Skip to content

fix(cursor): reject unenforceable output caps - #1264

Merged
bloodf merged 13 commits into
mainfrom
v5/1084
Oct 13, 2026
Merged

bloodf merged 13 commits into
mainfrom
v5/1084

Conversation

@bloodf

@bloodf bloodf commented Oct 9, 2026 •

Copy link
Copy Markdown
Owner

Scope

fix(cursor): reject unenforceable output caps

Closes #1084

Changed files

  • open-sse/translator/request/openai-to-cursor.js
  • tests/translator/bugs-gemini-cursor-commandcode.test.js
  • tests/translator/coverage-all-models.test.js

Local evidence

  • Checkpoint: fa897b8 committed;294focused2expected; corrected full raw0; lint pass; review no findings; smoke explicit400/uncapped; not merged
  • Full-suite metadata: 12383 passed / 0 failed / 66 pending of 12449 (tests/.test-results.json, metadata only)
  • Docs: no documentation files changed
  • No baseline additions.

Status

Draft. Not integrated with other branches; CI pending. Publication commitlint gate blocked locally (missing @commitlint/config-conventional). Not ready to merge until final publication gates and CI pass.

Review readiness update — 2026-10-09

Ready for review of the stated, finished PR scope; not ready to merge. This update supersedes earlier draft/parent-only publication wording without removing the original body or user notes.

  • Audited head: fa897b8388fdf555db44c5f95b0d6efee13a592a; current main at audit: e51ab1c089800c2a70587822189997c482f53654.
  • Required V5 Local CI: missing. No success status is published by this update.
  • Merge requires actual full-CI success for the final exact head, strict up-to-date main, required reviews and resolved review threads. Any rebase or new head invalidates previous head-bound evidence.
  • Missing administrator/confinement proof blocks the serial full-CI/merge path, not review readiness. No gate is waived; no build or test was run for this update.

Retained implementation evidence supports review of the stated PR scope. Historical test counts and older successful checks do not establish integration with current main or a current full-CI pass. Prior local publication notes are historical; no gates were rerun by this delivery worker.

Stop silently replacing explicit client limits with an unused default.
Refs #1084
@vercel

vercel Bot commented Oct 9, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
durindoor Ignored Ignored Preview Oct 13, 2026 4:02am UTC

Request Review

@bloodf
bloodf marked this pull request as ready for review October 9, 2026 22:13
bloodf and others added 11 commits October 12, 2026 20:49
* feat(ci): add independently reviewed scoped local gate receipts

* fix(ci): reuse string predicates at reviewed selection boundary

* docs(ci): identify nested test package in scoped gate commands
…1281)

* port(upstream): #4532 - prevent generated Gemini tool ID collisions

* port(upstream): #4532 - prevent Claude-backed Gemini tool ID collisions

* test(translator): place Gemini ID collision regression with translator tests
…nAI (#1283)

* test(provider): expose g4f-nvidia unsupported transport fallback

* fix(executor): isolate unknown providers from implicit vendor dispatch

* test(executor): compose unknown-provider negative boundaries

* test(executor): mock release updater during offline acceptance

* test(executor): add repaired Groq negative boundary
)

* docs: inventory partial OmniRoute security audit

Refs #1150

* fix(mcp): sanitize consumer error boundaries

Preserve tested MCP error envelopes and successful results.

Refs #1150

Signed-off-by: MCP Delivery Worker <mcp-delivery@localhost>

* fix(mcp): redact rendered retry and tool-list diagnostics

Refs #1150. Depends on #1269.

Signed-off-by: Heitor Ramon Ribeiro <heitor.ramon@gmail.com>

* test(mcp): cover registered gateway acceptance and probe disclosure

Add isolated grant/identity and tool-result acceptance controls through real MCP routes. Preserve a failing regression for unsanitized instance-probe errors; production remediation requires owner approval.

* fix(mcp): sanitize instance probe error diagnostics

Reuse canonical error sanitization for transport and upstream probe failures while retaining status, response shape, and instance context. Add negative coverage for invalid transport diagnostics.

* fix(mcp): return content-free instance probe failures

Do not expose arbitrary upstream or transport exception text, including escaped nested JSON credentials. Preserve probe status and envelope; retain plain credential controls and add nested-token regression.

* fix(mcp): reject encoded credential diagnostics at shared sanitizer

Fail closed on bounded escaped JSON diagnostics before regex redaction. Preserve connection-refused probe diagnostics through a fixed public code without exposing exception text.

* fix(logs): redact retained payloads at export boundary

---------

Signed-off-by: MCP Delivery Worker <mcp-delivery@localhost>
Signed-off-by: Heitor Ramon Ribeiro <heitor.ramon@gmail.com>
Co-authored-by: Independent CI Verifier <ci-verifier@localhost>
Co-authored-by: MCP Delivery Worker <mcp-delivery@localhost>
…ion (#1285)

* test(provider): cover g4f-ollama identity and native account validation gap

* test(provider): distinguish local Ollama discovery from cloud auth

* fix(provider): stop treating Ollama tags reachability as credential proof

* fix(provider): keep unverified Ollama stored credentials inactive

* test(provider): align bounded Ollama probes with unverified credentials
@bloodf

bloodf commented Oct 13, 2026

Copy link
Copy Markdown
Owner Author

Local FULL verification authenticated for this exact candidate.

  • Head: 5257f2557afc3741ca8b0efb44bd752900f360ca
  • Verified main base: 09ae535d1ad4ea70ba4a59b5877e0ba400525f8c
  • Canonical test files: 1,419, each executed exactly once across contained native and bwrap lanes.
  • Assertions: 12,536 passed, 0 failed, 66 unchanged skips.
  • Native trusted-shell suite: 10/10 passed, genuine root ownership preserved without root execution or predicate changes.
  • All 21 build, lint, test, baseline, commitlint and source-identity steps passed. Conditional website build not required.
  • Owned processes and native service stopped; source and dependency integrity verified.

Independent authentication SHA256: 33bdf1f8fbe5313eac61aa19b75a8c7a13e6555c38345d327ce743f214cdc3bf.
Combined report SHA256: 1e5278fb9e515b38de083d4f601b62242642afcd8dd31ed0dde35311b49f4c90.
JUnit SHA256: 0889455add01f6c932b5e2cd65284d4b23717765de1f56c264f38f0778a49784.
Composite receipt SHA256: d9489e4c0689a499219e573f5bb3dad555dba461279631425ecad0cf83189524.
Original native completion: 1791928485.7194185; aggregate completion: 1791929525.5248747. Freshness uses original execution times.

Historical failed attempts remain failed. No baseline waiver, test omission, live-provider acceptance or blanket runtime authorization is implied.

@bloodf
bloodf merged commit 837f245 into main Oct 13, 2026
3 checks passed
@bloodf
bloodf deleted the v5/1084 branch October 20, 2026 18:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(translator): Honor explicit client output limits on Cursor requests

1 participant