diff --git a/k8s/helm/commonly/templates/configmaps/litellm-config.yaml b/k8s/helm/commonly/templates/configmaps/litellm-config.yaml index def020f59d..5dc5b764c5 100644 --- a/k8s/helm/commonly/templates/configmaps/litellm-config.yaml +++ b/k8s/helm/commonly/templates/configmaps/litellm-config.yaml @@ -113,104 +113,58 @@ data: # all fallback chains below. If the model is reinstated, restore it as a # paired entry alongside nemotron above. - # --- Codex (chatgpt/ provider) --- - # The `responses/` in `chatgpt/responses/gpt-5.4*` is LOAD-BEARING. Plain - # `chatgpt/gpt-5.4*` routes to /backend-api/codex/chat/completions, which Cloudflare - # serves a JS bot-challenge for (HTML, not JSON) -> the call fails and silently falls - # back to OpenRouter Nemotron. The /responses endpoint is NOT challenged. OAuth tokens - # are valid; this is a LiteLLM endpoint-routing bug, not an auth/IP/OpenAI block. - # See BerriAI/litellm#27175 (workaround) + openclaw#68033 (2026-06). - # Equally LOAD-BEARING: do NOT add `model_info: mode: responses` here. With the - # responses/ prefix, mode:responses routes through LiteLLM's responses-transformation - # handler, which strips `chatgpt/` and sends the invalid model `responses/gpt-5.4-mini` - # (400 "model not supported"). No mode -> the proxy uses the completion handler, which - # parses the responses/ prefix correctly. Verified 3/3 via proxy /chat/completions. - # NOTE: LiteLLM's chatgpt/ provider reads tokens from auth.json (written by the - # codex-auth-seed init + codex-auth-rotator sidecar). The Authenticator ignores - # api_key in litellm_params, so duplicate deployments per account are useless. - # Multi-account rotation happens via the sidecar swapping auth.json every 10 min. - # Each user on the ChatGPT Team has their own quota pool, so rotation gives real - # multi-account benefit. - # - # timeout: 120s per call; fallback to OpenRouter on 429/timeout (router_settings). - # Pricing sourced from pricepertoken.com 2026-04-04: - # gpt-5.4: $2.50 input / $15.00 output per 1M tokens - # gpt-5.4-mini: $0.75 input / $4.50 output per 1M tokens - # gpt-5.4-nano: $0.20 input / $1.25 output per 1M tokens + # --- D111 (2026-10-27): GPT/Codex access revoked. Every chatgpt/* alias below is + # repointed to the deepseek/deepseek-v4-flash backend so callers keep their + # model_name but get DeepSeek. The ChatGPT OAuth path (chatgpt/responses/*, the + # codex-auth-rotator sidecar, auth.json) is dormant until GPT access returns; + # revert this block to restore it. deepseek-v4-flash's own entry above is the + # canonical backend and carries the group budget; these are thin aliases to it, + # so they inherit DeepSeek pricing from LiteLLM's model db. The durable caps are + # the service virtual keys (backend $40, commonly-bot $20). --- - model_name: gpt-5.4 litellm_params: - model: chatgpt/responses/gpt-5.4 - timeout: 120 - input_cost_per_token: 0.0000025 - output_cost_per_token: 0.000015 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - model_name: openai-codex/gpt-5.4 litellm_params: - model: chatgpt/responses/gpt-5.4 - timeout: 120 - input_cost_per_token: 0.0000025 - output_cost_per_token: 0.000015 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - # --- gpt-5.4-mini (used for dev agent heartbeat orchestration) --- - model_name: gpt-5.4-mini litellm_params: - model: chatgpt/responses/gpt-5.4-mini - timeout: 120 - input_cost_per_token: 0.00000075 - output_cost_per_token: 0.0000045 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - model_name: openai-codex/gpt-5.4-mini litellm_params: - model: chatgpt/responses/gpt-5.4-mini - timeout: 120 - input_cost_per_token: 0.00000075 - output_cost_per_token: 0.0000045 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - # --- gpt-5.4-nano (community agents — cheapest Codex model) --- - model_name: gpt-5.4-nano litellm_params: - model: chatgpt/responses/gpt-5.4-nano - timeout: 120 - input_cost_per_token: 0.0000002 - output_cost_per_token: 0.00000125 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - model_name: openai-codex/gpt-5.4-nano litellm_params: - model: chatgpt/responses/gpt-5.4-nano - timeout: 120 - input_cost_per_token: 0.0000002 - output_cost_per_token: 0.00000125 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - # Aliases for Codex CLI default model names in openai mode - # When acpx_run spawns with auth_mode=openai, the CLI may send these model names - model_name: codex-mini-latest litellm_params: - model: chatgpt/responses/gpt-5.4-mini - input_cost_per_token: 0.00000075 - output_cost_per_token: 0.0000045 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - model_name: o4-mini litellm_params: - model: chatgpt/responses/gpt-5.4-mini - input_cost_per_token: 0.00000075 - output_cost_per_token: 0.0000045 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY - # --- Codex CLI native /responses path (cloud-codex / Cody, wire_api="responses") --- - # Unlike the