fix(egress): remove implicit provider routes

2026-05-28 19:04:49 -04:00
parent 9399626ba6
commit c31845a5b8
5 changed files with 35 additions and 90 deletions
@@ -42,9 +42,8 @@ class TestBuildConfig(unittest.TestCase):
            },
            cfg["request_body_scanning"],
        )
-        # Baked defaults always present.
-        self.assertIn("api.anthropic.com", cast(list[str], cfg["api_allowlist"]))
-        self.assertIn("raw.githubusercontent.com", cast(list[str], cfg["api_allowlist"]))
+        # No provider defaults are injected implicitly.
+        self.assertEqual([], cast(list[str], cfg["api_allowlist"]))
        # pipelock has no SSH carve-outs at all — neither
        # trusted_domains nor ssrf are emitted from bottle data.
        self.assertNotIn("trusted_domains", cfg)