diegosouzapw 94f1b3eb5b fix(sse): stop unhydrated compatible connections routing to the real OpenAI/Anthropic API (#13452) ...

Root cause: BaseExecutor/DefaultExecutor.buildUrl() silently defaulted an
openai-compatible-*/anthropic-compatible-* connection to the real
OpenAI/Anthropic API when providerSpecificData.baseUrl was absent, shipping
the connection's own stored credential to a public third party. baseUrl is
only ever stamped at write time by two routes; a connection created outside
those (direct DB insert, pre-hydration row, node-update race) reproduced
this bug.

Fix: buildUrl() now throws instead of defaulting (requireCompatibleBaseUrl
in providerRegistry.ts), and the credential-selection read path
(auth.ts -> compatibleNodeBaseUrl.ts) self-heals by re-joining
provider_nodes via the existing cache before a request ever reaches the
executor.

Regression test: tests/unit/issue-13452-node-baseurl-ignored.test.ts

2026-09-15 17:31:06 -03:00

57 KiB

Raw Blame History

View Raw