chore(release): patch v1.89.0-rc.2 with batch-file auth, CrowdStrike AIDR, Mantle SigV4, NetApp streaming-cost fix, and team-scoped Datadog toward v1.89.0-rc.3

[mateo-berri]

Relevant issues

Adds the next batch of fixes to the patch/v1.89.0-rc.1 line (on top of the v1.89.0-rc.2 content) so it can be tagged v1.89.0-rc.3:

• fix(proxy): authorize batch files using upload target_model_names (LIT-3593) #30009 — fix(proxy): authorize batch files using upload target_model_names (LIT-3593), cherry-picked from staging 2cd7e87485
• CrowdStrike AIDR identity capture (feat(guardrails): capture user and model metadata in CrowdStrike AIDR #29517 feature, picked from stable/1.84.x — the rc line predates it) + fix(guardrails): read CrowdStrike AIDR identity from both metadata bags #29991 follow-up fix reading identity from both metadata bags (staging squash 1bbaf1c39d)
• feat(bedrock_mantle): add SigV4/IAM auth to Responses API route (fixes #29665) #29788 — feat(bedrock_mantle): add SigV4/IAM auth to the Responses API route; applied as the exact squash diff of the PR head since it landed upstream only inside the squashed litellm_oss_staging_080626 sync (32c88ca74f). The rc line already carries the prerequisite feat(bedrock_mantle): add Responses API support (/openai/v1/responses) #29490 Responses route via the 040626 sync
• fix: completion_cost AttributeError on streaming Anthropic web_search responses (#26153) #27346 — fix: completion_cost AttributeError on streaming Anthropic web_search responses ([Bug]: completion_cost() raises AttributeError on streaming Anthropic responses with web_search in v1.83.10 #26153), cherry-picked from staging squash 4a3860df1f
• feat(datadog): add team-scoped Datadog callback support #29947 — feat(datadog): add team-scoped Datadog callback support, cherry-picked from the single-commit PR head 9c049daa1b

No version bump: the 1.89 line keeps pyproject.toml at 1.89.0 and the rc number is a git tag, matching rc.2 (#30143).

Conflict resolutions / branch adaptations

• CrowdStrike feature pick: same two conflicts as the stable backports (chore(release): backport Fable 5, batch-file auth, CrowdStrike AIDR, and Mantle Responses SigV4 to stable/1.87.x and cut 1.87.2 #30146/chore(release): backport Fable 5, batch-file auth, CrowdStrike AIDR, Mantle Responses SigV4, and NetApp streaming-cost fix to stable/1.88.x and cut 1.88.2 #30144) — kept this line's imports and guard_input.model_dump(mode="json"), adopted the dict[str, Any] annotation; appended the three feature tests and fix(guardrails): read CrowdStrike AIDR identity from both metadata bags #29991's parametrized test to this line's test-file tail (parametrized block black-formatted; upstream carries >88-col lines there)
• fix(proxy): authorize batch files using upload target_model_names (LIT-3593) #30009 / feat(bedrock_mantle): add SigV4/IAM auth to Responses API route (fixes #29665) #29788 / feat(datadog): add team-scoped Datadog callback support #29947: applied cleanly (all hunks)
• fix: completion_cost AttributeError on streaming Anthropic web_search responses (#26153) #27346 NetApp: the rc line, like the stable lines, predates the Usage.__init__ server_tool_use dict→ServerToolUse coercion that staging carries (it landed via the squashed OSS sync Litellm oss staging 080626 #29932 / 32c88ca74f). calculate_usage round-trips usage through Usage(**returned_usage.model_dump()), which re-serializes server_tool_use to a plain dict, so without that coercion the regression test asserting a ServerToolUse type fails. Restored the coercion in litellm/types/utils.py — it matches fix: completion_cost AttributeError on streaming Anthropic web_search responses (#26153) #27346's own first commit, dropped from the squash only because staging already had it.
• feat(datadog): add team-scoped Datadog callback support #29947 Datadog: black --check in the worktree flags pre-existing multi-line-string formatting in litellm_core_utils/litellm_logging.py (lines ~1006-1050) that is already present on the patch/v1.89.0-rc.1 base and untouched by this pick — left as-is to avoid reformatting unrelated lines.

Verified on this branch

• test_batch_file_validation.py, test_crowdstrike_aidr.py, test_bedrock_mantle_responses_transformation.py, test_llm_http_handler.py — 149 passed
• NetApp + Datadog suites (test_streaming_chunk_builder_server_tool_use.py, test_tool_call_cost_tracking_dict_safety.py, test_cost_calculation_dict_safety.py, test_streaming_chunk_builder_utils.py, test_datadog_team_handler.py) — 41 passed
• Black clean on all hand-touched files

Pre-Submission checklist

• The cherry-picked PRs carry their own tests
• Scope is limited to backporting already-merged changes

Type

🐛 Bug Fix
🆕 New Feature (backport to rc line)

---

Generated by Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 61.45833% with 37 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ardrail_hooks/crowdstrike_aidr/crowdstrike_aidr.py	4.54%	21 Missing ⚠️
litellm/llms/custom_httpx/llm_http_handler.py	62.50%	6 Missing ⚠️
litellm/litellm_core_utils/litellm_logging.py	72.72%	3 Missing ⚠️
litellm/litellm_core_utils/llm_cost_calc/utils.py	71.42%	2 Missing ⚠️
...itellm_core_utils/streaming_chunk_builder_utils.py	60.00%	2 Missing ⚠️
litellm/proxy/hooks/batch_rate_limiter.py	66.66%	2 Missing ⚠️
litellm/llms/anthropic/cost_calculation.py	80.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
5 out of 6 committers have signed the CLA.

