licos-dev-sdk 0.4.5__tar.gz → 0.4.7__tar.gz

{licos_dev_sdk-0.4.5 → licos_dev_sdk-0.4.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: licos-dev-sdk
-Version: 0.4.5
+Version: 0.4.7
 Summary: LICOS Dev SDK - file generation and model capability clients
 Requires-Python: >=3.10
 Requires-Dist: beautifulsoup4>=4.12

{licos_dev_sdk-0.4.5 → licos_dev_sdk-0.4.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "licos-dev-sdk"
-version = "0.4.5"
+version = "0.4.7"
 description = "LICOS Dev SDK - file generation and model capability clients"
 requires-python = ">=3.10"
 dependencies = [

licos_dev_sdk-0.4.7/src/licos_dev_sdk/_usage_identity.py

@@ -0,0 +1,59 @@
+"""Renew existing model billing signatures without changing routing headers."""
+
+from __future__ import annotations
+
+import threading
+import time
+from datetime import datetime
+from typing import Any, Callable
+
+from licos_platform_sdk._runtime import ApiError
+
+IDENTITY_HEADERS = (
+    "X-AIOS-Usage-Context",
+    "X-AIOS-Usage-Context-Signature",
+    "X-AIOS-Provider-Credential-Id",
+    "X-AIOS-Provider-Workspace-Id",
+)
+REFRESH_LEAD_SECS = 30
+
+
+def has_signature(headers: dict[str, str]) -> bool:
+    return any(name.lower() in {value.lower() for value in IDENTITY_HEADERS[:2]} for name in headers)
+
+
+class UsageIdentityLease:
+    def __init__(self, detail: dict[str, Any] | None, parse_headers: Callable[[Any], dict[str, str]]) -> None:
+        self._parse_headers = parse_headers
+        self._headers, self._expires_at = self._parse(detail)
+        self._lock = threading.Lock()
+
+    def _parse(self, detail: dict[str, Any] | None) -> tuple[dict[str, str], float]:
+        if detail is None:
+            raise ApiError("model detail is missing usage identity")
+        raw = self._parse_headers(detail.get("requiredHeaders") or detail.get("required_headers"))
+        normalized = {name.lower(): value for name, value in raw.items()}
+        headers = {}
+        for name in IDENTITY_HEADERS:
+            value = normalized.get(name.lower())
+            if not value:
+                raise ApiError(f"model detail is missing {name}")
+            headers[name] = value
+        expiry = detail.get("usageContextExpiresAt")
+        try:
+            parsed = datetime.fromisoformat(str(expiry).replace("Z", "+00:00"))
+            if parsed.tzinfo is None:
+                raise ValueError("expiry requires timezone")
+            expires_at = parsed.timestamp()
+        except ValueError as exc:
+            raise ApiError("model detail has invalid usageContextExpiresAt") from exc
+        return headers, expires_at
+
+    def current_headers(self, fetch_detail: Callable[[], dict[str, Any] | None]) -> dict[str, str]:
+        with self._lock:
+            if self._expires_at <= time.time() + REFRESH_LEAD_SECS:
+                headers, expires_at = self._parse(fetch_detail())
+                if expires_at <= time.time() + REFRESH_LEAD_SECS:
+                    raise ApiError("renewed model usage identity expires before the request can start")
+                self._headers, self._expires_at = headers, expires_at
+            return dict(self._headers)

{licos_dev_sdk-0.4.5 → licos_dev_sdk-0.4.7}/src/licos_dev_sdk/model.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import atexit
+import asyncio
 import base64
 import json
 import logging
@@ -25,6 +26,7 @@ from licos_platform_sdk._runtime import (
     resolve_user_token,
     should_refresh_user_token,
 )
+from ._usage_identity import UsageIdentityLease, has_signature
 
 
 AVAILABLE_MODELS_PATH_TEMPLATE = "/api/v1/admin/workspaces/{workspace_id}/models/available"
@@ -92,6 +94,7 @@ class ModelEndpoint:
     context_length: int | None = None
     max_input_length: int | None = None
     max_output_length: int | None = None
+    usage_identity: UsageIdentityLease | None = field(default=None, repr=False, compare=False)
 
