4332e1a5dd
Squashed from claude/fervent-booth-fb7b1f. Hardens resolveModelPolicy against prototype pollution and fixes resolveModelForTier to check model_policy before dynamic_routing. 199 tests green.
395 B
395 B
type, pr
| type | pr |
|---|---|
| Security | 572 |
Hardened resolveModelPolicy against prototype pollution: Object.hasOwn guards now block __proto__ / constructor keys in user-supplied provider/budget/runtime_tiers from reaching inherited prototype slots. Also fixed resolveModelForTier to check model_policy before dynamic_routing so provider presets are not silently bypassed when dynamic routing is enabled.