: ["agentide_litellm_hooks_v1.structured_genai_otel", "agentide_litellm_hooks_v1.codex_proxy_sanitizer", "agentide_litellm_hooks_v1.tool_order_sanitizer", "agentide_litellm_hooks_v1.empty_thinking_sanitizer", "agentide_litellm_hooks_v1.reasoning_params_sanitizer"]
-  turn_off_message_logging: false
+
+  # ---------------------------------------------------------------------------
+  # Content capture — OPT-IN (PLAN/compliance-req.md §6, data minimization)
+  # ---------------------------------------------------------------------------
+  # Default: prompts and completions are NOT written to spans. Every span still carries model,
+  # token counts, latency, status, requester metadata, and a sha256 + byte length of the content,
+  # so a turn stays attributable and a disclosed transcript can be matched back to it.
+  #
+  # This used to be `turn_off_message_logging: false` + `message_logging: true`, i.e. full prompt
+  # and completion capture on by default, unredacted for the serve lane.
+  #
+  # TO RECORD PROMPTS/COMPLETIONS (both steps are required — either alone keeps you redacted):
+  #   1. set  turn_off_message_logging: false  and  callback_settings.otel.message_logging: true
+  #   2. export AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1
+  # Step 2 is enforced in agentide_litellm_hooks_v1.py at span-write time and logs loudly when on.
+  turn_off_message_logging: true
 
 callback_settings:
   otel:
-    message_logging: true          # critical for seeing tool_calls, arguments, responses
-
-model_list:
-
-  - model_name: litellm/gpt-4.1-nano
-    litellm_params:
-      model: openai/gpt-4.1-nano
-      api_base: https://api.openai.com/v1
-      drop_params: true
-      additional_drop_params: ["user", "max_output_tokens", "reasoning.effort", "reasoning_effort"]      # Must be set at specific model -- global does not work: Force LiteLLM to remove this specific field before sending the request
-
-# Add this under (existing) model_list:
-# model_list:
-#   - model_name: ...
-  - model_name: litellm/claude-opus-4-7
-    litellm_params:
-      model: anthropic/claude-opus-4-7
-      reasoning_effort: "medium"
-      additional_drop_params: ["user", "max_output_tokens"]
-      store: false
-      api_key: os.environ/ANTHROPIC_SETUP_TOKEN
-    model_info:
-      upstream_provider: "anthropic-setup-token"
-
-# Add this under (existing) model_list:
-# model_list:
-#   - model_name: ...
-  - model_name: litellm/claude-haiku-4-5-20251001
-    litellm_params:
-      model: anthropic/claude-haiku-4-5-20251001
-      top_p: null
-      drop_params: true
-      api_base: https://api.anthropic.com
-
-  - model_name: litellm/claude-sonnet-4-6
-    litellm_params:
-      model: anthropic/claude-sonnet-4-6
-      api_base: https://api.anthropic.com
-
-
-# Add this under (existing) model_list:
-# model_list:
-#   - model_name: ...
-  - model_name: litellm/gpt-5.3-codex
-    litellm_params:
-      model: openai/gpt-5.3-codex
-      store: false
-      api_key: os.environ/OPENAI_CODEX_API_KEY
-      api_base: https://chatgpt.com/backend-api/codex
-      reasoning_effort: "medium"
-      additional_drop_params: ["user", "max_output_tokens"]      # Must be set at specific model -- global does not work: Force LiteLLM to remove this specific field before sending the request
-
-  - model_name: litellm/gpt-5.5
-    litellm_params:
-      model: openai/gpt-5.5
-      store: false
-      api_key: os.environ/OPENAI_API_KEY
-      api_base: https://api.openai.com/v1
-      reasoning_effort: "medium"
-      additional_drop_params: ["user", "max_output_tokens"]      # Must be set at specific model -- global does not work: Force LiteLLM to remove this specific field before sending the request
-
-# Add this under (existing) model_list:
-# model_list:
-#   - model_name: ...
-  - model_name: litellm/gpt-5.1-codex-mini
-    litellm_params:
-      model: openai/gpt-5.1-codex-mini
-      reasoning_effort: "medium"
-      additional_drop_params: ["user", "max_output_tokens", "temperature"]
-      store: false
-      api_key: os.environ/OPENAI_CODEX_API_KEY
-      api_base: https://chatgpt.com/backend-api/codex
-
-# Add this under (existing) model_list:
-# model_list:
-#   - model_name: ...
-  - model_name: litellm/claude-opus-4-6-subs
-    litellm_params:
-      model: anthropic/claude-opus-4-6
-      reasoning_effort: "medium"
-      max_tokens: 64000
-      additional_drop_params: ["user", "max_output_tokens"]
-      store: false
-      api_key: os.environ/ANTHROPIC_SETUP_TOKEN
-
-
-  - model_name: litellm/claude-haiku-4-5-subs
-    litellm_params:
-      model: anthropic/claude-haiku-4-5
-      reasoning_effort: "medium"
-      additional_drop_params: ["user", "max_output_tokens"]
-      store: false
-      api_key: os.environ/ANTHROPIC_SETUP_TOKEN
-
-# Add this under (existing) model_list:
-# model_list:
-#   - model_name: ...
-  - model_name: litellm/claude-opus-4-7-test
-    litellm_params:
-      model: anthropic/claude-opus-4-7
-      reasoning_effort: "medium"
-      additional_drop_params: ["user", "max_output_tokens"]
-      store: false
-    model_info:
-      upstream_provider: "anthropic"
+    message_logging: false         # true + AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1 records tool_calls, arguments, responses
+
+# ---------------------------------------------------------------------------
+# Model routes
+# ---------------------------------------------------------------------------
+# A fresh install ships with no active routes. Uncomment `model_list:` and the
+# provider blocks you use, then put the matching key in ~/.agent-hippo/.env
+# (e.g.  echo 'OPENAI_API_KEY=sk-...' >> ~/.agent-hippo/.env). The launcher
+# warns at startup about any referenced env var that is not set.
+#
+# NOTE: `additional_drop_params` must be set per model — the global setting
+# does not work.
+# More providers: https://docs.litellm.ai/docs/providers
+#
+# Consumer/subscription-credential routes (litellm/gpt-5.3-codex,
+# litellm/claude-opus-4-7, …) are deliberately NOT in this file — see
+# agentide-litellm-consumer-routes.local-dev-only.config.yaml and
+# PLAN/compliance.md §12. `litellm/gpt-5.3-codex` is the default model in
+# several docs/manifests; it has NOT been re-pointed at a platform-API route
+# here, because which platform model id is equivalent is a provider question,
+# not a config one — pick one deliberately rather than inheriting a guess.
 
