fix(api): fail-closed role, content, and name on tools passthrough

[cursor]

Summary

• Close the remaining tools/response_format fail-open that fix(api): fail-closed message honesty on tools passthrough #585 left: developer role, empty user/system content, multimodal content-part shape, participant name, and missing/empty/messages now run before the passthrough early-return.
• Shared helpers (_normalize_chat_message_content, _validate_one_chat_message_name) keep the orchestration path and the tools path on the same fail-closed rules.
• Isolate Completions/chat sampling knobs on the calling thread via ModelClient.request_sampling so concurrent ThreadingHTTPServer workers cannot observe another request's temperature / top_p / penalties / max_tokens.
• HTTP honesty tests cover tools + each previously skipped field, response_format + weight, unknown tool_calls.function keys + tools, and missing/empty/non-object messages + tools.

This branch is the mergeable repair of #585 (cbd0420) and therefore of #582/#583/#584. Do not merge those heads.

Test plan

• python3 tests/test_message_role_content_name_tools_passthrough_http_honesty.py
• python3 tests/test_model_client_request_sampling_thread_isolation.py
• python3 tests/test_message_weight_http_honesty.py
• python3 tests/test_tool_calls_entry_keys_http_honesty.py
• python3 tests/test_chat_developer_multimodal_content_http_honesty.py
• python3 tests/test_api_contract.py
• CI Full unit + Semgrep product gates

Product gates only: Full unit + Semgrep (Strix ignored). Independent non-author APPROVE still required.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Stale comment

The #584 fail-open on weight / prefix / refusal / annotations is closed here, and Completions max_tool_calls, omit-pop, role/content/name, and thread-local sampling all hold. Local honesty + sampling tests passed.

Do not merge 28ef9d2 yet. Tools passthrough still accepts a chat completion without a valid messages array. Live at this head: tools + messages: [] / omitted / JSON null / non-list all return 200 and are proxied. Without tools, empty messages correctly 400 invalid_message. A buyer sending tools from an SDK can therefore get a billed completion with no prompt.

Next action: require a non-empty messages array before the passthrough early-return (same named error as _validate_messages) and add HTTP cases with nonempty tools. Follow-up branch from this head will land that repair.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Stale comment

The empty-messages fail-open flagged on 28ef9d2 is closed at afd8208.

Live HTTP at this head: tools + omitted / [] / JSON null / non-list messages all return 400 invalid_message. Developer role, empty user content, multimodal input_audio, and invalid name also 400 on the tools path. Thread-local request_sampling keeps concurrent knobs on the calling thread. Claimed honesty tests passed locally:

• tests/test_message_role_content_name_tools_passthrough_http_honesty.py
• tests/test_model_client_request_sampling_thread_isolation.py
• tests/test_message_weight_http_honesty.py
• tests/test_tool_calls_entry_keys_http_honesty.py
• tests/test_chat_developer_multimodal_content_http_honesty.py

Do not merge #582–#585. This head is the stacked repair for that message-honesty slice.

Still fail-open on the same early-return (live at this head; non-tools path is already 400 / SSE):

• tools or response_format + stream=true → 200 JSON (proxy_completion forces stream=false). Without tools, stream=true correctly returns SSE. An OpenAI SDK tool-calling client that streams will parse a completion object as a broken stream.
• tools + omitted model → 200 and a silent pool pick. Without tools this is 400 invalid_model.
• tools + stream_options.include_usage=true → 200. Without tools this is 400 invalid_stream_options.
• tools + temperature=99 → 200. Without tools this is 400 invalid_temperature.

seed / stop / n staying 200 on passthrough is consistent with OPENAI_PASSTHROUGH_PARAM_KEYS (forward to one provider). Do not hoist those rejects.

Next action: before the passthrough early-return, reject stream=true with named invalid_stream (SSE passthrough is still a follow-up), require model + pool membership, run _validate_chat_stream_options, and range-check temperature / top_p. Independent non-author APPROVE still required. Product gates: Full unit + Semgrep.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Verdict: COMMENT on 28ef9d2 (cannot REQUEST_CHANGES on cursor[bot] own PR)

The unique commits close the holes this PR claims. Live HTTP at this SHA:

Prior #585 fail-open	This head
tools + role: developer	400 invalid_message_role
tools + empty user content	400 invalid_message_content
tools + input_audio parts	400 invalid_message_content
tools + empty / tool-role name	400 invalid_message_name
Shared ModelClient sampling defaults	Isolated for chat()

Do not merge #582–#585. Do not merge this head either.

Blocking

1. Empty messages still fail-open on tools passthrough (_validate_chat_message_content_and_name returns when messages is not a list, and is a no-op on []). _validate_messages requires a non-empty array, but it runs only after the tools/response_format return. Live: tools + [] / omitted / null / non-list → 200 chat.completion with prompt_tokens: 0.
2. stream_chat drops top_p / penalties. chat() applies temperature, top_p, both penalties, and max_tokens from thread-local overrides. Route streaming still ignores top_p / penalties.

Next action

Prefer #594 (7a16460): _require_chat_messages_array before passthrough, HTTP cases for empty/omitted/null/non-list + tools and response_format, and stream_chat sharing _effective_request_sampling with chat. Independent non-author APPROVE still required after product gates (Full unit + Semgrep).

CodeRabbit CLI 0.7.3 is installed; coderabbit auth login --agent timed out waiting for a browser.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head afd8208f225fe1d6c6907075635177a8a7317f0d.

• Head SHA: afd8208f225fe1d6c6907075635177a8a7317f0d

• Workflow run: 32071253960

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: afd8208f225fe1d6c6907075635177a8a7317f0d
• Workflow run: 32071253960
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head afd8208f225fe1d6c6907075635177a8a7317f0d.

• Head SHA: afd8208f225fe1d6c6907075635177a8a7317f0d

• Workflow run: 32071253960

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading