fix(security): catalog discovery must use chat egress policy - #661
fix(security): catalog discovery must use chat egress policy#661cursor[bot] wants to merge 5 commits into
Conversation
Register NVIDIA NIM, OpenAI, OpenRouter, and Bytez credentials into the KV, compose a production agent pool (no GitHub Models), and fail closed on missing keys, 429 failover, and malformed upstream responses. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Replace keyword scoring and YAML-order failover with a single quality-per-unit-cost chooser. 429/5xx/timeout re-runs that chooser on the remaining healthy pool. Empty pool fail-closes without GitHub Models. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Discovery now reuses the chat-path host/IP checks, refuses redirects that would carry a KV Bearer token, and treats HTTP as an explicit lab hook. Reseed replaces the sqlite agent pool so stale discovered workers cannot linger. Sidecar CI fails when /healthz never comes up. Empty credentials are not treated as ready. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict
Do not merge this head (64b69d0). The egress/reseed/health direction is correct, but this branch is #642 at ca2dd9f and is missing 1e82827 (live GET /v1/models as the primary catalog, _provider_slots compose, and the capability-tag cap).
Land #675 instead. That branch is 1e82827 plus this egress policy, persist-replace, sidecar /healthz fail-closed, empty-credential NotConfigured, and marker-only tag_discovered_model (the 1e82827 default-reasoning bug is not on this older compose path).
Next action
Leave this PR unmerged. Review and merge #675, then close #642 and this PR as superseded.
Sent by Cursor Automation: Fix Issues
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
…pt-out Match tip substrate: bind-only placeholder SQL and audited provider urllib/TLS paths; product Semgrep gate requires these suppressions.
2 participants
Why
PR #642 seeds the org provider catalog and chooses workers by cost-performance. Catalog
GET /v1/modelsstill sent the KV Bearer token after only a hostname + HTTPS check, followed redirects, and treated anyhttp://seed URL as insecure-ok. That is a credential leak chat would have refused.What landed (on top of #642)
provider_base_url_rejectionfor chat and discovery (public HTTPS, allowlist,getaddrinfoprivate/loopback/link-local/reserved).allow_insecure_discoveryonly (loopback lab fixtures).persist_catalog_to_agents_dbreplaces the sqliteagent_poolso a later static reseed cannot keep stale discovered workers./healthznever succeeds; no-secrets smoke skip happens only after a healthy serve.NotConfigured, no GitHub Models fallback).Do not merge #642 in parallel. This branch is #642 (
ca2dd9f) plus the egress/reseed/health fixes.Tests
Local: 333 passed (full
testsminus fuzz).Papers
Same claim boundary as
docs/doctoring/provider-catalog.mdanddocs/doctoring/cost_performance_routing.md(APA 7). Discovery egress is now an explicit claim: no private/loopback/redirect leak of the KV key.