     @property
     def async_task(self) -> bool:
@@ -482,6 +485,7 @@ def create_chat_openai(
     max_completion_tokens: int | None = None,
     timeout: int | None = None,
     streaming: bool = True,
+    use_responses_api: bool | None = None,
     default_headers: dict[str, str] | None = None,
     **kwargs: Any,
 ) -> Any:
@@ -490,6 +494,8 @@ def create_chat_openai(
     `model=None`, an empty string, or `model="auto"` uses the catalog default. The
     returned ChatOpenAI receives the current user token as its OpenAI-compatible API
     key, so deployed projects do not need LLM_MODEL/OPENAI_MODEL env injection.
+    A catalog `response_url` selects Responses by default. Set
+    `use_responses_api=False` to use Chat Completions explicitly.
     """
     try:
         from langchain_core.callbacks import BaseCallbackHandler
@@ -500,6 +506,11 @@ def create_chat_openai(
 
     runtime = _model_runtime(base_url=base_url, user_token=user_token, user_id=user_id, workspace_id=workspace_id)
     endpoint = _resolve_chat_endpoint(runtime, model_group=model_group, requested_model=model)
+    if use_responses_api is None:
+        use_responses_api = bool(endpoint.response_url)
+    if use_responses_api and not endpoint.response_url:
+        raise ConfigurationError(f"Model {endpoint.model!r} has no response_url configured")
+    endpoint_url = endpoint.response_url if use_responses_api else endpoint.base_url
     headers = _without_authorization(
         _merge_headers(
             endpoint.request_headers or endpoint.required_headers,
@@ -540,7 +551,8 @@ def create_chat_openai(
         )
     chat_kwargs: dict[str, Any] = {
         "model": endpoint.model,
-        "base_url": _chat_completions_sdk_base_url(endpoint.base_url),
+        "base_url": _openai_sdk_base_url(endpoint_url, use_responses_api=use_responses_api),
+        "use_responses_api": use_responses_api,
         "api_key": api_key or runtime.token,
         "streaming": streaming,
         **_not_none(
@@ -566,8 +578,11 @@ def _LangChainUsageHandler(
     endpoint: ModelEndpoint,
 ) -> Any:
     class UsageHandler(base_handler):
+        run_inline = True
+
         def __init__(self) -> None:
             super().__init__()
+            self._routing_headers = _routing_headers(runtime)
             self._request_id: ContextVar[str | None] = ContextVar(
                 "licos_langchain_model_request_id",
                 default=None,
@@ -586,12 +601,37 @@ def _LangChainUsageHandler(
         def on_chat_model_start(self, *_args: Any, **_kwargs: Any) -> None:
             self._current_request_id()
 
+        def _matches_model_request(self, request_value: Any) -> bool:
+            if request_value.method != "POST" or request_value.headers.get("content-type", "").split(";")[0] != "application/json":
+                return False
+            return json.loads(request_value.content).get("model") == endpoint.model and all(
+                request_value.headers.get(name) == value for name, value in self._routing_headers.items()
+            )
+
         def on_http_request(self, request_value: Any) -> None:
+            if not self._matches_model_request(request_value):
+                return
             request_id = self._current_request_id()
             request_value.headers[MODEL_REQUEST_ID_HEADER] = request_id
+            if request_value.extensions.get("licos_usage_identity_managed"):
+                return
+            self._apply_usage_identity(request_value, _current_usage_identity(endpoint, runtime))
+
+        def _apply_usage_identity(self, request_value: Any, headers: dict[str, str]) -> None:
+            for name, value in headers.items():
+                for existing in list(request_value.headers):
+                    if existing.lower() == name.lower():
+                        del request_value.headers[existing]
+                request_value.headers[name] = value
 
         async def on_async_http_request(self, request_value: Any) -> None:
-            self.on_http_request(request_value)
+            if not self._matches_model_request(request_value):
+                return
+            request_value.headers[MODEL_REQUEST_ID_HEADER] = self._current_request_id()
+            if request_value.extensions.get("licos_usage_identity_managed"):
+                return
+            headers = await asyncio.to_thread(_current_usage_identity, endpoint, runtime)
+            self._apply_usage_identity(request_value, headers)
 
         def on_llm_end(self, response: Any, **_kwargs: Any) -> None:
             usage = None
@@ -622,9 +662,10 @@ def _LangChainUsageHandler(
     return UsageHandler()
 
