mirror of
https://github.com/vxcontrol/pentagi.git
synced 2026-07-10 14:17:11 +00:00
4c0f4204ca
The GraphQL createProvider/updateProvider path applied no field validation, so a direct API call (bypassing the browser's native HTML5 form validation) could persist nonsensical values (temperature 99, negative price, an inverted min/max length window, a reasoning budget over the 32000 engine cap). Add ProviderConfig.Validate()/AgentConfig.Validate(), called after patchProviderConfig in both CreateProvider and UpdateProvider. It is deliberately permissive — 0 means "unset" and provider-specific tuning ranges remain the LLM API's responsibility — so it only rejects universally-invalid values and never a valid provider-specific config. Found during comprehensive provider QA. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>