Skip to content

fix: default discovery must reuse chat egress (not #658) - #678

Closed
cursor[bot] wants to merge 3 commits into
mainfrom
cursor/bc-8f45fffd-9f54-47e6-8aa6-466deb468eac-324b
Closed

fix: default discovery must reuse chat egress (not #658)#678
cursor[bot] wants to merge 3 commits into
mainfrom
cursor/bc-8f45fffd-9f54-47e6-8aa6-466deb468eac-324b

Conversation

@cursor

@cursor cursor Bot commented Aug 16, 2026

Copy link
Copy Markdown

Unique slice (do not merge as a duplicate)

Protected main is still 6841b719. This is the landing vehicle for #658 (default discovery, original_list_price, choose-once min-cost, GET /v1/models, Noema) plus the chat egress boundary that #658 is missing.

Work Owner This PR
Production seed, --from-env, flag-gated --discover-models, OpenCode sidecar, 429 hop #642 / landing #661 Not taken
Default-on discovery + priced selection + GET /v1/models #658 Taken, then hardened
Discovery SSRF / Bearer-on-redirect Missing on #658 Fixed here

Do not merge #658 in parallel. Do not merge #642/#661 onto the same main tip as this PR (two catalog HTTP stacks).

What changed after #658 9274f64

  1. Shared provider_egress.provider_base_url_rejection used by chat and catalog.
  2. No-redirect fetch. Loopback / private / link-local / reserved IPs are rejected before the KV Bearer is attached.
  3. allow_insecure is ignored on the production fetch path.
  4. A KV stub that omits billed rate keys is unknown, not promotional-free.

Tests (secret-free)

python tests/test_composed_catalog.py
python tests/test_priced_selection.py
python tests/test_original_list_price.py
python tests/test_cost_ledger.py
python tests/test_security_hardening.py
python tests/test_provider_reliability.py

Local: catalog, price, security, and reliability scripts passed on this head.

Papers

APA 7th claim boundary: docs/doctoring/priced-selection.md (adds OWASP Foundation, 2021, SSRF cheat sheet). Requirement owner: issue #86.

Next action

Review this head. If the egress tests and choose-once / cost-honesty contracts hold, merge this PR and leave #658 unmerged.

Open in Web View Automation 

cursoragent and others added 3 commits August 16, 2026 16:37
Unique slice vs PR #642: discover models when a KV credential is present
(static fallback only on GET /v1/models failure), retain original_list_price
when billed rates are promotional 0, select one min-cost/max-performance
worker instead of walking a next-agent list, and expose GET /v1/models for
Noema and other first-class /v1 consumers.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Issue #86 honesty: PriceBook.compute_cost returns None on a missing row
instead of 0.0. Explicit billed 0 stays actual free-to-caller;
original_list_price stays the hypothetical list beside it. Selection and
cheapest_upstream skip unknown instead of treating it as free.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Reject loopback, private, link-local, and reserved addresses before a
KV Bearer is attached, and refuse 3xx so the credential is never
replayed. Partial price rows that omit billed rates stay unknown.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
@cursor
cursor Bot requested a review from seonghobae August 16, 2026 16:50
@seonghobae
seonghobae marked this pull request as ready for review August 16, 2026 17:06
@seonghobae
seonghobae enabled auto-merge (squash) August 16, 2026 17:06
@cursor

cursor Bot commented Aug 16, 2026

Copy link
Copy Markdown
Author

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@seonghobae seonghobae closed this Aug 16, 2026
auto-merge was automatically disabled August 16, 2026 18:23

Pull request was closed

@seonghobae

Copy link
Copy Markdown
Contributor

Superseded by tip #691 (cumulative honesty substrate ≥ #689). Closing to free Full unit + Semgrep runners.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants