Skip to content

fix: harden provider trust boundaries #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheStreamCode merged 2 commits into from
Aug 8, 2026
Merged

fix: harden provider trust boundaries #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e7ff7c5
fix: harden provider trust boundaries
TheStreamCode Aug 8, 2026
d2cb123
test: avoid static unsafe regex fixture
TheStreamCode Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@ enter this repository, its history, or the packaged VSIX.
manager, a second lockfile, or edit the lockfile by hand.
- Node.js 22 or newer for development and CI. The bundle targets `node20` because that is the runtime shipped by
the supported VS Code extension host.
- `engines.vscode` is `^1.104.0`, the release that introduced the language model chat provider API.
- `engines.vscode` is `^1.106.0`, the minimum version that provides the image/data chat-part API used by the
extension.

## Architecture

Expand Down Expand Up @@ -49,6 +50,7 @@ Every command below exists in `package.json`; do not invent others.
| Type-check | `npm run check-types` |
| Lint (code only) | `npm run lint:code` |
| Lint (types + code + format) | `npm run lint` |
| Dependency audit | `npm run audit` |
| Format / verify | `npm run format` / `npm run format:check` |
| Offline tests | `npm test` |
| Live tests | `npm run test:live` (requires `CHUTES_KEY`) |
Expand All @@ -57,8 +59,8 @@ Every command below exists in `package.json`; do not invent others.
| Package a VSIX | `npm run vsix` |
| Run in the editor | `F5` in VS Code (Extension Development Host) |

`npm run check` is the gate: strict TypeScript, Oxlint with `--deny-warnings`, Prettier verification, the offline
test suite, a production bundle, and `vsce ls` to confirm the VSIX contents.
`npm run check` is the gate: strict TypeScript, Oxlint with `--deny-warnings`, Prettier verification, a high-severity
dependency audit, the offline test suite, a production bundle, and `vsce ls` to confirm the VSIX contents.

## Release and publishing

Expand Down
24 changes: 24 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,30 @@

## Unreleased

### Fixed

- Propagated model-list cancellation and prevented invalidated in-flight requests from restoring stale cache data.
- Reserved `model-router` for the virtual **Auto (router)** entry so a catalogue collision cannot create duplicate
models or route a normal model through the router endpoint.
- Corrected daily quota normalization for mixed unlimited/finite entries, negative API values, and account payloads
that provide quota usage without a separate quota list.
- Raised the minimum supported VS Code version to 1.106 because image attachments use `LanguageModelDataPart`, which
is not present in the previously declared 1.104 API.

### Changed

- Bounded model, account, error, streaming-event, tool-call, and quota-fallback payload processing; quota fallback
requests now use limited concurrency.
- Potentially expensive model-filter regular expressions now fall back to literal substring matching.
- Pinned the VS Code API types to the declared minimum and added a high-severity dependency audit to the quality gate.

### Security

- Tool calls now fail closed unless their streamed id, type, name, arguments, and advertised availability are valid;
missing ids are no longer synthesized.
- Updated vulnerable transitive development dependencies used by VSIX packaging (`brace-expansion`, `fast-uri`,
`js-yaml`, and `undici`).

## 0.4.4 - 2026-08-01

### Fixed
Expand Down
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ Thanks for your interest in improving Chutes AI — Chat Model Provider.

- Node.js 22 or newer
- `npm`
- Visual Studio Code 1.104 or newer
- Visual Studio Code 1.106 or newer

## Development setup

Expand Down
16 changes: 8 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,18 +41,18 @@ You can also set the key anytime via **`Chutes AI: Manage API Key`** in the Comm

## Requirements

- **VS Code 1.104.0 or newer** (the language model provider API). VS Code **1.125+** also lets you discover this extension from the _Language Models_ editor via **Install Model Providers**.
- **VS Code 1.106.0 or newer** (required for image/data chat parts). VS Code **1.125+** also lets you discover this extension from the _Language Models_ editor via **Install Model Providers**.
- A **Chutes API key** (starts with `cpk_`). Create one at [chutes.ai](https://chutes.ai).

## Settings

| Setting | Default | Description |
| -------------------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `chutes.endpoint` | `https://llm.chutes.ai/v1` | OpenAI-compatible API base URL. Change only for self-hosted or proxy endpoints. |
| `chutes.modelFilter` | _(empty)_ | Restrict which models appear. Comma-separated terms matched against the model id as a case-insensitive substring or regex (e.g. `deepseek, qwen` or `Qwen3.*TEE`). Empty shows all chat models. |
| `chutes.requestTimeoutMs` | `15000` | Timeout (ms) for fetching the model list. Does not limit streaming responses. |
| `chutes.autoRouterEnabled` | `true` | Show the **Auto (router)** model that delegates selection and automatic cold/unavailable fallback to Chutes' native router. |
| `chutes.routerEndpoint` | `https://model-router-ten.vercel.app/v1` | Base URL of Chutes' native router, used by the **Auto (router)** model. Change only for a self-hosted router. |
| Setting | Default | Description |
| -------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `chutes.endpoint` | `https://llm.chutes.ai/v1` | OpenAI-compatible API base URL. Change only for self-hosted or proxy endpoints. |
| `chutes.modelFilter` | _(empty)_ | Restrict which models appear. Comma-separated terms use a case-insensitive substring or safe regex (e.g. `deepseek, qwen` or `Qwen3.*TEE`); unsafe or invalid regexes are treated literally. Empty shows all chat models. |
| `chutes.requestTimeoutMs` | `15000` | Timeout (ms) for fetching the model list. Does not limit streaming responses. |
| `chutes.autoRouterEnabled` | `true` | Show the **Auto (router)** model that delegates selection and automatic cold/unavailable fallback to Chutes' native router. |
| `chutes.routerEndpoint` | `https://model-router-ten.vercel.app/v1` | Base URL of Chutes' native router, used by the **Auto (router)** model. Change only for a self-hosted router. |

