Merge origin/main into devin/1785721011-security-process-tools

Both conflicts were additive collisions: an import block that gained a line on
each side, and two test suites appending cases at the same point in the file.

tests/test_inputs.py

@@ -300,6 +300,16 @@ def test_make_model_settings_forces_required_for_anyllm_routed_openai_model() ->
     assert settings.tool_choice == "required"
 
 
+def test_make_model_settings_disables_parallel_tool_calls_by_default() -> None:
+    assert make_model_settings("none", model_name="gpt-4o").parallel_tool_calls is False
+
+
+def test_make_model_settings_omits_parallel_tool_calls_without_tools() -> None:
+    settings = make_model_settings("none", model_name="gpt-4o", has_tools=False)
+
+    assert settings.parallel_tool_calls is None
+
+
 def test_make_model_settings_sets_request_timeout() -> None:
     settings = make_model_settings(
         "none",
@@ -381,3 +391,32 @@ def test_scan_targets_drop_empty_and_duplicate_entries() -> None:
     }
 
     assert build_scan_targets(config) == ["https://app.example.com"]
+
+
+def test_openrouter_attribution_rides_on_the_request_headers() -> None:
+    # litellm.headers is ignored once a request carries any header of its own,
+    # so the attribution must be part of the per-request headers.
+    headers = make_model_settings(
+        None, model_name="openrouter/anthropic/claude-sonnet-4-5"
+    ).extra_headers
+    assert headers == {
+        "HTTP-Referer": "https://strix.ai",
+        "X-Title": "Strix",
+        "X-OpenRouter-Categories": "cli-agent",
+    }
+
+
+def test_openrouter_attribution_absent_for_other_providers() -> None:
+    assert make_model_settings(None, model_name="anthropic/claude-sonnet-4-5").extra_headers is None
+
+
+def test_user_headers_override_openrouter_attribution() -> None:
+    headers = make_model_settings(
+        None,
+        model_name="openrouter/anthropic/claude-sonnet-4-5",
+        extra_headers={"X-Title": "Custom", "X-Tenant": "acme"},
+    ).extra_headers
+    assert headers is not None
+    assert headers["X-Title"] == "Custom"
+    assert headers["X-Tenant"] == "acme"
+    assert headers["HTTP-Referer"] == "https://strix.ai"