fix(providers): honor allowed_tools, strict and developer role on Gemini and Anthropic - #1091

Preview deployment for your docs. Learn more about Mintlify Previews.

💡 Tip: Enable Automations to automatically generate PRs for you.

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

Merge Risk: 🟡 Moderate · up to 19322

Strict Anthropic tools whose object properties are split across allOf branches can reject otherwise valid combined arguments. Resolve or explicitly accept this compatibility regression before merging.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 19322

Tool restrictions are more faithfully forwarded, but the Anthropic role mapping may erase the distinction between system and developer instructions. Whether that creates an exploitable authority change depends on who can supply each role.

Retained concerns

• Medium · security · inferred: Anthropic translation gives developer messages the same system-content placement as system messages. If a caller combines trusted system instructions with less-trusted developer messages, the translation no longer represents their distinct priorities; effective exposure depends on upstream role ownership, which is not established here.

• Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{A rabbit checks the tools at dawn,
Strict schemas get their edges drawn.
Developer words join system’s stream,
Gemini modes follow each scheme.
I hop away beneath the moon,
With tests that keep the paths in tune.}

_{Comment @coderabbitai help to get the list of available commands.}

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 97.43590% with 1 line in your changes missing coverage. Please review.

📢 Thoughts on this report? Let us know!

Confidence Score: 5/5

[Medium risk] Adds tool configuration options to Anthropic and Gemini providers.

The PR appears safe to merge. No new issue remains after the latest test fixes.

sequenceDiagram
    participant Client
    participant GoModel
    participant Gemini
    participant Anthropic

    alt Gemini native chat
        Client->>GoModel: Chat request with tools
        GoModel->>GoModel: Read strict and allowed tools
        GoModel->>Gemini: generateContent with AUTO, ANY, NONE, or VALIDATED
        Gemini-->>GoModel: Model response or allowed tool calls
    else Anthropic chat
        Client->>GoModel: Chat request with developer messages and tools
        GoModel->>GoModel: Move developer text to system content
        GoModel->>GoModel: Clean strict tool schemas
        GoModel->>Anthropic: Messages request with system content and strict tools
        Anthropic-->>GoModel: Model response or tool calls
    else Anthropic Messages ingress
        Client->>GoModel: Messages request with strict tools
        GoModel->>GoModel: Keep strict on converted tools
        GoModel->>Gemini: Translated request when Gemini is selected
        GoModel->>Anthropic: Native request when Anthropic is selected
    end

_{Reviews (4) · Last reviewed commit: "test: require tool map shapes before rea..."}

TREX

No user flows identified for testing.

AI Generated comment:

@coderabbitai About the remaining allOf merge risk in the summary: I'm explicitly accepting it. I tested every variant against the live APIs.

• allOf branches only (nested): Anthropic strict merges them and returns properties from all branches. This works.
• Parent properties/required plus allOf branches, strict: Anthropic returns a clear 400 ("Cannot merge allOf schemas: sibling keys conflict…"). It does not silently reject valid arguments. Sending the schema unsanitized is also a 400 ("'additionalProperties' must be explicitly set to false"), so no sanitizer change can make this shape work in Anthropic's strict mode.
• OpenAI strict mode rejects allOf in every form ("'allOf' is not permitted"). A request with strict: true and allOf is therefore already invalid under the OpenAI contract GoModel accepts, so no working OpenAI client sends it.

Before this PR, such a request "worked" only because strict was silently dropped, which is exactly what #1055 reported. A 400 that names the problem is the intended outcome. Non-strict tools are not sanitized and are unaffected.

@SantiagoDePolonia, thanks for testing these cases against the live APIs. I used your earlier clarification that Anthropic merges nested allOf branches in strict tool schemas.

The remaining allOf risk I described does not apply to valid OpenAI strict-tool requests. The conflicting sibling-key shape returns a clear 400, and non-strict tools are unaffected. I withdraw that concern.

Learnt from: SantiagoDePolonia
URL: https://github.com/ENTERPILOT/GoModel/pull/1091

Timestamp: 2026-09-25T19:36:34.425Z
Learning: In ENTERPILOT/GoModel PR `#1091`, live API tests found that Anthropic strict tools reject a schema with parent `properties` or `required` alongside `allOf` branches with a 400 sibling-key conflict; sending that shape unsanitized also returns a 400 because `additionalProperties` is not explicitly false. OpenAI strict tools reject `allOf` in every form. Before this PR, GoModel silently dropped `strict` for these tools; non-strict tool schemas are not sanitized by the Anthropic translation.

Learnt from: SantiagoDePolonia
Repo: ENTERPILOT/GoModel PR: 1091
File: internal/providers/anthropic/request_translation.go:140-140
Timestamp: 2026-09-25T17:50:19.115Z
Learning: For Anthropic strict tool schemas in `internal/providers/anthropic/request_translation.go`, `sanitizeAnthropicSchema` closes each nested object-valued `allOf` branch with `additionalProperties: false`. Anthropic's live API accepts this form and merges properties across the branches. Do not infer that standard JSON Schema `allOf` validation makes these strict tool schemas unusable. Anthropic rejects top-level `allOf` in tool `input_schema`, regardless of `strict`.

You are interacting with an AI system.