 
-def _chat_completions_sdk_base_url(url: str) -> str:
+def _openai_sdk_base_url(url: str, *, use_responses_api: bool) -> str:
     trimmed = str(url or "").strip().rstrip("/")
-    return trimmed.removesuffix("/chat/completions").rstrip("/")
+    suffix = "/responses" if use_responses_api else "/chat/completions"
+    return trimmed.removesuffix(suffix).rstrip("/")
 
 
 def resolve_vision_endpoint(
@@ -1630,7 +1671,22 @@ def _enterprise_org_id(value: str | None) -> str | None:
 
 def _request_headers(endpoint: ModelEndpoint, runtime: ModelRuntime) -> dict[str, str]:
     headers = endpoint.request_headers or endpoint.required_headers
-    return _without_authorization(_merge_headers(headers, _routing_headers(runtime)))
+    return _without_authorization(_merge_headers(headers, _routing_headers(runtime), _current_usage_identity(endpoint, runtime)))
+
+
+def _current_usage_identity(endpoint: ModelEndpoint, runtime: ModelRuntime) -> dict[str, str]:
+    if endpoint.usage_identity is None:
+        return {}
+    return endpoint.usage_identity.current_headers(
+        lambda: _fetch_model_detail(runtime, endpoint.model, refresh=True)
+    )
+
+
+def _with_usage_identity(endpoint: ModelEndpoint, detail: dict[str, Any] | None) -> ModelEndpoint:
+    detail_headers = _parse_required_headers((detail or {}).get("requiredHeaders") or (detail or {}).get("required_headers"))
+    if not has_signature(_merge_headers(endpoint.required_headers, endpoint.request_headers, detail_headers)):
+        return endpoint
+    return replace(endpoint, usage_identity=UsageIdentityLease(detail, _parse_required_headers))
 
 
 def _merge_headers(*groups: dict[str, str] | None) -> dict[str, str]:
@@ -2120,7 +2176,7 @@ def _resolve_chat_endpoint(
     selected_model = _selected_model(requested_model, endpoint.model)
     endpoint = replace(endpoint, model=selected_model)
     detail = _fetch_model_detail(runtime, selected_model)
-    return _apply_model_detail(endpoint, detail)
+    return _with_usage_identity(_apply_model_detail(endpoint, detail), detail)
 
 
 def _resolve_endpoint_with_detail(
@@ -2139,7 +2195,7 @@ def _resolve_endpoint_with_detail(
         input_capabilities=input_capabilities,
     )
     detail = _fetch_model_detail(runtime, endpoint.model)
-    return _apply_model_detail(endpoint, detail)
+    return _with_usage_identity(_apply_model_detail(endpoint, detail), detail)
 
