start.sh: append credit-pack hint to LiteLLM's hardcoded budget-exceeded messages (team + key)

start.sh

@@ -172,4 +172,42 @@ echo "Tinfoil proxy PID: $TINFOIL_PROXY_PID"
 # Give the proxy a moment to verify the enclave attestation
 sleep 3
 
+# Append a co-op-specific hint to LiteLLM's budget-exceeded messages so a
+# member who hits their limit is told they can top up with a credit pack.
+# LiteLLM hardcodes these strings in
+# litellm/proxy/auth/auth_checks.py (not configurable via env/settings), so we
+# patch the running copy at boot. Idempotent (checks a marker first) and
+# re-applied every start, so it survives upstream file moves on version bumps
+# — unlike the old build-time `RUN sed` CORS patch, which broke silently when
+# LiteLLM relocated the file.
+CREDIT_PACK_HINT='. You can add credit packs at https://opencollective.com/inference-cooperative'
+AUTH_CHECKS_PY="$(python3 -c 'import litellm.proxy.auth.auth_checks as m; print(m.__file__)')"
+if [ -n "$AUTH_CHECKS_PY" ] && ! grep -q "opencollective.com/inference-cooperative" "$AUTH_CHECKS_PY" 2>/dev/null; then
+    echo "Patching budget-exceeded messages with credit-pack hint..."
+    python3 - "$AUTH_CHECKS_PY" <<'PYEOF'
+import sys
+p = sys.argv[1]
+s = open(p).read()
+hint = ". You can add credit packs at https://opencollective.com/inference-cooperative"
+before = s
+# Team budget message (the one that fires for members, enforced at team level)
+s = s.replace(
+    'message=f"Budget has been exceeded! Team={team_object.team_id} Current cost: {spend}, Max budget: {team_object.max_budget}"',
+    'message=f"Budget has been exceeded! Team={team_object.team_id} Current cost: {spend}, Max budget: {team_object.max_budget}" + "' + hint.replace('"', '\\"') + '"',
+)
+# Key budget message (a few keys carry individual max_budget)
+s = s.replace(
+    'message=f"Budget has been exceeded! Key={key_descriptor} Current cost: {spend}, Max budget: {valid_token.max_budget}"',
+    'message=f"Budget has been exceeded! Key={key_descriptor} Current cost: {spend}, Max budget: {valid_token.max_budget}" + "' + hint.replace('"', '\\"') + '"',
+)
+if s != before:
+    open(p, "w").write(s)
+    print("patched")
+else:
+    print("no match (upstream message format changed) — leaving unpatched")
+PYEOF
+else
+    echo "Budget-exceeded hint already applied (or auth_checks.py not found); skipping."
+fi
+
 exec litellm --config "$CONFIG_FILE" --port 4000 --host 0.0.0.0