✅ kenany
✅ Sameerlite
✅ yuneng-berri
✅ kingdoooo
✅ aanchal22
❌ ishaan-berri
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR backports four independent fixes onto the patch/v1.89.0-rc.1 branch: batch-file auth now uses upload-time target_model_names instead of a non-deterministic reverse-model-lookup (LIT-3593); CrowdStrike AIDR captures user identity from both metadata and litellm_metadata bags; Bedrock Mantle gains SigV4/IAM auth on the Responses API route; and several supporting fixes address server_tool_use dict/pydantic coercion, team-scoped Datadog credentials, and signing-order correctness in the HTTP handler.

• Batch file auth (fix(proxy): authorize batch files using upload target_model_names (LIT-3593) #30009/LIT-3593): _enforce_batch_file_model_access now accepts target_model_names from the unified file ID, bypassing the old resolve_model_name_from_model_id reverse-lookup which was non-deterministic when multiple deployments shared a provider model ID. The fallback path for non-managed files (no target_model_names) still reads model names directly from JSONL content.
• Bedrock Mantle SigV4 (feat(bedrock_mantle): add SigV4/IAM auth to Responses API route (fixes #29665) #29788): sign_request is added to BaseResponsesAPIConfig as a no-op default and overridden in BedrockMantleResponsesAPIConfig; the HTTP handler now calls it after body finalisation (including _prepare_fake_stream_request) so signed bytes always match what is sent, and the compact handler variants are also wired up.
• CrowdStrike AIDR (feat(guardrails): capture user and model metadata in CrowdStrike AIDR #29517 + fix(guardrails): read CrowdStrike AIDR identity from both metadata bags #29991): _merge_metadata_bags merges both metadata and litellm_metadata bags before extracting identity fields, and the model name and extra_info are added to the guard payload.

Confidence Score: 4/5

Safe to merge; all three feature backports include mock-based tests, the signing hook is a no-op for every existing provider, and the DD credential block list prevents user injection.

The changes are cherry-picks of already-merged staging work with their own tests. The Bedrock Mantle SigV4 path signs correctly after body finalisation and strips stale Authorization headers before handing to _sign_request. The batch-file auth fix eliminates a non-deterministic reverse-lookup in favour of upload-time target_model_names. The one open question — whether the CrowdStrike AIDR API accepts an empty "extra_info": {} object — is minor and codified in tests, so it is unlikely to be a blocker.

The crowdstrike_aidr.py change warrants a quick API-contract check around the unconditional extra_info: {} payload field when no user email is present.

Important Files Changed

Filename	Overview
litellm/llms/bedrock_mantle/responses/transformation.py	Adds SigV4/IAM auth alongside existing Bearer-token path; correctly strips stale Authorization before signing and pins the credential-scope region to the URL host via _resolve_region.
litellm/llms/base_llm/responses/transformation.py	Adds a no-op default sign_request hook so existing providers are unaffected; straightforward extension point.
litellm/llms/custom_httpx/llm_http_handler.py	Wires sign_request into all four Responses API handler variants (sync/async x create/compact) after body finalisation and fake-stream prep; replaces json=data with data=signed_body or json=data via body_kwargs.
litellm/proxy/hooks/batch_rate_limiter.py	Passes target_model_names from the unified file ID into _enforce_batch_file_model_access, removing the ambiguous resolve_model_name_from_model_id reverse-lookup that could match the wrong deployment when multiple share a provider model ID.
litellm/proxy/guardrails/guardrail_hooks/crowdstrike_aidr/crowdstrike_aidr.py	Adds _merge_metadata_bags to read identity from both metadata and litellm_metadata; injects user_id, model, and extra_info into the AIDR payload; extra_info is always set (even {}) when a metadata bag is present.
litellm/integrations/datadog/datadog_team_handler.py	New file implementing per-team DataDogLogger caching via DynamicLoggingCache, following the same pattern as LangFuseHandler; credentials keyed correctly for isolation.
litellm/integrations/datadog/datadog.py	Adds explicit dd_api_key, dd_site, dd_agent_host, dd_agent_port kwargs that take priority over env vars, enabling team-scoped credential injection.
litellm/litellm_core_utils/litellm_logging.py	Moves process_dynamic_callbacks after standard_callback_dynamic_params initialisation; adds a datadog-specific _custom_logger_init_args filter so team-scoped DD credentials are passed into _init_custom_logger_compatible_class.
litellm/litellm_core_utils/streaming_chunk_builder_utils.py	Coerces server_tool_use dict to ServerToolUse pydantic instance during chunk aggregation, fixing the AttributeError on downstream attribute access (issue #26153).
litellm/litellm_core_utils/llm_cost_calc/utils.py	Adds _get_web_search_requests helper that tolerates server_tool_use being None, dict, or pydantic instance; used across cost-calculation call sites.
litellm/litellm_core_utils/initialize_dynamic_callback_params.py	Adds dd_* params to both the supported list and the request-blocked set, preventing end-user injection of Datadog credentials via request body.
litellm/types/utils.py	Extends Usage.init to accept server_tool_use as Union[ServerToolUse, dict] and coerce dicts; adds dd_* fields to StandardCallbackDynamicParams.
tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py	Comprehensive mock-based SigV4 tests covering bearer precedence, region consistency, Authorization-header stripping, and credential-error mapping; all mock network calls.
tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py	Adds tests for the new sign_request wiring: no-op provider sends json=, signing provider sends data= bytes; fake-stream ordering test confirms stream key is absent from signed body.
tests/test_litellm/proxy/hooks/test_batch_file_validation.py	Updates existing proxy-alias test to pass target_model_names directly and asserts reverse-lookup is never called; adds parametrised multi-deployment ordering test (LIT-3593).
tests/test_litellm/proxy/guardrails/guardrail_hooks/test_crowdstrike_aidr.py	Adds four new tests covering identity capture, empty extra_info, missing metadata, and parametrised dual-bag reading; all mock-based.
tests/test_litellm/litellm_core_utils/test_streaming_chunk_builder_utils.py	Updates existing assertion from dict access to isinstance+attribute access, correctly reflecting the new ServerToolUse coercion behavior.