 
 def _resolve_endpoint(

licos_dev_sdk-0.4.7/tests/test_langchain_protocol.py

@@ -0,0 +1,154 @@
+from __future__ import annotations
+
+import asyncio
+import json
+from pathlib import Path
+import sys
+import unittest
+from unittest.mock import patch
+
+import httpx
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "licos-platform-sdk" / "src"))
+
+from licos_dev_sdk import model
+from licos_platform_sdk._runtime import ConfigurationError
+
+
+CHAT_URL = "https://chat.example/compatible/v1/chat/completions"
+RESPONSES_URL = "https://responses.example/api/v1/responses"
+
+
+class LangChainProtocolTests(unittest.TestCase):
+    def setUp(self):
+        runtime = model.ModelRuntime(base_url="https://platform.example", token="user-token")
+        self.runtime_patch = patch.object(model, "_model_runtime", return_value=runtime)
+        self.usage_patch = patch.object(model, "_enqueue_model_usage")
+        self.runtime_patch.start()
+        self.usage = self.usage_patch.start()
+        self.addCleanup(self.runtime_patch.stop)
+        self.addCleanup(self.usage_patch.stop)
+
+    def endpoint(self, response_url):
+        return model.ModelEndpoint(
+            provider="test", capability="chat", model="test-model", base_url=CHAT_URL,
+            response_url=response_url, request_headers={"X-Provider-Route": "route-1"},
+        )
+
+    def response(self, request):
+        if str(request.url) == RESPONSES_URL:
+            body = {
+                "id": "resp_1", "object": "response", "created_at": 1,
+                "model": "test-model", "status": "completed", "error": None,
+                "output": [{"id": "msg_1", "type": "message", "role": "assistant", "status": "completed",
+                            "content": [{"type": "output_text", "text": "answer", "annotations": []}]}],
+                "usage": {"input_tokens": 3, "output_tokens": 2, "total_tokens": 5},
+            }
+        else:
+            self.assertEqual(str(request.url), CHAT_URL)
+            body = {
+                "id": "chat_1", "object": "chat.completion", "created": 1, "model": "test-model",
+                "choices": [{"index": 0, "message": {"role": "assistant", "content": "answer"}, "finish_reason": "stop"}],
+                "usage": {"prompt_tokens": 3, "completion_tokens": 2, "total_tokens": 5},
+            }
+        return httpx.Response(200, json=body)
+
+    def test_catalog_selects_actual_protocol_and_address(self):
+        for response_url, override, expected in [
+            (RESPONSES_URL, None, RESPONSES_URL),
+            (None, None, CHAT_URL),
+            (RESPONSES_URL, False, CHAT_URL),
+            (RESPONSES_URL, True, RESPONSES_URL),
+        ]:
+            for asynchronous in (False, True):
+                with self.subTest(response_url=response_url, override=override, asynchronous=asynchronous):
+                    requests = []
+
+                    def handle(request):
+                        requests.append(request)
+                        return self.response(request)
+
+                    transport = httpx.MockTransport(handle)
+                    sync_client = httpx.Client(transport=transport)
+                    async_client = httpx.AsyncClient(transport=transport)
+                    try:
+                        with patch.object(model, "_resolve_chat_endpoint", return_value=self.endpoint(response_url)):
+                            options = {} if override is None else {"use_responses_api": override}
+                            chat = model.create_chat_openai(streaming=False, http_client=sync_client,
+                                                            http_async_client=async_client, **options)
+                        result = asyncio.run(chat.ainvoke("question")) if asynchronous else chat.invoke("question")
+                        self.assertEqual(len(requests), 1)
+                        self.assertEqual(str(requests[0].url), expected)
+                        payload = json.loads(requests[0].content)
+                        self.assertIn("input" if expected == RESPONSES_URL else "messages", payload)
+                        self.assertEqual(requests[0].headers["Authorization"], "Bearer user-token")
+                        self.assertEqual(requests[0].headers["X-Provider-Route"], "route-1")
