feat(aicore): transparent proxy routing and BTP Destination Service mode

[tiagoek]

Summary

Adds transparent proxy routing and BTP Destination Service mode to set_aicore_config() — agent code is identical in all environments; the deployer controls routing by choosing which env vars to inject.

Neither proxy mode nor destination mode requires a LiteLLM upstream change. Both work with the current public litellm package.

---

What changed

set_aicore_config() now detects the routing mode from environment variables (priority: proxy > destination > direct):

Proxy mode — AICORE_PROXY_URL set

Routes all LiteLLM calls through an external LiteLLM proxy:

• Sets litellm.api_base and litellm.api_key (proxy API key) globally
• Model strings (e.g. sap/<model>) are passed verbatim — no prefix rewrite. LiteLLM routes through the configured api_base natively
• No AI Core credentials written to the process environment
• JWT never reaches the agent process — the proxy holds the OAuth client secret

# Deployer injects these; agent code unchanged
AICORE_PROXY_URL=https://litellm-proxy.cluster.svc
AICORE_PROXY_API_KEY=sk-master-xxx

Destination mode — AICORE_DESTINATION_NAME set

Loads AI Core credentials at startup from a named BTP Destination Service destination:

• Uses the existing sap_cloud_sdk.destination client — no new dependencies
• Deployer only needs to inject Destination Service binding credentials into the K8s Secret
• AICORE_CLIENT_SECRET never needs to be in the K8s Secret — it lives in BTP Destination Service
• On AuthenticationError, the reactive reload in completion() calls set_aicore_config(), which re-fetches fresh credentials from the Destination Service

# Deployer injects these; agent code unchanged
AICORE_DESTINATION_NAME=aicore-instance
# + Destination Service service binding (clientid/clientsecret/url/uri)

Direct mode (unchanged)

Neither env var set → existing behaviour: load from mounted K8s secret or env vars.

---

Agent code — identical in all modes

# Same regardless of proxy, destination, or direct mode
set_aicore_config()
response = completion(model="sap/gpt-4o", messages=[{"role": "user", "content": "Hello"}])

---

Security coverage

Threat	Proxy mode	Destination mode	Direct mode
CLIENT_SECRET in K8s Secret	✅ not needed	✅ not needed	❌ required
CLIENT_SECRET in process env	✅ never	⚠️ present during session	⚠️ present during session
JWT in agent process memory	✅ never (proxy holds it)	❌ agent receives JWT	❌ agent receives JWT
LiteLLM upstream change required	✅ no	✅ no	✅ no
Zero agent code changes	✅	✅	✅

---

Tests

New unit tests:

• TestSetAICoreConfigProxyMode (6 tests) — mode detection, litellm globals, precedence, filtering still applied
• TestSetAICoreConfigDestinationMode (9 tests) — URL extraction, credentials, resource group, error cases

Full suite: 156 passed, 4 skipped (integration tests requiring real BTP).