fix(#1080): allow uninspected request bodies on Vertex AI profile

[fullsend-ai-coder]

Summary

• Add allow_uninspected_credentials: true to the *.googleapis.com endpoint in profiles/fullsend-vertex-ai.yaml to bypass OpenShell 0.0.110+'s request-body placeholder-prefix guard (bug(supervisor): literal and foreign-provider placeholders in conversation history block inference NVIDIA/OpenShell#2904)
• Agents that quote the placeholder namespace in model request bodies (e.g. from reading files, diffs, or issues that mention it) no longer trigger an ECONNRESET from the sandbox proxy
• TLS termination, bearer header injection, and method/path rule enforcement remain unchanged — only the request-body placeholder scan is skipped

Context

The scaffold copies were already patched in fullsend-ai/fullsend#6695 (ADR 0092). This change applies the same fix to the fleet harness copy loaded from this repository. See fullsend-ai/fullsend#6716 for the full analysis and reproduction table.

Testing

• Validated YAML structure and field values programmatically
• Verified the profile retains protocol: rest, access: read-write, and enforcement: enforce alongside the new field

---

Closes #1080

Post-script verification

• Branch is not main/master (agent/1080-vertex-allow-uninspected)
• Secret scan passed (gitleaks — 20bd058ec31d8cd9a6c34bb9d04b5247b0440fce..HEAD)
• PR body secret scan passed (gitleaks — no-git)

Review takeover (maintainer)

Independently reviewed by Codex and Grok against the NVIDIA/OpenShell v0.0.115 source, and verified on a local 0.0.115 gateway:

• The field is a first-class profile-endpoint field (crates/openshell-providers/src/profiles.rs EndpointProfile, copied by endpoint_to_proto into the composed _provider_* policy). Importing this exact file with openshell provider profile import --file profiles/fullsend-vertex-ai.yaml on 0.0.115 succeeds and provider list-profiles -o json shows allow_uninspected_credentials: true on the *.googleapis.com endpoint.
• Runtime effect, measured with the identical flag on the OpenAI profile (OpenShell 0.0.110+ resets model requests whose body mentions the placeholder prefix; fullsend agents cannot read text containing it fullsend#6716): a request body carrying the placeholder prefix gets 200 instead of a socket reset, the bearer header is still injected (the upstream API answers), and a request to a path outside the rules is still refused (403). TLS termination is unchanged (protocol: rest, default tls).
• Scope: the flag is added to the endpoint the profile already grants (*.googleapis.com, read-write). Narrowing that host is out of scope here — the sandbox also reaches sts.googleapis.com/oauth2.googleapis.com for the in-sandbox WIF exchange, and OpenShell rejects overlapping endpoints whose request-processing metadata disagree — and the exposure the flag adds on other googleapis hosts is only the skipped body marker scan (those bodies never carry placeholders either).
• Consumers: every fleet harness (harness/*.yaml) references this profile, so the fix applies fleet-wide; no other model-fronting profile exists in this repo.
• The same flag also relaxes the WebSocket-upgrade guard/extension mode on a provider-credentialed endpoint; dormant for Vertex generateContent traffic, noted in the profile comment.

Security-flagged approval (OpenShell's policy schema asks for it for this field): this is the same decision fullsend made in fullsend-ai/fullsend#6695 / ADR 0092 for the scaffold copies; approved here by the maintainer as part of this takeover.

[waynesun09]

/fs-fix-stop

[github-actions]

Fix agent disabled for this PR. Remove the fullsend-no-fix label or use /fs-fix to re-engage.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:12 PM UTC · Completed 8:26 PM UTC

Commit: b86cc4a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.79

[fullsend-ai-review]

Risk Assessment: low (1/5)

Details

Minimal additive config change (11 lines, 1 file) from a trusted bot author; all signals unchanged from prior assessment — protected path (profiles/) and security issue label contribute minor signal, but the change is trivially revertible with no dependency, CI, or security-sensitive pattern changes.

Previous run

Risk Assessment: low (1/5)

Details

Minimal additive config change (5 lines, 1 file) from a trusted bot author. All acceptance criteria from issue #1080 are met. The security issue label and protected path (profiles/) contribute minor signal, but the change is easily revertible and introduces no new dependencies, CI changes, or security-sensitive patterns.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] profiles/fullsend-vertex-ai.yaml — This PR modifies a file under the protected path profiles/. The PR links to issue Vertex profile: allow uninspected request bodies on *.googleapis.com so agents survive OpenShell 0.0.110+'s placeholder-prefix guard #1080 and the description explains the rationale (workaround for OpenShell 0.0.110+'s placeholder-prefix guard, approved via ADR 0092). Human approval is always required for protected-path changes, regardless of context.

