Files
moltbot/src/config/types.provider-request.ts
Qasim Soomro 71617ef2f0 fix: allow private network provider request opt-in (#63671)
* feat(models): allow private network via models.providers.*.request
Add optional request.allowPrivateNetwork for operator-controlled self-hosted
OpenAI-compatible bases (LAN/overlay/split DNS). Plumbs the flag into
resolveProviderRequestPolicyConfig for streaming provider HTTP and OpenAI
responses WebSocket so SSRF policy can allow private-resolved model URLs
when explicitly enabled.
Updates zod schema, config help/labels, and unit tests for sanitize/merge.

* agents thread provider request into websocket stream

* fix(config): scope allowPrivateNetwork to model requests

* fix(agents): refresh websocket manager on request changes

* fix(agents): scope runtime private-network overrides to models

* fix: allow private network provider request opt-in (#63671) (thanks @qas)

---------

Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-04-10 11:11:03 +05:30

48 lines
1.0 KiB
TypeScript

import type { SecretInput } from "./types.secrets.js";
export type ConfiguredProviderRequestAuth =
| {
mode: "provider-default";
}
| {
mode: "authorization-bearer";
token: SecretInput;
}
| {
mode: "header";
headerName: string;
value: SecretInput;
prefix?: string;
};
export type ConfiguredProviderRequestTls = {
ca?: SecretInput;
cert?: SecretInput;
key?: SecretInput;
passphrase?: SecretInput;
serverName?: string;
insecureSkipVerify?: boolean;
};
export type ConfiguredProviderRequestProxy =
| {
mode: "env-proxy";
tls?: ConfiguredProviderRequestTls;
}
| {
mode: "explicit-proxy";
url: string;
tls?: ConfiguredProviderRequestTls;
};
export type ConfiguredProviderRequest = {
headers?: Record<string, SecretInput>;
auth?: ConfiguredProviderRequestAuth;
proxy?: ConfiguredProviderRequestProxy;
tls?: ConfiguredProviderRequestTls;
};
export type ConfiguredModelProviderRequest = ConfiguredProviderRequest & {
allowPrivateNetwork?: boolean;
};