feat(backend): remote LLM catalog sync for self-hosted installs

[ntindle]

Why

Part 5 of 9 of the LLM registry restack (#13605 → #13606 → #13607 → #13608 → this). This is the piece that makes the registry strictly better than the enum for self-hosted users: new models and remote disables arrive within a day, no git pull required.

What

backend/data/llm_registry/sync.py — a lifespan background loop that fetches the cloud catalog on startup and every 24h, validates it, and feeds it to the part-3 importer with source=REMOTE:

• Cloud never fetches from itself: gated on behave_as == LOCAL (not app_env — self-hosted installs also run app_env=local; behave_as is what encodes "our cloud")
• Validation before any write: pydantic schema + 2MiB size cap + the importer's schema_version check; a hostile or malformed payload is rejected wholesale, last-known-good stays
• Fetch hygiene: util.request.Requests (SSRF guard, retries), catalog host in trusted_origins so pointing LLM_CATALOG_URL at an internal mirror works, 15s timeout
• Ops: loop never dies (every attempt wrapped + recorded on LlmCatalogState.lastRemoteSyncAt/lastRemoteSuccessAt); single-key Redis NX lock dedups multi-pod installs; startup never blocks on the network (background task)
• Runs in the rest_api lifespan, not the scheduler — that process is Prisma-less and this only matters on self-hosted single-pod installs anyway

Config (mirrored in .env.default): LLM_CATALOG_SYNC_ENABLED=true, LLM_CATALOG_URL=https://backend.agpt.co/api/llm/catalog, LLM_CATALOG_SYNC_INTERVAL_HOURS=24.

Verification

• 10 new tests: behave_as/flag gating, fetch→validate→import flow with payload + source_url assertions, oversized and malformed payloads rejected before import, loop survival on fetch failure, success/failure attempt recording, lock-held skip, disabled-loop immediate return; plus registry suite regression green
• poetry run format + poetry run lint clean

Checklist

• Outbound fetch reviewed: SSRF-guarded helper, validated-before-write, size-capped, fail-soft
• Out-of-scope changes: none

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1e088b45-1aef-4150-82e9-9b828e411cec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/llm-registry-v2-sync

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.02%. Comparing base (dcf5080) to head (e4690ea).

Additional details and impacted files

@@                       Coverage Diff                        @@
##           feat/llm-registry-v2-public-api   #13609   +/-   ##
================================================================
  Coverage                            76.02%   76.02%           
================================================================
  Files                                 2688     2688           
  Lines                               204279   204281    +2     
  Branches                             19654    19655    +1     
================================================================
+ Hits                                155303   155312    +9     
+ Misses                               44693    44630   -63     
- Partials                              4283     4339   +56     

Flag	Coverage Δ
platform-frontend-e2e	31.27% <ø> (+0.25%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Platform Backend	82.83% <ø> (ø)
Platform Frontend	50.06% <ø> (+0.02%)	⬆️
AutoGPT Libs	∅ <ø> (∅)
Classic AutoGPT	28.43% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ntindle]

After a post-build design review we pivoted from the DB-registry to catalog-as-code: one canonical, schema-validated catalog file is the source of truth (models + costs + copilot routing), updated by PR (catalog-only diffs may ride hotfix→master; the /review bot covers the lane), propagated by CD, with LaunchDarkly demoted to optional cohort experiments and git history as the audit log. Rationale: the admin machinery mostly bought instant-mutation and non-engineer authoring we don't need, and LD is too unreliable to be the load-bearing control layer.

No replacement by design — CD propagates the catalog at deploy; self-hosted installs get it on upgrade. A raw-GitHub fetch remains an easy add if between-release freshness is ever wanted.