mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-25 00:51:28 +02:00
acfad1a384
Three open review findings. The discovery filter treated every slash in a listed id as a gateway prefix and matched the tail against the policy. A self-hosted id carries slashes of its own, and an upstream may scope ids per tenant, so "tenant-b/claude-sonnet-5" matched a permitted "claude-sonnet-5" and reached the picker — a model the policy never named, and one the guardrail denies on sight, since enforcement compares the id as written. Strip only the namespaces a gateway is known to prepend, taken from the first slash rather than the last. The e2e retry loops slept between attempts without watching the context, so a cancelled run kept retrying calls that fail instantly and spent its remaining window sleeping between them. They now stop when the context is done. The streamed provider's setup key outlived its test: deleting the group does not delete the key that auto-joins it.