dev_agentandClaude Opus 5.5
799e7b62d0
GET /settings/ai/models now removes the stored API key from every model ID and display name the provider returns, so a provider that echoes the key in a successful list cannot disclose it. PATCH /settings/ai gets its own body limit, sized for 8,000 characters at 12 bytes of JSON each (a \u-escaped surrogate pair) plus the other fields. A valid prompt of three- or four-byte characters was refused by the shared 16 KiB limit; the 8,000-character rule stays the only limit on the prompt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>