-# Add this under (existing) model_list:
 # model_list:
-#   - model_name: ...
-  - model_name: litellm/gpt-5.4-nano
-    litellm_params:
-      model: openai/gpt-5.4-nano
-      reasoning_effort: "medium"
-      additional_drop_params: ["user", "max_output_tokens"]
-      store: false
-      api_base: https://api.openai.com/v1
-    model_info:
-      upstream_provider: "openai"
-
-  # Fleet / Cloud Run: ah-auto resolves via the central AgentHippo model gateway (same as
-  # colocated agents with AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1).
-  # Set AGENTHIPPO_GATEWAY_KEY to an ahgw_… service key (create-gateway-key on the gateway host).
-  - model_name: ah-auto
-    litellm_params:
-      # openai/ prefix required — bare `ah-auto` fails LiteLLM router deployment (no provider).
-      model: openai/ah-auto
-      api_base: https://gateway.agenthippo.ai/v1
-      api_key: os.environ/AGENTHIPPO_GATEWAY_KEY
-      drop_params: true
-      additional_drop_params: ["user", "max_output_tokens", "reasoning.effort", "reasoning_effort"]
-    model_info:
-      upstream_provider: "agenthippo-gateway"
+#   # --- OpenAI (platform API) ---
+#   - model_name: litellm/gpt-5.5
+#     litellm_params:
+#       model: openai/gpt-5.5
+#       api_base: https://api.openai.com/v1
+#       api_key: os.environ/OPENAI_API_KEY
+#       drop_params: true
+#       additional_drop_params: ["user", "max_output_tokens"]
+#
+#   # --- Anthropic (platform API) ---
+#   - model_name: litellm/claude-sonnet-4-6
+#     litellm_params:
+#       model: anthropic/claude-sonnet-4-6
+#       api_base: https://api.anthropic.com
+#       api_key: os.environ/ANTHROPIC_API_KEY
+#       drop_params: true
+#
+#   # --- AgentHippo model gateway (fleet / Cloud Run) ---
+#   # Same endpoint as colocated agents with
+#   # AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1.
+#   # AGENTHIPPO_GATEWAY_KEY is an ahgw_… service key (create-gateway-key on
+#   # the gateway host).
+#   - model_name: ah-auto
+#     litellm_params:
+#       # openai/ prefix required — bare `ah-auto` fails LiteLLM router
+#       # deployment (no provider).
+#       model: openai/ah-auto
+#       api_base: https://gateway.agenthippo.ai/v1
+#       api_key: os.environ/AGENTHIPPO_GATEWAY_KEY
+#       drop_params: true
+#       additional_drop_params: ["user", "max_output_tokens", "reasoning.effort", "reasoning_effort"]
+#
+#   # --- Distributed LiteLLM OTEL: central model gateway ---
+#   - model_name: ah-auto
+#     litellm_params:
+#       model: openai/ah-auto
+#       api_base: https://gatewayv1.agenthippo.ai/v1
+#       api_key: os.environ/AGENTHIPPO_GATEWAY_KEY
+#       drop_params: true