Changes to any `chutes.*` setting invalidate the model cache immediately; no window reload is required.

Expand Down
2 changes: 1 addition & 1 deletion docs/troubleshooting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
- Make sure an API key is set: run **`Chutes AI: Manage API Key`**.
- Run **`Chutes AI: Refresh Models`** to re-fetch the list.
- Check `chutes.modelFilter` — an over-strict filter can hide everything. Clear it to show all chat models.
- Confirm you are on **VS Code 1.104+**.
- Confirm you are on **VS Code 1.106+**.

## "Could not load models" error

Expand Down
14 changes: 7 additions & 7 deletions docs/user-guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ Models that accept image input (the picker marks them via their capabilities) ca

## Settings

| Setting | Default | Description |
| -------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `chutes.endpoint` | `https://llm.chutes.ai/v1` | OpenAI-compatible API base URL. |
| `chutes.modelFilter` | _(empty)_ | Comma-separated terms (substring or regex) matched against model ids to narrow the picker. Example: `deepseek, qwen` or `Qwen3.*TEE`. |
| `chutes.requestTimeoutMs` | `15000` | Timeout for fetching the model list. |
| `chutes.autoRouterEnabled` | `true` | Show the **Auto (router)** model with automatic model selection and fallback. |
| `chutes.routerEndpoint` | `https://model-router-ten.vercel.app/v1` | OpenAI-compatible endpoint used only by **Auto (router)**. |
| Setting | Default | Description |
| -------------------------- | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `chutes.endpoint` | `https://llm.chutes.ai/v1` | OpenAI-compatible API base URL. |
| `chutes.modelFilter` | _(empty)_ | Comma-separated terms (substring or safe regex) matched against model ids. Unsafe or invalid regexes are treated literally. Example: `deepseek, qwen` or `Qwen3.*TEE`. |
| `chutes.requestTimeoutMs` | `15000` | Timeout for fetching the model list. |
| `chutes.autoRouterEnabled` | `true` | Show the **Auto (router)** model with automatic model selection and fallback. |
| `chutes.routerEndpoint` | `https://model-router-ten.vercel.app/v1` | OpenAI-compatible endpoint used only by **Auto (router)**. |

Setting changes refresh the model list immediately. A custom model or router endpoint receives your API key and request content; configure only services you trust.

Expand Down
58 changes: 17 additions & 41 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 5 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
},
"engines": {
"node": ">=22",
"vscode": "^1.104.0"
"vscode": "^1.106.0"
},
"categories": [
"AI",
Expand Down Expand Up @@ -105,7 +105,7 @@
"chutes.modelFilter": {
"type": "string",
"default": "",
"markdownDescription": "Restrict which models appear in the picker. Comma-separated terms; each is matched against the model id as a case-insensitive substring or a regular expression (e.g. `deepseek, qwen` or `Qwen3.*TEE`). Leave empty to show all chat models."
"markdownDescription": "Restrict which models appear in the picker. Comma-separated terms; each is matched against the model id as a case-insensitive substring or a safe regular expression (e.g. `deepseek, qwen` or `Qwen3.*TEE`). Unsafe or invalid expressions are treated as literal substrings. Leave empty to show all chat models."
},
"chutes.requestTimeoutMs": {
"type": "number",
Expand Down Expand Up @@ -133,18 +133,19 @@
"format:check": "prettier --check .",
"lint:code": "oxlint --deny-warnings src test esbuild.js prettier.config.cjs",
"lint": "npm run check-types && npm run lint:code && npm run format:check",
"audit": "npm audit --audit-level=high",
"compile": "npm run check-types && node esbuild.js",
"watch": "node esbuild.js --watch",
"package": "npm run check-types && node esbuild.js --production",
"test:build": "node test/build.js",
"test": "npm run test:build && node --test test/unit.test.cjs",
"test:live": "esbuild test/harness.ts --bundle --platform=node --format=cjs --outfile=test/harness.cjs --alias:vscode=./test/vscode-stub.cjs && node test/harness.cjs",
"check": "npm run lint && npm test && node esbuild.js --production && vsce ls",
"check": "npm run lint && npm run audit && npm test && node esbuild.js --production && vsce ls",
"vsix": "vsce package"
},
"devDependencies": {
"@types/node": "^22.20.1",
"@types/vscode": "^1.104.0",
"@types/vscode": "1.106.0",
"@vscode/vsce": "^3.2.0",
"esbuild": "^0.28.1",
"oxlint": "^1.76.0",
Expand Down
Loading