valvesss 31653352cb fix(sse): loopback/LAN-gate the cursor-agent-image spawn path (Hard Rules #15/#17) ...

handleCursorAgentImageGeneration spawns the Cursor `agent` CLI, but
POST /v1/images/generations is shared by ~40 non-spawning image providers
that remote callers legitimately use, so the whole route can't be
classified LOCAL_ONLY without breaking them. Instead the handler now
rejects before any credential lookup or spawn unless the trusted
AUTHZ_HEADER_PEER_LOCALITY verdict (stamped by the authz pipeline from
the real TCP peer, never the spoofable Host header) is "loopback" or
"lan" — mirroring the policy every other LOCAL_ONLY route already gets.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

2026-08-20 08:58:25 -03:00

..

AGENTROUTER.md

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

ALIBABA-QWEN-PROVIDER-FAMILIES.md

fix(providers): refresh the translate-path golden for the bailian Token Plan endpoint (#10410)

2026-08-14 16:52:00 -03:00

CHATGPT_WEB.md

docs: restructure — planning artifacts to _tasks, duplicate merges, nav gaps closed (#10190)

2026-08-12 14:23:52 -03:00

CLAUDE_WEB.md

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

CURSOR_IMAGE.md

fix(sse): loopback/LAN-gate the cursor-agent-image spawn path (Hard Rules #15/#17)

2026-08-20 08:58:25 -03:00

CURSOR-API-KEY-AND-CLI.md

feat(providers): Cursor API provider (crsr_ keys) and Cursor CLI passthrough (#10729)

2026-08-20 06:29:11 -03:00

CURSOR-DOCKER.md

feat(cursor): exclusive live listing + verbatim AgentRun model ids (#9911)

2026-08-10 03:46:14 -03:00

meta.json

feat(providers): Cursor API provider (crsr_ keys) and Cursor CLI passthrough (#10729)

2026-08-20 06:29:11 -03:00

ZED-DOCKER.md

Release v3.8.40

2026-06-29 08:40:06 -03:00