From 423cbaaa0f76b71e020247cebae202dda0580db6 Mon Sep 17 00:00:00 2001
From: biersoeckli <meow@biersoeckli.ch>
Date: Wed, 11 Nov 2026 09:32:06 +0000
Subject: [PATCH] fix: allow deploy when legacy LiteLLM key is missing

---
 src/server/services/agent-runtime.service.ts   | 16 ++++++++++------
 .../agent-runtime.service.unit.spec.ts         | 18 ++++++++++++++++++
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/src/server/services/agent-runtime.service.ts b/src/server/services/agent-runtime.service.ts
index b5bdfc57..08809741 100644
--- a/src/server/services/agent-runtime.service.ts
+++ b/src/server/services/agent-runtime.service.ts
@@ -254,12 +254,16 @@ class AgentRuntimeService {
         const existingSecret = await secretService.getDecodedSecret(secretName, namespace);
 
         if (existingSecret?.QS_VIRTUAL_KEY && agent.llmGateway?.encryptedAdminKey) {
-            const adminKey = CryptoUtils.decrypt(agent.llmGateway.encryptedAdminKey);
-            await liteLlmApiAdapter.deleteVirtualKey(
-                agent.llmGateway.baseUrl,
-                adminKey,
-                existingSecret.QS_VIRTUAL_KEY,
-            );
+            try {
+                const adminKey = CryptoUtils.decrypt(agent.llmGateway.encryptedAdminKey);
+                await liteLlmApiAdapter.deleteVirtualKey(
+                    agent.llmGateway.baseUrl,
+                    adminKey,
+                    existingSecret.QS_VIRTUAL_KEY,
+                );
+            } catch (error) {
+                console.warn(`Failed to delete legacy LiteLLM virtual key during Agent deploy (agentId=${agentId}):`, error);
+            }
         }
 
         await secretService.deleteSecretSafe(secretName, namespace);
diff --git a/src/server/services/agent-runtime.service.unit.spec.ts b/src/server/services/agent-runtime.service.unit.spec.ts
index eff19519..c7423ba1 100644
--- a/src/server/services/agent-runtime.service.unit.spec.ts
+++ b/src/server/services/agent-runtime.service.unit.spec.ts
@@ -158,6 +158,24 @@ describe('agent-runtime.service', () => {
         vi.mocked(liteLlmApiAdapter.listVirtualKeysByUserId).mockResolvedValue([]);
     });
 
+    describe('refreshRuntimeSecret', () => {
+        it('refreshes the secret when the legacy key was already deleted in LiteLLM', async () => {
+            vi.mocked(dataAccess.client.agent.findUnique).mockResolvedValue(mockAgent() as any);
+            vi.mocked(secretService.getDecodedSecret).mockResolvedValue({ QS_VIRTUAL_KEY: 'old-key' });
+            vi.mocked(liteLlmApiAdapter.deleteVirtualKey).mockRejectedValue(new ServiceException('LiteLLM request failed with status 404: No keys found'));
+            const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+            await agentRuntimeService.refreshRuntimeSecret(AGENT_ID);
+
+            expect(secretService.deleteSecretSafe).toHaveBeenCalledWith(KubeObjectNameUtils.toSecretId(AGENT_ID), PROJECT.id);
+            expect(secretService.createOrReplaceGenericSecret).toHaveBeenCalledWith(
+                KubeObjectNameUtils.toSecretId(AGENT_ID), PROJECT.id,
+                { QS_GATEWAY_URL: GATEWAY.baseUrl, MY_KEY: 'my-secret' },
+            );
+            warn.mockRestore();
+        });
+    });
+
     describe('startSandbox', () => {
         it('starts Git source agents after the sandbox template has been deployed', async () => {
             vi.mocked(dataAccess.client.agent.findUnique).mockResolvedValue(mockAgent({ sourceType: 'GIT' }) as any);