Conversation
Multi-level gateway model IDs (openrouter/<vendor>/<model>) broke four things that only bit gateway routes: - stream_openai_compat re-derived the provider from an already-stripped model string, so openrouter/deepseek/* resolved to the DeepSeek API and picked up DeepSeek-only request fields (extra_body.thinking, reasoning_effort) plus the wrong output caps; openrouter/openai/* sent max_completion_tokens instead of the max_tokens OpenRouter documents. stream() now passes the resolved provider via config['_provider_name']. - COSTS/_MODEL_CONTEXT_LIMITS are keyed by plain model name, so every openrouter/* route priced at $0.00 (the quota dollar budget never fired for a gateway that bills real money) and inherited a flat 128k context window. New lookup_model_key() drops the vendor path and the @provider/quant routing suffix; context falls back to the vendor's own window when the per-model registry has no entry. - The @<provider>[/<quant>] suffix made prompt-family overlay routing tail to 'fp8', silently dropping claude.md/qwen.md. Tests: tests/test_openrouter_provider.py 11 -> 23 cases. Docs: usage.md (OpenRouter setup + provider pinning), recipes.md, architecture.md, i18n READMEs.
….87) auto mode now asks only when an action can change the user's files, run arbitrary code, or reach outside the session. - Read-only tools come from ToolDef.read_only instead of a hardcoded five-name list: 18 already-read-only tools (GetDiagnostics, TaskList, MemorySearch, ReadPDF, SummarizeLargeFile, ...) stopped prompting. Session-state tools (TaskCreate/TaskUpdate/MemorySave/Skill/SleepTimer) join them; unclassified MCP/plugin tools still prompt. - _is_safe_bash is a shlex parser instead of a prefix match: pipelines of read-only stages auto-run (git log | head -20), while redirection, backgrounding, subshells and command substitution are refused. Closes a hole where anything starting with 'python '/'node '/'find ' auto-ran arbitrary code; interpreters now prompt, their --version forms do not. - Write auto-approves only when it CREATES a file inside the workspace; overwrites, paths outside it, and dot-paths (.git/hooks, .github, .env) still prompt. Disable with /config auto_create_files=false. - New 's' answer grants one signature (Bash:git commit, Edit:/path) for the session: in-memory only, ignored in manual mode, listed by /permissions, dropped by /permissions clear. - cli._ask_permission_event tolerates 2-arg permission handlers, which would otherwise raise into the callers' except and silently DENY. - /config bash_safe_extra=[...] extends the read-only vocabulary. Tests: tests/test_permission_auto_approve.py, 118 cases. Docs: security.md (policy + boundaries), reference.md, features.md, README, news.md, i18n CN. Version 3.5.86 -> 3.5.87.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.