+                        self.assertTrue(requests[0].headers[model.MODEL_REQUEST_ID_HEADER])
+                        self.assertEqual(result.text, "answer")
+                        self.assertEqual(result.usage_metadata["total_tokens"], 5)
+                        self.assertEqual(chat.use_responses_api, expected == RESPONSES_URL)
+                    finally:
+                        sync_client.close()
+                        asyncio.run(async_client.aclose())
+
+    def test_explicit_responses_requires_catalog_address(self):
+        with patch.object(model, "_resolve_chat_endpoint", return_value=self.endpoint(None)):
+            with self.assertRaisesRegex(ConfigurationError, "response_url"):
+                model.create_chat_openai(use_responses_api=True)
+
+    def test_streaming_uses_selected_endpoint_and_keeps_usage(self):
+        for response_url in (RESPONSES_URL, None):
+            for asynchronous in (False, True):
+                with self.subTest(response_url=response_url, asynchronous=asynchronous):
+                    requests = []
+
+                    def handle(request):
+                        requests.append(request)
+                        body = self.response(request).json()
+                        if response_url:
+                            events = [
+                                {"type": "response.created", "response": {**body, "status": "in_progress", "output": []}},
+                                {"type": "response.output_text.delta", "output_index": 0, "content_index": 0,
+                                 "item_id": "msg_1", "delta": "answer"},
+                                {"type": "response.output_text.done", "output_index": 0, "content_index": 0,
+                                 "item_id": "msg_1", "text": "answer"},
+                                {"type": "response.completed", "response": body},
+                            ]
+                            text = "".join(f"event: {event['type']}\ndata: {json.dumps({**event, 'sequence_number': i})}\n\n"
+                                           for i, event in enumerate(events))
+                        else:
+                            base = {"id": "chat_1", "object": "chat.completion.chunk", "created": 1, "model": "test-model"}
+                            events = [
+                                {**base, "choices": [{"index": 0, "delta": {"role": "assistant", "content": "answer"}, "finish_reason": None}]},
+                                {**base, "choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}]},
+                                {**base, "choices": [], "usage": body["usage"]},
+                            ]
+                            text = "".join(f"data: {json.dumps(event)}\n\n" for event in events) + "data: [DONE]\n\n"
+                        return httpx.Response(200, headers={"Content-Type": "text/event-stream"}, content=text)
+
+                    transport = httpx.MockTransport(handle)
+                    sync_client = httpx.Client(transport=transport)
+                    async_client = httpx.AsyncClient(transport=transport)
+                    try:
+                        with patch.object(model, "_resolve_chat_endpoint", return_value=self.endpoint(response_url)):
+                            chat = model.create_chat_openai(http_client=sync_client, http_async_client=async_client)
+
+                        async def collect():
+                            return [chunk async for chunk in chat.astream("question")]
+
+                        chunks = asyncio.run(collect()) if asynchronous else list(chat.stream("question"))
+                        combined = chunks[0]
+                        for chunk in chunks[1:]:
+                            combined += chunk
+                        self.assertEqual(str(requests[0].url), response_url or CHAT_URL)
+                        self.assertTrue(json.loads(requests[0].content)["stream"])
+                        self.assertEqual(combined.text, "answer")
+                        self.assertEqual(combined.usage_metadata["total_tokens"], 5)
+                    finally:
+                        sync_client.close()
+                        asyncio.run(async_client.aclose())
+
+
+if __name__ == "__main__":
+    unittest.main()

