fix(security): read provider host allowlist from KV on the honesty tip - #607

Closed

cursor[bot] wants to merge 18 commits into

mainfrom

cursor/bc-43bd5124-6de2-4813-a8ae-c3a4f3ee88bf-10c1

Commits on Aug 16, 2026

fix(api): treat message audio/function_call null-empty as omit; fail-closed otherwise
seonghobae
committed
743c6e9
fix(api): treat message weight 0/1/null as omit-equivalent; fail-closed otherwise
seonghobae
committed
e3a6e0e
fix(api): fail-closed on unknown chat message fields and legacy function role
seonghobae
committed
4a95b9a
fix(api): treat message prefix null/false as omit; fail-closed on true
seonghobae
committed
82038d3
fix(api): treat chat max_tool_calls null/empty as omit; fail-closed otherwise
seonghobae
committed
1a196b0
fix(api): treat Completions max_tool_calls null/empty as omit; fail-closed otherwise
seonghobae
committed
3a0d35e
fix(api): treat stream_options null flags as omit-equivalent no-ops
seonghobae
committed
9d10fa9
fix(api): fail-closed unknown stream_options keys and tools-path message honesty

cursoragent
and
seonghobae
committed
b108251
fix(api): fail-closed stream, model, and sampling on tools passthrough

cursoragent
and
seonghobae
committed
856adb8
fix(api): fail-closed empty messages and spend keys on tools passthrough

cursoragent
and
seonghobae
committed
169a382
fix(api): fail-closed batch routing hints on tools passthrough

cursoragent
and
seonghobae
committed
b950724
docs: tell buyers to omit batch routing on tool-calling requests

cursoragent
and
seonghobae
committed
dbfa0e5
fix(api): fail-closed seed/stop/n/logprobs on tools passthrough

cursoragent
and
seonghobae
committed
ffad9cb
fix(api): apply request temperature on streamed route completions

cursoragent
and
seonghobae
committed
18e6263
fix(api): pop null tool.function description/parameters/strict before proxy

cursoragent
and
seonghobae
committed
bc73dd2
docs: record passthrough knob and stream temperature fixes in CHANGELOG

cursoragent
and
seonghobae
committed
7e9a339
fix(security): read provider host allowlist from KV at request time

cursoragent
and
seonghobae
committed
dfb6ca1
test(security): lock seed-twice and request-path env-ignore for host allowlist

cursoragent
and
seonghobae
committed
6ebb1f8

Navigation Menu

Uh oh!

fix(security): read provider host allowlist from KV on the honesty tip - #607

fix(security): read provider host allowlist from KV on the honesty tip#607
cursor[bot] wants to merge 18 commits into
mainfrom
cursor/bc-43bd5124-6de2-4813-a8ae-c3a4f3ee88bf-10c1

Commits on Aug 16, 2026

fix(api): treat message audio/function_call null-empty as omit; fail-closed otherwise

fix(api): treat message weight 0/1/null as omit-equivalent; fail-closed otherwise

fix(api): fail-closed on unknown chat message fields and legacy function role

fix(api): treat message prefix null/false as omit; fail-closed on true

fix(api): treat chat max_tool_calls null/empty as omit; fail-closed otherwise

fix(api): treat Completions max_tool_calls null/empty as omit; fail-closed otherwise

fix(api): treat stream_options null flags as omit-equivalent no-ops

fix(api): fail-closed unknown stream_options keys and tools-path message honesty

fix(api): fail-closed stream, model, and sampling on tools passthrough

fix(api): fail-closed empty messages and spend keys on tools passthrough

fix(api): fail-closed batch routing hints on tools passthrough

docs: tell buyers to omit batch routing on tool-calling requests

fix(api): fail-closed seed/stop/n/logprobs on tools passthrough

fix(api): apply request temperature on streamed route completions

fix(api): pop null tool.function description/parameters/strict before proxy

docs: record passthrough knob and stream temperature fixes in CHANGELOG

fix(security): read provider host allowlist from KV at request time

test(security): lock seed-twice and request-path env-ignore for host allowlist