feat(settings): add foreground fallback controls#5684
Closed
RaresKeY wants to merge 1934 commits into
Closed
Conversation
Keep an unhealthy MemoryVectorStore instance available for health reporting instead of discarding it as disabled. This lets health checks report a degraded/down vector-store state while preserving focused regression coverage for initializer behavior.
* fix(security): prevent ReDoS in XML and args tool-call parsers
Four py/polynomial-redos sinks in tool_parsing.py ran lazy/greedy regexes over
untrusted model output (tool-call markup is attacker-influenced via prompt
injection). When the closing delimiter was absent, each rescanned to
end-of-string from every opener -> O(n^2):
- args => { ... } in _parse_tool_call_block: greedy \{([\s\S]*)\} restarted
from every `args:{` opener. Now finds the opener once and takes through the
last `}` (rfind) — equivalent capture, O(n).
- _XML_INVOKE_RE: lazy <invoke ...>([\s\S]*?)</invoke>. Now _iter_xml_invoke
pairs each opener with the first reachable </invoke> and stops when none is.
- _XML_DIRECT_TOOL_RE and the <tag>([\s\S]*?)</\1> param scan in
_parse_tool_code_block: lazy backreference patterns. Now _iter_backref_blocks
pairs each opener with the nearest matching closer and memoizes tag names
with no remaining closer, so an opener flood stays O(n).
All four are output-equivalent to the originals on well-formed tool-call markup;
the lazy patterns remain defined (still re-exported via agent_tools) but no
longer drive a finditer over untrusted text. Adds tests/test_redos_xml_tool_parsers.py
pinning correctness and bounding the opener-flood inputs (old paths took 4-15s).
* fix(security): harden invoke-parameter and distinct-name tag scans
Forward-only the two residual ReDoS paths in the XML/tool parsers that the
outer-delimiter fix left quadratic:
- _parse_xml_invoke parsed <parameter> with _XML_PARAM_RE.finditer, so a
closed <invoke> body full of unclosed <parameter> openers rescanned the
body from every opener (O(n^2), ~11s at 8k openers). Now scans forward-only
via _iter_named_blocks, factored out of _iter_xml_invoke.
- _iter_backref_blocks only memoized repeated missing tag names; a flood of
distinct unclosed names searched the suffix once per name (O(n^2)). It now
indexes every closer by name in one linear pass and binary-searches per
opener (O(n log n)). Covers the direct and tool_code backref scans.
Output-equivalent to the prior scanners (200k randomized trials match the
memoized version for both the direct ci=True and tool_code ci=False configs).
Adds regressions for the closed-invoke parameter flood and the distinct-name
floods (45k openers now run in ~0.05s, were 5-6s).
fix(docker): bump Docker CLI to a patched release
fix(docker): bump Docker CLI to a patched release
* feat(models): define capability schema and readers * fix(models): harden Google catalog probing Restrict native catalog probing to the Gemini host, keep provider keys out of request URLs, filter non-chat model resources, and preserve the manual refresh default in the built-in Google add flow.
…(#5474) * security(url-safety): reject RFC 6598 shared address space in strict mode Strict mode (block_private=True) is a full SSRF lockdown, but it only rejected is_private and is_loopback targets. CPython does not classify RFC 6598 shared/CGNAT space (100.64.0.0/10) as is_private (it is "shared", not "private"), so a public redirect into 100.64.0.1 passed the per-hop guard and still issued the request to a potentially internal CGNAT service. not is_global would also exclude it, but only on CPython 3.11.10+/3.12.4+/ 3.13+; the CI matrix runs 3.11/3.12, so reject the range explicitly to stay correct across patch levels and the 3.14 runtime image. Default local-first mode is unchanged. Adds strict-mode coverage for shared, non-global, and public targets. * docs(url-safety): correct CGNAT is_global rationale in strict-mode comment The prior comment claimed `not is_global` catches 100.64.0.0/10 only on CPython 3.11.10+/3.12.4+/3.13+. That is inaccurate for CGNAT: is_global is False for 100.64.0.1 on every supported version (verified 3.10-3.14). The version-fragility applies to other ranges gh-113171 touched, not CGNAT. The explicit range reject is still the right choice; restate the reason as is_private not covering shared space, and not coupling strict mode to is_global's broader, cross-version definition. No behavior change.