licos_dev_sdk-0.4.7/tests/test_usage_identity.py

@@ -0,0 +1,176 @@
+from __future__ import annotations
+
+import asyncio
+import sys
+import unittest
+from concurrent.futures import ThreadPoolExecutor
+from datetime import datetime, timezone
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "licos-platform-sdk" / "src"))
+
+import httpx
+
+from licos_dev_sdk import model
+from licos_dev_sdk._usage_identity import IDENTITY_HEADERS, UsageIdentityLease
+from licos_platform_sdk._runtime import ApiError
+
+
+def detail(context: str, expires_at: float) -> dict:
+    return {
+        "usageContextExpiresAt": datetime.fromtimestamp(expires_at, timezone.utc).isoformat(),
+        "requiredHeaders": {
+            IDENTITY_HEADERS[0].lower(): context,
+            IDENTITY_HEADERS[1]: f"{context}-signature",
+            IDENTITY_HEADERS[2]: f"{context}-credential",
+            IDENTITY_HEADERS[3]: f"{context}-workspace",
+            "X-Provider-Unrelated": "must-not-merge",
+            "X-Licos-Owner-User-Id": "must-not-replace",
+        },
+    }
+
+
+def endpoint(expires_at: float) -> model.ModelEndpoint:
+    return model._with_usage_identity(
+        model.ModelEndpoint(
+            provider="bailian", capability="videoGeneration", model="qwen-test",
+            base_url="http://gateway.example/model",
+            required_headers={IDENTITY_HEADERS[0].lower(): "catalog-stale", "X-Provider-Route": "route"},
+            endpoint={"async": True, "taskQueryUrl": "http://gateway.example/tasks/{taskId}"},
+        ),
+        detail("initial", expires_at),
+    )
+
+
+class UsageIdentityTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.runtime = model.ModelRuntime(
+            base_url="http://platform.example", token="user-token", workspace_id="workspace-1",
+            user_id="owner-1", current_user_id="caller-1", owner_project_id="project-1",
+        )
+
+    def test_valid_lease_reuses_signed_snapshot(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            lease = UsageIdentityLease(detail("initial", 200), model._parse_required_headers)
+            fetch = mock.Mock()
+            snapshot = lease.current_headers(fetch)
+            snapshot[IDENTITY_HEADERS[0]] = "mutated"
+            self.assertEqual(lease.current_headers(fetch)[IDENTITY_HEADERS[0]], "initial")
+            fetch.assert_not_called()
+
+    def test_concurrent_requests_share_one_near_expiry_refresh(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            lease = UsageIdentityLease(detail("initial", 120), model._parse_required_headers)
+            fetch = mock.Mock(return_value=detail("renewed", 200))
+            with ThreadPoolExecutor(max_workers=8) as executor:
+                snapshots = list(executor.map(lambda _: lease.current_headers(fetch), range(16)))
+            fetch.assert_called_once()
+            self.assertTrue(all(value[IDENTITY_HEADERS[0]] == "renewed" for value in snapshots))
+
+    def test_invalid_signed_detail_is_rejected(self) -> None:
+        for missing in (*IDENTITY_HEADERS[1:], "usageContextExpiresAt"):
+            invalid = detail("initial", 200)
+            if missing == "usageContextExpiresAt":
+                del invalid[missing]
+            else:
+                del invalid["requiredHeaders"][missing]
+            with self.subTest(missing=missing), self.assertRaises(ApiError):
+                UsageIdentityLease(invalid, model._parse_required_headers)
+
+    def test_expired_renewal_never_sends_model_request(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            selected = endpoint(90)
+            with mock.patch.object(model, "_fetch_model_detail", return_value=detail("still-expired", 110)), \
+                    mock.patch.object(model, "_request_json") as request:
+                with self.assertRaisesRegex(ApiError, "expires before"):
+                    model._post_model_json(selected, self.runtime, {"model": "qwen-test"})
+                request.assert_not_called()
+
+    def test_refresh_failure_never_sends_model_request(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            selected = endpoint(90)
+            with mock.patch.object(model, "_fetch_model_detail", side_effect=ApiError("catalog unavailable")), \
+                    mock.patch.object(model, "_request_json") as request:
+                with self.assertRaisesRegex(ApiError, "catalog unavailable"):
+                    model._post_model_json(selected, self.runtime, {"model": "qwen-test"})
+                request.assert_not_called()
+
+    def test_submit_replaces_only_four_headers_and_retains_owner_and_caller(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            selected = endpoint(120)
+            with mock.patch.object(model, "_fetch_model_detail", return_value=detail("renewed", 200)) as fetch, \