chat-path aliases above, the codex CLI hits LiteLLM's /v1/responses - # endpoint directly. There the chatgpt provider's get_complete_url already targets - # /responses, so the `responses/` prefix is redundant AND breaks: it gets sent - # literally to OpenAI as `responses/gpt-5.4` -> 400 "model not supported". These - # aliases map to plain `chatgpt/gpt-5.4*` (NO prefix) so /v1/responses sends the - # bare model name. Verified end-to-end via litellm.aresponses: real codex (served= - # gpt-5.4 / gpt-5.4-mini-2026-03-17). Do NOT point chat-path (/chat/completions) - # callers here — plain chatgpt/gpt-5.4* on the chat path hits the Cloudflare- - # challenged /backend-api/codex/chat/completions (see the chat-path note above). - model_name: codex-cli/gpt-5.4 litellm_params: - model: chatgpt/gpt-5.4 - timeout: 120 - input_cost_per_token: 0.0000025 - output_cost_per_token: 0.000015 + model: deepseek/deepseek-v4-flash + api_key: os.environ/DEEPSEEK_API_KEY # --- OpenAI (optional, for embeddings) --- - model_name: text-embedding-3-large @@ -249,26 +203,27 @@ data: # (writes /chatgpt-auth/rotate-now → sidecar polls and swaps auth.json). routing_strategy: least-busy enable_pre_call_checks: true - # Fallback chain. The Codex entries below predate the 2026-10-15 probe and - # point at nemotron, which is itself dead now (the gateway they served is - # parked). Read the dead-route note at the end of the list. + # Fallback chain. Under D111 (2026-10-27) the gpt-5.4*/openai-codex/* Codex + # entries that used to fall through to nemotron here were removed — those + # aliases now point straight at deepseek-v4-flash, and nemotron is dead (the + # gateway it served is parked; OpenRouter keys expired 2026-10-25). The only + # fallback entries below are inbound gemini/nemotron alias names that callers + # still request; they fall through to deepseek-v4-flash. + # Earlier removals from this chain: # - Gemini removed 2026-05-03: GEMINI_API_KEY belongs to a project that # doesn't have generativelanguage.googleapis.com enabled (403). Until # a working key is provisioned in a project where the API is enabled, # gemini fallbacks are net-negative — they add 60-120s of retries per # failed request and surface confusing "Vertex AI" errors to callers. # - Trinity removed 2026-05-03: 404 No endpoints found at OpenRouter. - # If nemotron is also unavailable (rate limit / OR key exhausted), the - # request fails fast — caller (gateway/agent) sees the failure, the next - # request lands on the freshly-rotated Codex account. + # If deepseek-v4-flash itself is unavailable the request fails fast — the + # caller (gateway/agent) sees the failure and the "LiteLLM is failing its + # callers" alert fires (docs/runbooks/alerting.md#litellm-failing). There is + # no nemotron or Codex tier behind it any more. fallbacks: - - {"gpt-5.4": ["openrouter/nvidia/nemotron-3-super-120b-a12b:free"]} - - {"openai-codex/gpt-5.4": ["openrouter/nvidia/nemotron-3-super-120b-a12b:free"]} - - {"gpt-5.4-mini": ["openrouter/nvidia/nemotron-3-super-120b-a12b:free"]} - - {"openai-codex/gpt-5.4-mini": ["openrouter/nvidia/nemotron-3-super-120b-a12b:free"]} - - {"gpt-5.4-nano": ["openrouter/nvidia/nemotron-3-super-120b-a12b:free"]} - - {"openai-codex/gpt-5.4-nano": ["openrouter/nvidia/nemotron-3-super-120b-a12b:free"]} - - {"codex-cli/gpt-5.4": ["openrouter/nvidia/nemotron-3-super-120b-a12b:free"]} + # D111 (2026-10-27): gpt-5.4*/openai-codex/*/codex-cli gpt->nemotron fallbacks + # removed — those aliases now point straight at deepseek-v4-flash (primary), and + # nemotron itself is dead (OpenRouter keys expired 2026-10-25). # Dead routes fall back to deepseek-v4-flash (2026-10-15). Probing every # chat route from the backend pod found exactly two answering: # deepseek-v4-flash and the since-removed Workers AI route. Every Gemini name 401s @@ -286,11 +241,11 @@ data: - {"google/gemini-2.0-flash": ["deepseek-v4-flash"]} - {"openrouter/nvidia/nemotron-3-super-120b-a12b:free": ["deepseek-v4-flash"]} - {"nvidia/nemotron-3-super-120b-a12b:free": ["deepseek-v4-flash"]} - # One retry on rate-limit, with a deliberate 1s delay so the 429 callback - # has time to rotate auth.json before the retry reads it. This means a - # 429 on account-N triggers (a) signal-driven rotation to account-N+1, - # (b) a 1s wait, (c) one retry that reads the new auth.json. If the - # retry also 429s, falls to nemotron fallback. + # One retry on rate-limit with a deliberate 1s delay. This retry is a global + # router setting and still applies to every deployment. The Codex auth.json + # rotation it was originally written for is dormant post-D111 (no chatgpt/* + # route consumes the rotator now); for the repointed aliases a 429 simply + # retries the same deepseek-v4-flash deployment after 1s, then fails fast. # # Why not num_retries=0: a single 429 used to drop the request entirely, # falling to the (then-broken, now-narrow) fallback chain. Same-prompt