fix(agents): custom model provider routing

[jordan-umusu]

Summary by cubic

Fixes custom model provider routing with a passthrough mode and always proxies LLM traffic through the local bridge. Drops the "openai/" prefix for custom providers in both runtime routing and credential injection for correct upstream routing.

• Refactors

  • Replaced litellm with custom-model-provider + passthrough on AgentConfig and SandboxAgentConfig (propagated through workflow schemas/payloads).
  • Added resolve_custom_model_provider_config_activity to load base_url, optional model_name, and passthrough from workspace credentials; applied in the durable workflow and management service.
  • Updated LLMSocketProxy: renamed litellm_url to upstream_url, added passthrough that strips Authorization and Anthropic-only fields before forwarding; proxy now always starts.
  • Removed openai/ prefix for custom-model-provider (runtime no longer maps to "openai"; gateway injects the raw model name).
  • Secrets API now returns aggregated registry definitions (sorted) and adds litellm with optional LITELLM_BASE_URL; frontend copy updated to reflect “aggregated” definitions.

• Migration

  • Replace any litellm provider usage with custom-model-provider.
  • Configure workspace credentials: CUSTOM_MODEL_PROVIDER_BASE_URL (required), optional CUSTOM_MODEL_PROVIDER_MODEL_NAME, and CUSTOM_MODEL_PROVIDER_PASSTHROUGH=true to forward directly to your upstream.
  • No app config changes needed for the bridge; the LLM socket proxy and bridge start automatically.

^{Written for commit a4388c9. Summary will update on new commits.}

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to a4388c9.

Security Overview

• 🔎 Scanned files: 3 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=0a86a738-9369-4f75-8016-d5d4ffd0031e&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Refactor	► tests/unit/test_agent_runtime.py     Update expected model name for custom-model-provider in test data ► tracecat/agent/gateway.py     Remove "openai/" prefix from custom model names ► tracecat/agent/runtime/claude_code/runtime.py     Remove "custom-model-provider": "openai" mapping

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.