+                    mock.patch.object(model, "_request_json", return_value={}) as request:
+                for _ in range(2):
+                    model._post_model_json(selected, self.runtime, {"model": "qwen-test"})
+                fetch.assert_called_once_with(self.runtime, "qwen-test", refresh=True)
+                headers = request.call_args.kwargs["headers"]
+                self.assertEqual(headers[IDENTITY_HEADERS[0]], "renewed")
+                self.assertNotIn(IDENTITY_HEADERS[0].lower(), headers)
+                self.assertEqual(headers["X-Licos-Owner-User-Id"], "owner-1")
+                self.assertEqual(headers["X-Licos-Current-User-Id"], "caller-1")
+                self.assertEqual(headers["X-Provider-Route"], "route")
+                self.assertEqual(headers["X-DashScope-Async"], "enable")
+                self.assertNotIn("X-Provider-Unrelated", headers)
+
+    def test_media_poll_refreshes_after_submit_identity_nears_expiry(self) -> None:
+        clock = [100]
+        with mock.patch("time.time", side_effect=lambda: clock[0]):
+            selected = endpoint(200)
+            captured = []
+
+            def request(method, url, **kwargs):
+                captured.append(kwargs["headers"])
+                return {"output": {"task_status": "RUNNING" if len(captured) == 1 else "SUCCEEDED"}}
+
+            with mock.patch.object(model, "_request_json", side_effect=request), \
+                    mock.patch.object(model, "_fetch_model_detail", return_value=detail("renewed", 500)) as fetch, \
+                    mock.patch.object(model, "_enqueue_model_usage"), \
+                    mock.patch("time.sleep", side_effect=lambda _: clock.__setitem__(0, 180)):
+                model._await_async_model_result(selected, self.runtime, {"output": {"task_id": "task-1"}})
+            fetch.assert_called_once_with(self.runtime, "qwen-test", refresh=True)
+            self.assertEqual([headers[IDENTITY_HEADERS[0]] for headers in captured], ["initial", "renewed"])
+            self.assertTrue(all(headers["X-Licos-Current-User-Id"] == "caller-1" for headers in captured))
+
+    def test_langchain_sync_hook_renews_static_default_headers(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            handler = model._LangChainUsageHandler(object, self.runtime, endpoint(90))
+            req = httpx.Request("POST", "http://gateway.example/model", headers={
+                IDENTITY_HEADERS[0].lower(): "stale", **model._routing_headers(self.runtime),
+            }, json={"model": "qwen-test"})
+            with mock.patch.object(model, "_fetch_model_detail", return_value=detail("renewed", 200)) as fetch:
+                handler.on_http_request(req)
+                handler.on_http_request(req)
+            fetch.assert_called_once()
+            self.assertEqual(req.headers.get_list(IDENTITY_HEADERS[0]), ["renewed"])
+            self.assertEqual(req.headers["X-Licos-Owner-User-Id"], "owner-1")
+
+    def test_langchain_async_hooks_share_renewal(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            handler = model._LangChainUsageHandler(object, self.runtime, endpoint(90))
+            requests = [httpx.Request("POST", "http://gateway.example/model", json={"model": "qwen-test"},
+                                      headers=model._routing_headers(self.runtime)) for _ in range(8)]
+
+            async def run():
+                await asyncio.gather(*(handler.on_async_http_request(req) for req in requests))
+
+            with mock.patch.object(model, "_fetch_model_detail", return_value=detail("renewed", 200)) as fetch:
+                asyncio.run(run())
+            fetch.assert_called_once()
+            self.assertTrue(all(req.headers[IDENTITY_HEADERS[0]] == "renewed" for req in requests))
+
+    def test_shared_http_client_hooks_do_not_replace_other_user_or_model_signatures(self) -> None:
+        with mock.patch("time.time", return_value=100):
+            handler = model._LangChainUsageHandler(object, self.runtime, endpoint(90))
+            for body, headers in [
+                ({"model": "another-model"}, model._routing_headers(self.runtime)),
+                ({"model": "qwen-test"}, {**model._routing_headers(self.runtime), "X-Licos-Current-User-Id": "another-user"}),
+            ]:
+                with self.subTest(body=body, headers=headers):
+                    req = httpx.Request("POST", "http://gateway.example/model", json=body,
+                                        headers={**headers, IDENTITY_HEADERS[0]: "other-context"})
+                    with mock.patch.object(model, "_fetch_model_detail") as fetch:
+                        handler.on_http_request(req)
+                    fetch.assert_not_called()
+                    self.assertEqual(req.headers[IDENTITY_HEADERS[0]], "other-context")