Security: auth on trace endpoints, pin litellm, sanitize errors

Trace list and replay require admin token. Pin litellm to d251238.
Generic error messages to client, full details logged server-side.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app.py

@@ -559,11 +559,14 @@ def build_app() -> gr.Blocks:
         doc_btn = gr.Button(visible=False)
         doc_btn.click(api_get_doc, inputs=doc_input, outputs=doc_output, api_name="doc")
 
-        # Trace list endpoint
-        traces_input = gr.Textbox(visible=False)
+        # Trace list endpoint (admin-only)
+        traces_token_input = gr.Textbox(visible=False)
+        traces_query_input = gr.Textbox(visible=False)
         traces_output = gr.Textbox(visible=False)
 
-        def api_list_traces(query):
+        def api_list_traces(token, query):
+            if not ADMIN_TOKEN or not hmac.compare_digest(token, ADMIN_TOKEN):
+                return json.dumps({"error": "unauthorized"})
             if not hf_api or not HF_TRACES_REPO:
                 return json.dumps({"error": "traces not configured"})
             try:
@@ -580,13 +583,16 @@ def build_app() -> gr.Blocks:
                 return json.dumps({"error": str(exc)})
 
         traces_btn = gr.Button(visible=False)
-        traces_btn.click(api_list_traces, inputs=traces_input, outputs=traces_output, api_name="traces")
+        traces_btn.click(api_list_traces, inputs=[traces_token_input, traces_query_input], outputs=traces_output, api_name="traces")
 
-        # Trace replay endpoint
-        replay_input = gr.Textbox(visible=False)
+        # Trace replay endpoint (admin-only)
+        replay_token_input = gr.Textbox(visible=False)
+        replay_filename_input = gr.Textbox(visible=False)
         replay_output = gr.Textbox(visible=False)
 
-        def api_get_trace(filename):
+        def api_get_trace(token, filename):
+            if not ADMIN_TOKEN or not hmac.compare_digest(token, ADMIN_TOKEN):
+                return json.dumps({"error": "unauthorized"})
             if not hf_api or not HF_TRACES_REPO or not filename:
                 return json.dumps({"error": "not found"})
             safe_name = Path(filename).name
@@ -612,7 +618,7 @@ def build_app() -> gr.Blocks:
                 return json.dumps({"error": str(exc)})
 
         replay_btn = gr.Button(visible=False)
-        replay_btn.click(api_get_trace, inputs=replay_input, outputs=replay_output, api_name="replay")
+        replay_btn.click(api_get_trace, inputs=[replay_token_input, replay_filename_input], outputs=replay_output, api_name="replay")
 
     return demo
 
@@ -655,7 +661,8 @@ def stream_question(question: str) -> Generator[str, None, None]:
                 tool_call_count += 1
                 yield json.dumps({"type": "tool_call", "count": tool_call_count, "name": event.name})
     except Exception as exc:
-        yield json.dumps({"type": "error", "error": str(exc)})
+        print(f"ERROR in stream_question: {exc}")
+        yield json.dumps({"type": "error", "error": "An error occurred during processing."})
         return
 
     trace = agent_run.trace

requirements.txt

@@ -1,5 +1,5 @@
 click>=8.1
-litellm @ git+https://github.com/BerriAI/litellm.git
+litellm @ git+https://github.com/BerriAI/litellm.git@d251238
 a-simple-llm-harness @ git+https://github.com/chuckfinca/a-simple-llm-harness.git@25e7e15
 e2b-code-interpreter>=2.5
 huggingface-hub