Add environment variable expansion to llmconfig.yml api_key and extra_headers

[Copilot]

LLM configurations currently use os.path.expandvars() for api_key expansion, which silently returns unexpanded strings when environment variables are missing. This differs from MCP server auth_token handling, which uses resolve_env_var() to provide explicit error messages.

Changes

Unified environment variable expansion:

• Replace os.path.expandvars() with resolve_env_var() in litellm_caller.py and cli.py
• Raises ValueError with clear message when required environment variables are unset
• Add environment variable expansion support to extra_headers field

Example usage:

models:
  openrouter-llama:
    model_url: "https://openrouter.ai/api/v1"
    model_name: "meta-llama/llama-3-70b-instruct"
    api_key: "${OPENROUTER_API_KEY}"
    extra_headers:
      HTTP-Referer: "${OPENROUTER_SITE_URL}"
      X-Title: "${OPENROUTER_SITE_NAME}"

Test coverage:

• 6 unit tests in test_config_manager.py for ModelConfig validation
• 6 integration tests in test_llm_env_expansion.py for LiteLLMCaller behavior
• Tests verify env var expansion, literal values, missing variables, and extra_headers

Original prompt

---

This section details on the original issue you should resolve

<issue_title>allow custom api key expansion in llmconfig.yml</issue_title>
<issue_description>similar to the custom key in the mcp.json</issue_description>

Comments on the Issue (you are @copilot in this section)

@garland3 Similar to how the mcp.json can read an env var for the key. re-use code when possible.

• Fixes allow custom api key expansion in llmconfig.yml #67

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[Copilot]

Pull Request Overview

This PR unifies environment variable expansion for LLM configurations by replacing os.path.expandvars() with resolve_env_var(), aligning the implementation with MCP server authentication handling. The change provides explicit error messages when required environment variables are unset and extends environment variable expansion support to the extra_headers field in LLM model configurations.

Key changes:

• Replace silent os.path.expandvars() with resolve_env_var() that raises clear errors for missing variables
• Add environment variable expansion to extra_headers dictionary values
• Remove unused CLI module (backend/modules/llm/cli.py)

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
backend/modules/llm/litellm_caller.py	Implements resolve_env_var() for api_key and extra_headers with proper error handling
backend/modules/llm/cli.py	Entire file deleted (323 lines) - CLI module removed
backend/tests/test_llm_env_expansion.py	Adds 6 integration tests covering env var expansion for api_key and extra_headers
backend/tests/test_config_manager.py	Adds 6 unit tests validating ModelConfig with environment variables
docs/02_admin_guide.md	Extensive documentation update (86 new lines) covering env var expansion patterns, security best practices, and examples

[Copilot]

The phrase 'The second example' is ambiguous since both configuration examples in lines 386-403 are OpenRouter configurations with environment variables. Consider replacing with 'The OpenRouter example above' or 'This example' to be more precise.

Suggested change

	**Note**: The second example demonstrates environment variable expansion in `extra_headers`, which is useful for services like OpenRouter that require site identification headers.
	**Note**: The OpenRouter example above demonstrates environment variable expansion in `extra_headers`, which is useful for services like OpenRouter that require site identification headers.

[Copilot]

The documentation claims the behavior is 'identical' to MCP server auth_token, but doesn't mention the key limitation that resolve_env_var() only supports exact ${VAR} patterns at the beginning of strings (using re.match()), not partial substitution like 'prefix-${VAR}-suffix'. Consider adding a note about this limitation or clarifying that only full-value environment variable substitution is supported.

Suggested change

	> **Limitation:** Only full-value environment variable substitution is supported. The value must be exactly in the form `"${VAR_NAME}"` (with nothing else before or after). Partial substitution, such as `"prefix-${VAR}-suffix"`, is **not** supported and will not be expanded. This applies to all fields that support environment variable expansion, including `api_key`, `auth_token`, and custom headers.

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls

[github-actions]

🔒 Security Scan Results

Security Scan Summary

Scan Results

Python SAST (Bandit)

⚠️ Security issues found in Python code

Recommendations

• Review all SARIF files uploaded to GitHub Security tab
• Address high and critical severity vulnerabilities immediately
• Run npm audit fix and pip-audit locally to fix dependencies
• Consider implementing additional security controls