Require user LLM credentials

agent.py

@@ -10,8 +10,8 @@ This agent only works when invoked through the platform orchestrator,
 because it needs three things forwarded from the caller:
 
   1. ``ctx.workspace.bucket`` — the user's MinIO bucket
-  2. ``ctx.llm`` — caller-selected LLM credentials when available, otherwise
-     a platform-scoped LiteLLM grant token for the builder's own DeepAgents loop
+  2. ``ctx.llm`` — the caller's saved LLM credential for the builder's own
+     DeepAgents loop
   3. ``ctx.cp_jwt`` — the user's CP JWT, so cp_deploy_tarball can
      POST to /v1/agents/from-tarball as the user.
 """
@@ -53,17 +53,16 @@ class AgentBuilder(A2AAgent[BuilderConfig, NoAuth]):
     config_model = BuilderConfig
     auth_model = NoAuth
     tools_used = ("deepagents", "langgraph", "a2a-pack", "litellm", "microsandbox")
-    llm_provisioning = LLMProvisioning.PLATFORM_OR_CALLER_PROVIDED
+    llm_provisioning = LLMProvisioning.PLATFORM
     wants_cp_jwt = True
     workspace_access = WorkspaceAccess.dynamic(
         allowed_modes=(WorkspaceMode.READ_ONLY, WorkspaceMode.READ_WRITE_OVERLAY),
     )
     pricing = Pricing(
         price_per_call_usd=0.10,
-        caller_pays_llm=False,
+        caller_pays_llm=True,
         notes=(
-            "Uses caller-selected LLM credentials when available; otherwise "
-            "uses a platform-scoped LiteLLM grant for the builder's own "
+            "Uses the caller's saved LLM credential for the builder's own "
             "reasoning loop. Deployed agents remain yours."
         ),
     )