DRAFT: Decouple LiteLLM extra-headers from Custom LLM via router_settings (alternative to #669)

replicated/config.yaml

@@ -962,23 +962,22 @@ spec:
         - name: litellm_forward_client_headers
           title: Enable Forwarding Client Headers Through LiteLLM to LLM Providers
           help_text: >-
-            Forward selected headers from each client request through LiteLLM to upstream LLM providers. When enabled, LiteLLM forwards the anthropic-beta header and client x-* headers, except x-stainless-* headers. It does not forward Authorization or non-x-* gateway headers such as Ocp-Apim-Subscription-Key. Leave disabled unless you need provider-visible client headers. Use Custom LLM Extra HTTP Headers for static gateway auth or routing headers.
+            Forward selected headers from each client request through LiteLLM to upstream LLM providers. When enabled, LiteLLM forwards the anthropic-beta header and client x-* headers, except x-stainless-* headers. It does not forward Authorization or non-x-* gateway headers such as Ocp-Apim-Subscription-Key. Leave disabled unless you need provider-visible client headers. Use Extra Upstream HTTP Headers for static gateway auth or routing headers.
           type: bool
           default: "0"
-        - name: custom_llm_extra_headers_enabled
-          title: Enable Custom LLM Extra HTTP Headers (JSON)
+        - name: extra_request_headers_enabled
+          title: Enable Extra Upstream HTTP Headers (JSON)
           help_text: >-
-            Show a JSON field for static headers that the bundled OpenHands LiteLLM Proxy sends on every request to the custom upstream gateway for all users in this deployment. NOTE: This is intended as temporary installer-level configuration until organization-level header settings are available in OpenHands. Use only if your upstream LLM gateway requires static auth or routing headers that cannot be expressed via the standard Authorization bearer header.
+            Show a JSON field for static headers that the bundled OpenHands LiteLLM Proxy sends on every outbound request to the upstream LLM provider for all users in this deployment. Provider-managed headers such as Authorization or x-api-key are constructed by LiteLLM and cannot be overridden here. NOTE: This is intended as temporary installer-level configuration until organization-level header settings are available in OpenHands. Use only if your upstream LLM gateway requires static auth or routing headers that cannot be expressed via the provider's standard authentication.
           type: bool
           default: "0"
-          when: 'repl{{ ConfigOptionEquals "llm_provider" "custom" }}'
-        - name: custom_llm_extra_headers
-          title: Custom LLM Extra HTTP Headers (JSON)
+        - name: extra_request_headers
+          title: Extra Upstream HTTP Headers (JSON)
           help_text: >-
             Format: JSON object mapping header names to values. Example: {"Ocp-Apim-Subscription-Key": "abc123", "X-Tenant-Id": "prod"}
           type: textarea
           default: ""
-          when: 'repl{{ and (ConfigOptionEquals "llm_provider" "custom") (ConfigOptionEquals "custom_llm_extra_headers_enabled" "1") }}'
+          when: 'repl{{ ConfigOptionEquals "extra_request_headers_enabled" "1" }}'
           required: false
           validation:
             regex:

replicated/openhands.yaml

@@ -189,6 +189,16 @@ spec:
           OR_SITE_URL: "https://docs.all-hands.dev"
         general_settings:
           forward_client_headers_to_llm_api: repl{{ ConfigOptionEquals "litellm_forward_client_headers" "1" }}
+        # STOPGAP — to be replaced by an org-level setting in the OpenHands
+        # application. Renders the JSON from the "Extra Upstream HTTP Headers"
+        # advanced option into LiteLLM Router's default_litellm_params, so the
+        # headers are merged onto every outbound call regardless of which
+        # provider/model is selected. `mustFromJson | mustToJson` validates
+        # the input and normalises whitespace; an empty/disabled value renders
+        # as `{}` and is a no-op.
+        router_settings:
+          default_litellm_params:
+            extra_headers: repl{{ if ConfigOptionEquals "extra_request_headers_enabled" "1" }}repl{{ ConfigOption "extra_request_headers" | trim | default "{}" | mustFromJson | mustToJson }}repl{{ else }}{}repl{{ end }}
         model_list:
           # Keep this alias available through the proxy for
           # openhands/claude-opus-4-7 (retained for backward compatibility
@@ -682,7 +692,6 @@ spec:
                   model: 'openai/{{repl ConfigOption "custom_model"}}'
                   api_key: os.environ/CUSTOM_API_KEY
                   api_base: os.environ/CUSTOM_API_BASE
-                  extra_headers: repl{{ if ConfigOptionEquals "custom_llm_extra_headers_enabled" "1" }}repl{{ ConfigOption "custom_llm_extra_headers" | trim | default "{}" | mustFromJson | mustToJson }}repl{{ else }}{}repl{{ end }}
 
     - when: '{{repl ConfigOptionEquals "google_api_type" "vertex" }}'
       recursiveMerge: true