fix(routing): validate LITELLM settings in resolve_route (evaluate-only path, -O safe)

resolve_route is reached on the evaluate-only path without a preceding
validate_api_keys(), so a scheme-less/missing LITELLM_BASE_URL there escaped
validation and recorded an empty host in environment_info; the arm's asserts were
also strippable under 'python -O'. Call _validate_litellm_settings() in the LiteLLM
arm (raise, not assert) so both the normal and evaluate-only paths validate presence
+ URL scheme with a field-named error; narrowing asserts kept for pyright only.

Closes the blocker-2 evaluate-only edge + review non-blocking #11.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: CarlesUIPath

src/coder_eval/models/routing.py

@@ -165,10 +165,14 @@ def resolve_route(settings: Settings) -> ApiRoute:
         case ApiBackend.DIRECT:
             return DirectRoute(judge_transport=_resolve_direct_judge_transport(settings))
         case ApiBackend.LITELLM:
-            # base_url/auth_token are guaranteed by validate_api_keys (run first);
-            # asserts narrow the Optional types, mirroring the Bedrock arm.
-            assert settings.litellm_base_url is not None, "LiteLLM backend requires litellm_base_url"
-            assert settings.litellm_auth_token is not None, "LiteLLM backend requires litellm_auth_token"
+            # Validate here (raise, not assert): resolve_route is reached on the
+            # evaluate-only path WITHOUT a preceding validate_api_keys(), so this is
+            # the only guard there and must survive `python -O`. Checks presence +
+            # URL scheme, raising a field-named ValueError (review non-blocking #11).
+            settings._validate_litellm_settings()
+            # Narrowing for pyright only — _validate_litellm_settings guarantees these.
+            assert settings.litellm_base_url is not None
+            assert settings.litellm_auth_token is not None
             # No inference-profile qualification: the id is passed verbatim to the gateway.
             small_model = settings.litellm_small_model or settings.litellm_model
             return LiteLLMRoute(

tests/test_litellm_route.py

@@ -144,6 +144,19 @@ def test_resolves_custom_route_with_all_fields(self):
         assert route.auth_token == "sk-master"
         assert route.model == "deepseek.v3.2"
 
+    def test_rejects_scheme_less_base_url(self):
+        # resolve_route is the ONLY validation on the evaluate-only path (which
+        # skips validate_api_keys), so it must reject a malformed URL itself —
+        # otherwise environment_info records an empty host silently.
+        settings = Settings(
+            api_backend=ApiBackend.LITELLM,
+            litellm_base_url="localhost:4000",
+            litellm_auth_token="sk-master",
+            litellm_model="zai.glm-5",
+        )
+        with pytest.raises(ValueError, match="LITELLM_BASE_URL must be an http"):
+            resolve_route(settings)
+
     def test_small_model_falls_back_to_model(self):
         settings = Settings(
             api_backend=ApiBackend.LITELLM,