An agent-level `generate_content_config.http_options.base_url` is copied into
every LlmRequest and overrides the client transport, so the configured API key
and the full prompt/response traffic are sent to that host. Nothing rejected
it, so a supplied agent config (including a YAML one) could redirect a
credentialed model call to an arbitrary endpoint.
`http_options.extra_body` is recursively merged into the serialized request
body just before it is sent, and the merge aligns the incoming key case to the
target, so it can overwrite `systemInstruction`, `tools` and `generationConfig`
— the exact fields the other three checks in this validator exist to reject.
It bypassed all of them.
Reject both in the field validator. Request-time `http_options` such as
headers, timeout, and retry options are unaffected; `base_url` belongs on the
model or its client, which is already why `RunConfig.http_options` deliberately
does not merge it.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 953629510
George Weale
472e4635fb