…… (#5491) * fix(llm): enhance fallback logic to handle empty completions and improve metadata handling * fix(llm): stream tool call deltas immediately
Slice 2f of the route-domain reorganization (#4082/#4071, per specs/architecture-runtime-inventory.md §6.3). Moves note_routes.py into routes/note/, leaving a backward-compat sys.modules shim at the old path. Pure file reorganization, no behavior change. The shim uses sys.modules replacement (same pattern as the merged gallery #4903, research #4975, memory #5007, history #5090, and contacts #5227 slices) so that `import routes.note_routes`, `from routes.note_routes import X`, `importlib.import_module(...)`, and the `import ... as note_routes` + `monkeypatch.setattr(note_routes, "SessionLocal", ...)` pattern used by test_note_reminder_fire_scope.py / test_notes_fail_closed_auth.py all operate on the same module object the application uses. The canonical module does NOT depend on the shim — routes/note/note_routes.py imports only from core/, src/, and stdlib. The outbound email cross-domain imports (routes.email_routes._get_email_config, routes.email_helpers. _send_smtp_message) are function-local lazy imports that keep resolving through the email module's own path (email is not yet migrated). One source-introspection test site repointed to the new canonical path: - test_model_helper_owner_scope.py (shared with history; history entry already repointed in #5090, note entry repointed here) Adds tests/test_note_routes_shim.py to pin the sys.modules shim contract (legacy and canonical paths resolve to the same module object; monkeypatch via legacy alias reaches the canonical module). Verified: compileall clean; full suite 4487 passed, 3 skipped.
… (#5658)
Slice 2g of the route-domain reorganization (#4082/#4071). Moves
cleanup_routes.py into routes/cleanup/, leaving a backward-compat
sys.modules shim at the old path. Pure file reorganization, no behavior
change.
The shim uses sys.modules replacement so string-targeted
monkeypatch.setattr("routes.cleanup_routes.*", ...) in
test_cleanup_owner_scope.py reaches the canonical module.
Canonical module imports only from src/ and stdlib (zero internal
routes/ coupling). Zero source-introspection landmines.
Adds tests/test_cleanup_routes_shim.py to pin the sys.modules shim
contract. Verified: compileall clean; targeted tests pass.
…ackage (#5659) Slice 2h of the route-domain reorganization (#4082/#4071). Moves admin_wipe_routes.py into routes/admin_wipe/, leaving a backward-compat sys.modules shim at the old path. Pure file reorganization, no behavior change. The shim uses sys.modules replacement so the `import ... as admin_wipe_routes` + `monkeypatch.setattr(admin_wipe_routes, "SessionLocal", ...)` / `"require_admin"` pattern in test_admin_wipe_gallery.py reaches the canonical module. Canonical module imports only from core/, src/, and stdlib (zero internal routes/ coupling). Zero source-introspection landmines. Adds tests/test_admin_wipe_routes_shim.py to pin the sys.modules shim contract. Verified: compileall clean; targeted tests pass.
… (#5660) Slice 2i of the route-domain reorganization (#4082/#4071). Moves compare_routes.py into routes/compare/, leaving a backward-compat sys.modules shim at the old path. Pure file reorganization, no behavior change. The shim uses sys.modules replacement so the `import ... as cr` + `monkeypatch.setattr(cr, "SessionLocal", ...)` / `"_owned_endpoint_by_url"` / `"_owned_endpoint_by_id"` pattern in test_endpoint_owner_scope_followup.py reaches the canonical module. Canonical module imports only from core/, src/, and routes.session_routes (zero dependency on the legacy shim). One source-introspection test site repointed: test_endpoint_owner_scope_followup.py (shared with other domains; only the compare entry repointed here). Adds tests/test_compare_routes_shim.py to pin the sys.modules shim contract. Verified: compileall clean; targeted tests pass.
