fix: make LiteLLM health probe auth-aware

Allow the dashboard health check to include optional LiteLLM auth headers and treat unauthenticated 401 responses as an auth-required healthy state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/backend/config.py

@@ -46,6 +46,7 @@ CHAT_SUMMARY_DB = os.environ.get("CHAT_SUMMARY_DB", "/app/data/chat-summarizer/c
 
 # LiteLLM
 LITELLM_URL = os.environ.get("LITELLM_URL", "http://127.0.0.1:4005")
+LITELLM_HEALTH_API_KEY = os.environ.get("LITELLM_HEALTH_API_KEY", "")
 
 # OpenClaw
 OPENCLAW_GATEWAY_TOKEN = os.environ.get("OPENCLAW_GATEWAY_TOKEN", "")

dashboard/backend/routers/litellm.py

@@ -1,7 +1,7 @@
 import time
 import httpx
 from fastapi import APIRouter
-from config import LITELLM_URL
+from config import LITELLM_URL, LITELLM_HEALTH_API_KEY
 
 router = APIRouter()
 
@@ -11,14 +11,23 @@ async def litellm_health():
     timeout = httpx.Timeout(2.0)
     checks = ("/health", "/v1/models")
 
+    api_key = (LITELLM_HEALTH_API_KEY or "").strip()
+    headers = {}
+    if api_key:
+        headers = {
+            "Authorization": f"Bearer {api_key}",
+            "X-API-Key": api_key,
+        }
+
     last_error = None
     async with httpx.AsyncClient(timeout=timeout) as client:
         for path in checks:
             url = f"{LITELLM_URL.rstrip('/')}{path}"
             started = time.perf_counter()
             try:
-                response = await client.get(url)
+                response = await client.get(url, headers=headers)
                 latency_ms = round((time.perf_counter() - started) * 1000, 1)
+
                 if response.is_success:
                     return {
                         "ok": True,
@@ -27,7 +36,20 @@ async def litellm_health():
                         "endpoint": path,
                         "http_status": response.status_code,
                     }
-                last_error = f"{path} returned {response.status_code}"
+
+                if response.status_code == 401 and not api_key:
+                    return {
+                        "ok": True,
+                        "status": "auth_required",
+                        "latency_ms": latency_ms,
+                        "endpoint": path,
+                        "http_status": response.status_code,
+                    }
+
+                if response.status_code == 401 and api_key:
+                    last_error = f"{path} returned 401 with configured health auth"
+                else:
+                    last_error = f"{path} returned {response.status_code}"
             except Exception as exc:
                 last_error = str(exc)