LiteLLM Codex Agno and Pydantic AI Harden Production Agent Control Planes

September 1 is not a frontier-model day. It is a control-plane day. The drops that shipped in the last 24 hours sit where production teams actually burn money and lose sleep: gateways, coding agents, knowledge ingestion, and typed agent runtimes. LiteLLM’s v1.99.0 stable is the loudest of those — Admin UI on React 19 with a real dark mode, OAuth login that stores refresh tokens in the OS keychain and can configure Claude Code in one pass, and batch accounting that finally treats cancelled or failed jobs as billable when they still produced output. Beside it, Codex CLI 0.152.0 tightens the terminal coding loop: search inside drafts, name MCP servers the way package registries already do, and stop letting a noisy tool dump unbounded tokens into the transcript.

The agent-framework layer moved in the same window. Agno 3.0.5 is a honesty patch for RAG: incomplete embeddings used to look “completed.” They no longer do. Pydantic AI 2.37.0 is quieter but equally practical — provider quirks and durable backends that used to blow up traces now fail in typed, catchable ways. None of this is a keynote. All of it is the difference between a demo that “worked once” and a stack you can leave running over a long weekend.

Top Stories

Codex CLI 0.152.0 adds vim search, MCP output token limits, and actionable rate-limit banners Practical dev impact: If you live in the Codex TUI, this is the upgrade that stops MCP dumps from eating the context window and lets you jump the rate-limit wall without leaving the terminal. Version 0.152.0 (GitHub tag `rust-v0.152.0`, npm `@openai/codex@0.152.0`) adds `/` and `?` search in vim-mode drafts with `n`/`N` repeat, rate-limit banners that deep-link into usage, credits, resets, and plans, and credential-refresh progress including Amazon Bedrock reauth. MCP server names may contain `:`, `@`, `/`, and `.`. Individual MCP tools take an `output_token_limit`, truncated consistently across session resumes. App-server clients can set thread/shellCommand timeouts past one hour. Planning is off by default (`tools.update_plan.enabled = true` to restore it). Cloud task requests now reject untrusted backend URLs.

Agno v3.0.5 surfaces embedding failures and adds a partial knowledge status Practical dev impact: If your agents search a knowledge base that “ingested fine,” re-run ingest after this upgrade — some of those documents were always incomplete. v3.0.5 is a breaking honesty release: ingestion reports embedding failures instead of success; `ContentStatus` gains `partial` (`processing` / `completed` / `partial` / `failed`); embedders raise `EmbeddingError` instead of returning an empty vector; Bedrock embedding failures are `EmbeddingError`, not `ModelProviderError`; `GET /knowledge/content/{id}/status` returns 404 for missing or non-owned content; `skip_if_exists=True` no longer skips failed or partial rows. Optional retries are off by default: `Knowledge(max_embedding_retries=3, embedding_retry_backoff=1.0)`. Re-ingest now embeds before delete, so a failed rewrite cannot wipe searchable chunks. `MCPTools` accepts static `headers=` on the URL path for Streamable HTTP and SSE.

Pydantic AI v2.37.0 hardens Z.AI catalog support and durable agent backends Practical dev impact: Typed-agent shops on Google Vertex, Z.AI, Temporal, DBOS, or Prefect should bump now — several “it worked in the playground” failure modes are fixed in the runtime, not in your prompt. Tagged v2.37.0 (2026-08-31, published to PyPI around Sep 1), the release adds Z.AI catalog coverage, maps Z.AI’s non-standard `finish_reason` values, routes Vertex vs Gemini by client transport instead of provider name, emits AG-UI `TEXT_MESSAGE_START` for the assistant message that owns tool calls, skips inactive capability hooks in agent tracebacks, and context-manages models rebuilt inside durable operations. Per-run `capabilities=` is rejected on DBOS (matching Temporal). Prefect tool discovery is journaled in tasks. Unmanaged models are no longer rebuilt inside durable capability operations.

Practical Impact Analysis

Codex 0.152.0 is a local-loop upgrade. `output_token_limit` on MCP tools is the feature to turn on first if you attach GitHub, browsers, or log dumpers; unbounded tool output is still the fastest way to blow a coding-agent context. Package-style MCP names reduce the glue you write around scoped registries. Rate-limit banners with actions matter once you are on usage-based coding seats.

Agno’s ingest change will look like a regression in dashboards. It is not. Content that flipped from `completed` to `partial` or `failed` was never fully in the index. Catch `EmbeddingError` at the embedder boundary, enable retries only where the failure is transient (auth failures correctly ignore retry), and stop treating `skip_if_exists` as a correctness guarantee.

Pydantic AI 2.37.0 is the “durable agents don’t lie about their model object” patch. If you fork models inside Temporal/DBOS/Prefect, unmanaged rebuilds and capability flags were a class of heisenbug. Vertex-vs-Gemini routing by transport also kills a common mis-route when the provider string and the actual client disagree.

Tutorial

1. Pull the signed gateway image (or `pip install ‘litellm[proxy]==1.99.0’` if you run the Python process). 2. Verify the image with the pinned cosign key from the v1.99.0 release. 3. Run a minimal proxy with a virtual key and at least one Claude-compatible deployment. 4. From a developer laptop: `lite login –config-claude`, then confirm Claude Code is aimed at the proxy.

# 1) Verify the v1.99.0 image (pinned public key from the LiteLLM release notes)
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

# 2) Minimal config — save as litellm_config.yaml
cat > litellm_config.yaml <<'EOF'
model_list:
  - model_name: claude-sonnet-5
    litellm_params:
      model: anthropic/claude-sonnet-5
      api_key: os.environ/ANTHROPIC_API_KEY
general_settings:
  master_key: os.environ/LITELLM_MASTER_KEY
EOF

... click "Show full code" below to expand

# 1) Verify the v1.99.0 image (pinned public key from the LiteLLM release notes)
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

# 2) Minimal config — save as litellm_config.yaml
cat > litellm_config.yaml <<'EOF'
model_list:
  - model_name: claude-sonnet-5
    litellm_params:
      model: anthropic/claude-sonnet-5
      api_key: os.environ/ANTHROPIC_API_KEY
general_settings:
  master_key: os.environ/LITELLM_MASTER_KEY
EOF

# 3) Run the proxy
docker run --rm -p 4000:4000 \
  -e ANTHROPIC_API_KEY \
  -e LITELLM_MASTER_KEY \
  -v "$(pwd)/litellm_config.yaml:/app/config.yaml" \
  ghcr.io/berriai/litellm:v1.99.0 \
  --config /app/config.yaml

# 4) On the laptop: PKCE login, store refresh token in the OS keychain, wire Claude Code
lite login --config-claude

# 5) Point Claude Code at the gateway (virtual key, not the raw Anthropic secret)
export ANTHROPIC_BASE_URL="http://127.0.0.1:4000"
export ANTHROPIC_API_KEY="sk-litellm-virtual-key"

After login, issue one Claude Code turn and confirm the request appears in the LiteLLM spend logs under that virtual key. If you run batches through the same proxy, cancelled jobs that still wrote an output file should now show cost instead of a silent zero — that is the v1.99.0 billing contract, not a dashboard bug.

Grok Deep Dive