fix(api): require ASCII for json_schema.name charset - #669
Closed
seonghobae wants to merge 18 commits into
Closed
Conversation
…closed otherwise Chat history: message-level audio and legacy function_call are null/empty omit no-ops; non-empty fail closed with named errors (including tools passthrough). Tip substrate from #577 assistant refusal/annotations honesty. Local full unit: 940 passed.
…ed otherwise OpenAI fine-tune style message weight is not applied on this gateway. Accept null/0/1 as honest no-ops; reject other types and values with invalid_message_weight. Tip substrate from #578. Local full unit: 943 passed.
…ion role Reject unsupported message keys with named unknown_message_fields (not silent strip or tools-passthrough smuggle). Reject legacy function role with invalid_message_role migration to tool. Tip substrate from #579. Local full unit: 947 passed.
OpenAI partial-assistant prefix flag is not applied on this gateway. null/false are honest no-ops; true and non-booleans fail closed with invalid_message_prefix. Tip substrate from #580. Local full unit: 950 passed.
…therwise Named invalid_max_tool_calls on /v1/chat/completions instead of opaque unknown_fields. Aligns with Responses max_tool_calls honesty; gateway has no multi-step tool loop.
…losed otherwise Legacy /v1/completions treated max_tool_calls as unknown_fields. Accept the key for named invalid_max_tool_calls (null/empty/whitespace omit-equivalent), matching chat/Responses honesty so SDKs get a clear migration path.
SDK clients often send include_usage/include_obfuscation as JSON null. Drop null flag values before validation so null (and null+false mixes) match omit / all-false no-ops on chat, Completions, and Responses. True flags remain fail-closed with invalid_stream_options.
…or Responses parallel true SDK optional defaults often send function.strict and json_schema.strict as null — treat as omit rather than type errors. Align Responses parallel_tool_calls=true with chat by requiring a non-empty tools array.
SDK optional defaults often send description and parameters as JSON null. Treat null as omit rather than type errors; non-null non-string/object values remain fail-closed with invalid_tools.
OpenAI-style tool descriptions are at most 1024 characters. Over-long descriptions fail closed with named invalid_tools so SDKs never believe a truncated description was accepted.
SDK optional participant name blanks ("" / whitespace) are omit-equivalent
like JSON null. Non-string, over-long, and invalid charset names remain
fail-closed with invalid_message_name.
SDK optional defaults serialize omitted tool.function description/parameters/strict as JSON null. Accepting those keys without popping them is not omit-equivalent: proxy_completion forwards the body and several providers reject null parameters. Pop in place so passthrough matches omit; keep non-null wrong types on invalid_tools. Also pop response_format.json_schema.strict null. Tip substrate from #614. Local full unit: 989 passed.
…n keys SDK optional defaults serialize omitted response_format.json_schema description/strict as JSON null or blank. Leave those keys and the gateway forwards them; several providers reject strict: null. Pop in place so passthrough matches omit. Unknown inner keys and non-string descriptions stay invalid_response_format. HTTP echo tests cover chat and Responses. Docs cite OpenAI structured outputs and IETF JSON Schema 2020-12 in APA 7th. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
SDK optional defaults serialize omitted function descriptions as empty or whitespace-only strings. Leaving those keys is not omit-equivalent: proxy_completion forwards them and several providers reject a blank description. Pop in place so passthrough matches omit; keep non-empty strings and fail-closed non-string values. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
OpenAI Structured Outputs require response_format.json_schema.name to
match [a-zA-Z0-9_-]{1,64}, the same charset already enforced on
tool.function.name. Spaces, punctuation, and names longer than 64 were
forwarded and buyers saw an opaque provider rejection.
Fail closed with named invalid_response_format on chat and Responses.
HTTP echo tests keep a 64-character legal name. Docs cite the OpenAI
Structured Outputs name rule in APA 7th.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Drive _validate_chat_response_format from exercise_request_body so
Hypothesis and Atheris share the omit-real + [a-zA-Z0-9_-]{1,64} name
invariants. Successful parses must keep a legal name and must not
forward null/blank description or non-bool strict.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
str.isalnum() accepted Unicode letters and digits (café, 名前,
Arabic-Indic digits), so the documented [a-zA-Z0-9_-]{1,64} check
still forwarded illegal names and buyers saw an opaque provider 400.
Require name.isascii() before alnum/_/-. HTTP honesty covers Unicode
reject on chat and Responses plus a Responses 64-character keep.
Fuzz invariant matches the ASCII regex.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Important Review skippedToo many files! This PR contains 155 files, which is 55 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (155)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Unique tip 8251149 — SOUND
Reviewed only fix(api): require ASCII for json_schema.name charset on the #654 substrate. The 155-file honesty stack is out of scope and must not land on main as one merge.
What this tip does
#654 documented OpenAI Structured Outputs [a-zA-Z0-9_-]{1,64} but used str.isalnum(), which accepts Unicode letters and digits. This tip requires name.isascii() before alnum/_/- so café, 名前, and schema_١٢٣ return 400 invalid_response_format on /v1/chat/completions and /v1/responses. Empty/whitespace names still fail on the existing non-empty check. A 64-character ASCII name still echoes on mock echo.response_format. The request-body fuzz invariant now requires ASCII.
Evidence
- Unique-tip review: no Critical or Important issues.
python3 tests/test_json_schema_name_charset_http_honesty.pyprintedok(Unicode reject + Responses 64-character keep).- GitHub Checks were still queued at review time; that is not a blocker for this verdict. Re-run Full unit + Semgrep on this tip after they finish.
Residual (do not fold onto this PR)
Official Responses text.format stays on #657 / #666. The same isalnum()-without-isascii() hole remains on tool.function.name, tool_calls.function.name, and message name — next unique tip, not this one.
Reviewer next action
Land only 8251149 after Full unit + Semgrep. Do not APPROVE or squash the honesty stack onto main. Do not add text.format here.
Buyer next action
Send response_format.json_schema.name that matches [a-zA-Z0-9_-]{1,64}. If the name uses spaces, punctuation, or non-ASCII letters/digits, expect 400 invalid_response_format from this gateway — rename the schema to the ASCII charset, then retry.
Sent by Cursor Automation: Fix Issues
5 tasks
5 tasks
seonghobae
enabled auto-merge (squash)
August 16, 2026 17:06
auto-merge was automatically disabled
August 16, 2026 18:22
Pull request was closed
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
[a-zA-Z0-9_-]{1,64}but implementedstr.isalnum(), which accepts Unicode letters and digits (café, Japanese schema names, Arabic-Indic digits).invalid_response_format.name.isascii()before alnum/_/-on/v1/chat/completionsand/v1/responses.echo.response_format.8251149on the fix(api): fail-closed json_schema.name charset and length #654 substrate. Do not merge this stack ontomain. Land the unique commit after Full unit + Semgrep.text.format(currentlyinvalid_text). Do not fold that onto this tip.Test plan
python3 tests/test_json_schema_name_charset_http_honesty.py(ok; RED on Unicode name before theisascii()guard)exercise_request_bodyUnicode + ASCII name cases (ok)Reviewer next action
Review the unique tip (
8251149) only. Confirm Unicode names return400 invalid_response_formatand that a 64-character ASCII name still echoes. Do not APPROVE the honesty stack as amainmerge.Buyer next action
Send
response_format.json_schema.namethat matches[a-zA-Z0-9_-]{1,64}. If the name uses spaces, punctuation, or non-ASCII letters/digits, expect400 invalid_response_formatfrom this gateway — rename the schema to the ASCII charset, then retry.Papers (APA 7th)