Low

• [credential inspection bypass] profiles/fullsend-vertex-ai.yaml:21 — Setting allow_uninspected_credentials: true on the *.googleapis.com wildcard endpoint disables body-level placeholder inspection for all googleapis.com subdomains, not just Vertex AI (aiplatform). The profile's binaries list constrains matching to **/claude, **/pi, and **/node, limiting the practical scope. The remaining controls (TLS termination, bearer header injection, method/path enforcement) are retained, and the placeholder is a reserved namespace token rather than a secret. Consider narrowing the host to *.aiplatform.googleapis.com if only Vertex AI inference endpoints require this bypass.

Previous run

Review

Findings

Medium

• [protected-path] profiles/fullsend-vertex-ai.yaml — This PR modifies a file under the protected path profiles/. Human approval is always required for protected-path changes, regardless of context. The PR links to issue Vertex profile: allow uninspected request bodies on *.googleapis.com so agents survive OpenShell 0.0.110+'s placeholder-prefix guard #1080 and explains the rationale for the change.

Low

• [credential inspection bypass] profiles/fullsend-vertex-ai.yaml:18 — Setting allow_uninspected_credentials: true on the *.googleapis.com wildcard host skips body-level placeholder inspection for all googleapis.com subdomains, not just Vertex AI endpoints. The wildcard is the pre-existing host pattern used across 10+ policy references in the codebase — no narrower alternative exists. The placeholder is a reserved namespace token, not a secret. Consider narrowing to *.aiplatform.googleapis.com if only aiplatform endpoints are needed, though this may break discovery or auth endpoints on other subdomains.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:28 PM UTC · Completed 8:41 PM UTC

Commit: 5866efd · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.50

[fullsend-ai-review]

See the review comment for full details.

[waynesun09]

Maintainer approval (security-flagged opt-in). One-line profile change reviewed by Codex and Grok against the OpenShell v0.0.115 source and verified on a live 0.0.115 gateway: the field is honoured at the profile layer and composed into the provider policy; it skips only the request-body placeholder marker guard while TLS termination, bearer injection and method/path rules remain enforced. Same decision as fullsend-ai/fullsend#6695 (ADR 0092) for the scaffold copies; analysis in fullsend-ai/fullsend#6716. All required checks green on 5866efd, threads resolved.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:11 PM UTC · Completed 9:29 PM UTC

Commit: 5866efd · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.55

[fullsend-ai-retro]

PR #1081 added allow_uninspected_credentials: true to the Vertex AI profile in fullsend-ai/agents, a 1-file, 11-line YAML addition to work around OpenShell 0.0.110+'s request-body placeholder-prefix guard. The workflow was efficient and well-executed overall.

Timeline: Issue #1080 created (19:57) → triage ($0.58, 4 min) → /fs-code (20:03) → code agent produces correct PR ($1.20, 5 min) → first review ($2.79, 14 min) → maintainer amends commit metadata (adds Signed-off-by/Assisted-by trailers) and force-pushes at 20:26 → second review triggered ($3.50, 13 min) → maintainer responds to review findings and approves with security-flagged justification (20:49) → merged (21:09). Total: ~70 minutes, $8.07.

What went well:

• Triage agent correctly identified critical severity and the exact change needed.
• Code agent produced the correct change on the first attempt with zero rework — a clean single-commit PR matching the issue's acceptance criteria.
• Review agent findings were accurate and useful: protected-path flag (medium) and credential-bypass scope concern (low) were both legitimate observations. The suggestion to narrow *.googleapis.com to *.aiplatform.googleapis.com was a reasonable consideration that the maintainer addressed with a substantive technical explanation.
• Human review was thorough: independently verified against OpenShell source (via Codex and Grok), tested on a live 0.0.115 gateway, and provided a security-flagged approval with detailed justification.

Primary waste — redundant review on metadata-only force-push: The maintainer amended the code agent's commit to add Signed-off-by and Assisted-by trailers, then force-pushed. This produced a new commit SHA (5866efd replacing b86cc4a) with identical file content (same git tree), triggering a full second review run ($3.50) that produced the same findings as the first ($2.79). Total review cost was $6.29 for an 11-line change that should have cost ~$3.

This scenario is covered by existing issue #108 ("Short-circuit review on rebase-only pushes to avoid redundant sub-agent dispatch"), which has the ready-to-code label. Implementation note: #108's proposed approach (compare API file count between old and new HEAD) may not catch metadata-only amends — the GitHub compare API returned status: diverged with 1 file for this case even though the tree content was identical. Comparing git tree SHAs via GET /repos/.../git/commits/{sha} would be a more reliable detection mechanism.

Autonomy assessment: The requires-manual-review label was correctly applied. The review agent provided useful but shallow coverage compared to the human maintainer's independent verification (source code analysis, live gateway testing, scope justification). For security-sensitive profile changes, human review remains essential — no autonomy increase is warranted for this class of change.

No new proposals are warranted. The primary cost optimization (short-circuiting review on content-identical force-pushes) is already tracked by #108 with ready-to-code priority.