Skip to content
This repository was archived by the owner on May 20, 2026. It is now read-only.
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/extension/byok/common/byokProvider.ts
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ export interface BYOKModelCapabilities {
supportedEndpoints?: ModelSupportedEndpoint[];
zeroDataRetentionEnabled?: boolean;
supportsReasoningEffort?: string[];
extraBody?: Record<string, unknown>;
}

export interface BYOKModelRegistry {
Expand Down Expand Up @@ -121,7 +122,8 @@ export function resolveModelInfo(modelId: string, providerName: string, knownMod
is_chat_fallback: false,
model_picker_enabled: true,
supported_endpoints: knownModelInfo?.supportedEndpoints,
zeroDataRetentionEnabled: knownModelInfo?.zeroDataRetentionEnabled
zeroDataRetentionEnabled: knownModelInfo?.zeroDataRetentionEnabled,
extraBody: knownModelInfo?.extraBody
};
if (knownModelInfo?.requestHeaders && Object.keys(knownModelInfo.requestHeaders).length > 0) {
modelInfo.requestHeaders = { ...knownModelInfo.requestHeaders };
Expand Down
4 changes: 4 additions & 0 deletions src/extension/byok/node/openAIEndpoint.ts
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,10 @@ export class OpenAIEndpoint extends ChatEndpoint {
if (!this.useResponsesApi && body.stream) {
body['stream_options'] = { 'include_usage': true };
}
// Merge extraBody fields (e.g. thinking: {type: "disabled"} for Fireworks)
if (this.modelMetadata.extraBody) {
Object.assign(body, this.modelMetadata.extraBody);
}
Comment on lines +294 to +297

Copilot AI Apr 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Object.assign(body, this.modelMetadata.extraBody) merges unvalidated, user-configurable data into the request body. This can lead to prototype pollution via keys like __proto__, constructor, or prototype, and also produces odd results if extraBody is not a plain object at runtime. Consider validating extraBody is a non-null plain object and filtering out dangerous keys before merging (or doing a safe merge helper).

Copilot uses AI. Check for mistakes.
Comment on lines +294 to +297

Copilot AI Apr 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New behavior merges modelMetadata.extraBody into outgoing requests, but there are existing unit tests for OpenAIEndpoint and none appear to assert this merge behavior. Please add coverage that verifies extraBody fields are applied (and, if you add validation/sanitization, that unsafe keys are ignored).

Copilot uses AI. Check for mistakes.
}
}

Expand Down
4 changes: 3 additions & 1 deletion src/extension/byok/vscode-node/customOAIProvider.ts
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ interface _CustomOAIModelConfig {
editTools?: EndpointEditToolName[];
requestHeaders?: Record<string, string>;
zeroDataRetentionEnabled?: boolean;
extraBody?: Record<string, unknown>;
}

export interface CustomOAIModelConfig extends _CustomOAIModelConfig {
Expand Down Expand Up @@ -142,7 +143,8 @@ export abstract class AbstractCustomOAIBYOKModelProvider extends AbstractOpenAIC
thinking: modelConfiguration?.thinking ?? false,
streaming: modelConfiguration?.streaming,
requestHeaders: modelConfiguration?.requestHeaders,
zeroDataRetentionEnabled: modelConfiguration?.zeroDataRetentionEnabled
zeroDataRetentionEnabled: modelConfiguration?.zeroDataRetentionEnabled,
extraBody: modelConfiguration?.extraBody
};
const modelInfo = resolveModelInfo(model.id, this._name, undefined, modelCapabilities);
if (modelCapabilities?.url?.includes('/responses')) {
Expand Down
1 change: 1 addition & 0 deletions src/platform/endpoint/common/endpointProvider.ts
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,7 @@ export type IChatModelInformation = IModelAPIResponse & {
urlOrRequestMetadata?: string | RequestMetadata;
requestHeaders?: Readonly<Record<string, string>>;
zeroDataRetentionEnabled?: boolean;
extraBody?: Record<string, unknown>;
};

export function isChatModelInformation(model: IModelAPIResponse): model is IChatModelInformation {
Expand Down
Loading