fix(security): resolve gateway Bearer tokens from the credential KV - #621

Closed

cursor[bot] wants to merge 20 commits into

mainfrom

cursor/bc-bf906600-0f14-4fe8-b2d5-93af1ddb66c1-8a3f

Commits on Aug 16, 2026

fix(api): treat message audio/function_call null-empty as omit; fail-closed otherwise
seonghobae
committed
743c6e9
fix(api): treat message weight 0/1/null as omit-equivalent; fail-closed otherwise
seonghobae
committed
e3a6e0e
fix(api): fail-closed on unknown chat message fields and legacy function role
seonghobae
committed
4a95b9a
fix(api): treat message prefix null/false as omit; fail-closed on true
seonghobae
committed
82038d3
fix(api): treat chat max_tool_calls null/empty as omit; fail-closed otherwise
seonghobae
committed
1a196b0
fix(api): treat Completions max_tool_calls null/empty as omit; fail-closed otherwise
seonghobae
committed
3a0d35e
fix(api): treat stream_options null flags as omit-equivalent no-ops
seonghobae
committed
9d10fa9
fix(api): fail-closed unknown stream_options keys and tools-path message honesty

cursoragent
and
seonghobae
committed
b108251
fix(api): fail-closed stream, model, and sampling on tools passthrough

cursoragent
and
seonghobae
committed
856adb8
fix(api): fail-closed empty messages and spend keys on tools passthrough

cursoragent
and
seonghobae
committed
169a382
fix(api): fail-closed batch routing hints on tools passthrough

cursoragent
and
seonghobae
committed
b950724
docs: tell buyers to omit batch routing on tool-calling requests

cursoragent
and
seonghobae
committed
dbfa0e5
fix(api): fail-closed seed/stop/n/logprobs on tools passthrough

cursoragent
and
seonghobae
committed
ffad9cb
fix(api): apply request temperature on streamed route completions

cursoragent
and
seonghobae
committed
18e6263
fix(api): pop null tool.function description/parameters/strict before proxy

cursoragent
and
seonghobae
committed
bc73dd2
docs: record passthrough knob and stream temperature fixes in CHANGELOG

cursoragent
and
seonghobae
committed
7e9a339
fix(security): read provider host allowlist from KV at request time

cursoragent
and
seonghobae
committed
af26158
test(security): lock allowlist seed-once and process-store isolation

cursoragent
and
seonghobae
committed
c91629e
fix(security): keep operational email on trusted traces

cursoragent
and
seonghobae
committed
fe444d2
fix(security): resolve gateway Bearer tokens from the credential KV

cursoragent
and
seonghobae
committed
3cfc201

Navigation Menu

Uh oh!

fix(security): resolve gateway Bearer tokens from the credential KV - #621

fix(security): resolve gateway Bearer tokens from the credential KV#621
cursor[bot] wants to merge 20 commits into
mainfrom
cursor/bc-bf906600-0f14-4fe8-b2d5-93af1ddb66c1-8a3f

Commits on Aug 16, 2026

fix(api): treat message audio/function_call null-empty as omit; fail-closed otherwise

fix(api): treat message weight 0/1/null as omit-equivalent; fail-closed otherwise

fix(api): fail-closed on unknown chat message fields and legacy function role

fix(api): treat message prefix null/false as omit; fail-closed on true

fix(api): treat chat max_tool_calls null/empty as omit; fail-closed otherwise

fix(api): treat Completions max_tool_calls null/empty as omit; fail-closed otherwise

fix(api): treat stream_options null flags as omit-equivalent no-ops

fix(api): fail-closed unknown stream_options keys and tools-path message honesty

fix(api): fail-closed stream, model, and sampling on tools passthrough

fix(api): fail-closed empty messages and spend keys on tools passthrough

fix(api): fail-closed batch routing hints on tools passthrough

docs: tell buyers to omit batch routing on tool-calling requests

fix(api): fail-closed seed/stop/n/logprobs on tools passthrough

fix(api): apply request temperature on streamed route completions

fix(api): pop null tool.function description/parameters/strict before proxy

docs: record passthrough knob and stream temperature fixes in CHANGELOG

fix(security): read provider host allowlist from KV at request time

test(security): lock allowlist seed-once and process-store isolation

fix(security): keep operational email on trusted traces

fix(security): resolve gateway Bearer tokens from the credential KV