fix(docker): detect snap+WSL2 GPU passthrough incompatibility
* ci: add CodeQL advanced setup to scan pull requests before merge * ci(codeql): preserve scheduled scans Add a weekly advanced-setup scan and update the security CI guide so default setup remains disabled. --------- Co-authored-by: RaresKeY <158580472+RaresKeY@users.noreply.github.com>
Make foreground fallback an explicit per-user, availability-only policy shared by streaming Chat, non-stream Chat, and Agent runs. Preserve strict defaults, owner/model and credential boundaries, pinned Agent routes, and truthful per-round provenance/accounting. Carry provider-reported model identifiers through native streaming adapters, non-stream responses, and caches, and keep legacy default_model_fallbacks as tombstoned raw storage that generic settings APIs and agent tools cannot expose or mutate.
Add an off-by-default per-user foreground fallback toggle and an ordered editor for unique concrete LLM endpoint/model candidates. Keep the catalog and runtime on the same owner, allowlist, endpoint-type, known/unknown inventory, and runtime-credential boundaries; preserve legacy data and stale rows without misleading strict-state claims; and fail closed across loading, refresh, and preference-write errors. Reuse existing Settings controls while preserving save ordering, keyboard focus, responsive layout, list limits, and service-worker caching.
github-actions
Bot
added
the
ready for review
3 tasks
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return StreamingResponse(agent_runs.subscribe(session), media_type="text/event-stream") | ||
| _detached_run = agent_runs.start(session, _safe_stream()) | ||
| return StreamingResponse( | ||
| agent_runs.subscribe(session, _detached_run), |
| : {}; | ||
| // Assigning by detached-run identity is replay-idempotent even when a | ||
| // refresh produces a fresh metrics object or two tabs race to write it. | ||
| sessionRuns[runId] = cost; |
| (total, entry) => total + (Number(entry[1]) || 0), | ||
| 0, | ||
| ); | ||
| overflow.forEach(([oldRunId]) => delete sessionRuns[oldRunId]); |
This was referenced Jul 22, 2026
Member
Author
|
Final refresh:
|
pewdiepie-archdaemon
force-pushed
the
dev
branch
from
July 23, 2026 16:22
6c3b6d3 to
d8a2059
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Settings now exposes an off-by-default per-user foreground fallback toggle and an ordered editor for concrete endpoint/model candidates. The editor writes only the replacement policy keys, never displays or migrates legacy fallback data, and uses the same owner, allowlist, endpoint-type, model-inventory, and runtime-credential boundaries as backend routing.
Target branch
dev, notmain. All PRs land indev;mainis curated by the maintainer at each release. If your PR is onmainby accident, click "Edit" on this PR and change the base.Linked Issue
Fixes #5627
Part of #5625
Depends on #5683
Type of Change
Checklist
devdocker compose uporuvicorn app:app) and verified the change works end-to-end. Type-checks and unit tests are not enough.Stack
This is the third PR in #5625: #5632 → #5683 → this PR.
Until the preceding PRs merge, GitHub shows the three-commit stack. The issue-specific commit is
266281699442d398cd1fd51c239e427ade9ec417.Behavior contract
default_model_fallbacksis never displayed, copied, or migrated.Scope
In scope: the Settings toggle, ordered editor, foreground-safe model catalog, persistence, failure recovery, keyboard focus, responsive layout, and service-worker caching.
Out of scope: per-message overrides, inferred model profiles, provider discovery, capability inference, legacy-data migration, and controls for Utility, Vision, Deep Research, tasks, teacher, image, embedding, or search providers.
Validation
Desktop/mobile browser validation and screenshots remain outstanding, so this PR remains draft.
How to Test
Visual / UI changes — REQUIRED if you touched anything that renders
--red,--fg,--bg,--card,--border, etc.) — do not introduce new color values, font sizes, or spacing units.static/index.html) or plain text.Fira Code) for primary UI text. Don't override.Screenshots / clips
Not included. Desktop/mobile browser validation and screenshots remain outstanding.