Comments Outside Diff (1)

1. litellm/integrations/datadog/datadog_team_handler.py, line 228-241 (link)

   _dynamic_datadog_credentials_are_passed is unused in production paths

   The method is defined and tested but is never called by the production code — the credential check happens inline in _init_custom_logger_compatible_class via if _dd_api_key or _dd_site or _dd_agent_host. If the intent is to keep it for future callers or as a utility, a short docstring clarifying that would help; otherwise it can be removed to avoid dead-code drift.

_{Reviews (1): Last reviewed commit: "feat(datadog): add team-scoped Datadog c..." | Re-trigger Greptile}

[greptile-apps]

extra_info unconditionally written when metadata bag is present

extra_info is always added to the payload (even as {}) when any metadata bag resolves, while user_id is conditionally added only when truthy. If the CrowdStrike AIDR API treats an explicit "extra_info": {} differently from an absent key (e.g., strict schema validation), this asymmetry could cause unexpected failures on requests where identity is unavailable despite metadata existing. The tests already codify this behavior, so this is a question about API contract rather than a defect — worth confirming CrowdStrike accepts an empty extra_info object.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time! Does the CrowdStrike AIDR API accept "extra_info": {} (empty object) without error, or should extra_info be omitted from the payload when there is no user email?

[greptile-apps]

The three-branch isinstance check can be replaced with a single model_validate call, which handles dict, ServerToolUse, and any other compatible object uniformly and is more future-proof if ServerToolUse gains additional fields.

Suggested change

	if isinstance(usage_chunk.server_tool_use, dict):
	server_tool_use = ServerToolUse(**usage_chunk.server_tool_use)
	elif isinstance(usage_chunk.server_tool_use, ServerToolUse):
	server_tool_use = usage_chunk.server_tool_use
	else:
	server_tool_use = ServerToolUse.model_validate(
	usage_chunk.server_tool_use
	)
	server_tool_use = ServerToolUse.model_validate(
	usage_chunk.server_tool_use
	)

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[veria-ai]

Medium: Spoofable guardrail identity

litellm_metadata is part of the request body on normal proxy calls, and _ensure_litellm_metadata() only populates it when the key is absent. Because this merge lets litellm_metadata overwrite the server-populated metadata, an authenticated caller can send litellm_metadata: {"user_api_key_user_id": "victim"} and have the AIDR payload report the request as that user; take user_id/email from the authenticated UserAPIKeyAuth data or another server-only field instead of a merged request metadata bag.

[veria-ai]

PR overview

This PR prepares the v1.89.0-rc.3 patch release with updates spanning batch-file authentication, CrowdStrike AIDR guardrail integration, Mantle SigV4 support, NetApp streaming-cost handling, and team-scoped Datadog behavior. The open code area is in the CrowdStrike AIDR guardrail hook, where request metadata is prepared for AIDR reporting.

One security issue remains open around how the CrowdStrike AIDR guardrail derives the user identity included in its outbound payload. An authenticated caller can influence request metadata so that AIDR reporting attributes their request to another user, creating a spoofing/audit-integrity risk rather than direct data access or code execution. No issues have been addressed yet, so the PR still needs a server-trusted source for user identity before this area is secure.

Open issues (1)

• Medium: Spoofable guardrail identity — litellm/proxy/guardrails/guardrail_hooks/crowdstrike_aidr/crowdstrike_aidr.py:114

Fixed/addressed: 0 · PR risk: 5/10