package/out/scripts/analytics/setup-analytics.ps1

@@ -282,6 +282,37 @@ function Resolve-LiteLLMHooks {
     return $null
 }
 
+# Ensure the proxy has an auth key without ever asking the user for one.
+# Mirrors ensure_litellm_master_key in setup-analytics.sh — the launcher refuses to start
+# unauthenticated, so a first run with no key would leave LiteLLM dead with the error in a log.
+function Ensure-LiteLLMMasterKey {
+    $envFile = Join-Path $AgentHomeDir ".env"
+
+    if ((Test-Path $envFile) -and (Select-String -Path $envFile -Pattern '^\s*LITELLM_MASTER_KEY=' -Quiet)) {
+        Log-Success "LiteLLM master key already configured"
+        return
+    }
+    if ($env:LITELLM_MASTER_KEY) {
+        Log-Success "Using LITELLM_MASTER_KEY from the environment"
+        return
+    }
+
+    $bytes = New-Object byte[] 24
+    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
+    $key = "sk-" + (($bytes | ForEach-Object { $_.ToString("x2") }) -join "")
+
+    New-Item -ItemType Directory -Path $AgentHomeDir -Force | Out-Null
+    $lines = @(
+        "# Generated by setup-analytics - authenticates the local LiteLLM proxy.",
+        "# Clients read the same value as AGENTHIPPO_LITELLM_API_KEY.",
+        "LITELLM_MASTER_KEY=$key",
+        "AGENTHIPPO_LITELLM_API_KEY=$key"
+    )
+    Add-Content -Path $envFile -Value $lines
+    $env:LITELLM_MASTER_KEY = $key
+    Log-Success "Generated a LiteLLM master key (stored in $envFile)"
+}
+
 function Setup-Config {
     Log-Step "Setting up configuration..."
 
@@ -289,6 +320,9 @@ function Setup-Config {
     New-Item -ItemType Directory -Path (Join-Path $AnalyticsDir "config") -Force | Out-Null
     New-Item -ItemType Directory -Path (Join-Path $AnalyticsDir "traces") -Force | Out-Null
 
+    # Before any early return below - the launcher exits non-zero without a key.
+    Ensure-LiteLLMMasterKey
+
     # Copy OTEL config
     $configDest = Join-Path $AnalyticsDir "config\otel-collector.yaml"
     $configSrc = Join-Path $ScriptDir "otel-collector.yaml"
@@ -330,19 +364,9 @@ function Setup-Config {
         Log-Success "LiteLLM OTEL config already present (user-owned)"
     }
 
-    # Keep canonical template in sync with user edits when writable.
-    if ((Test-Path $litellmSrc) -and (Test-Path $litellmDest)) {
-        $sourceHash = (Get-Sha256Hash $litellmSrc)
-        $destHash = (Get-Sha256Hash $litellmDest)
-        if ($sourceHash -ne $destHash) {
-            try {
-                Copy-Item $litellmDest $litellmSrc -Force
-                Log-Success "Synced LiteLLM OTEL config back to source template"
-            } catch {
-                Log-Info "Using user-owned LiteLLM config (source template is read-only)"
-            }
-        }
-    }
+    # Deliberately ONE-WAY (template -> user). Copying the user's config back over the shipped
+    # template wrote their edits into the installed extension / a git-tracked file, and model
+    # entries can carry a literal upstream api_key - a credential leak into source control.
 
     $hooksDest = Join-Path $AgentHomeDir "agentide_litellm_hooks_v1.py"
     $hooksSrc = Resolve-LiteLLMHooks