From 87564304e102d3ddc41cceb068892d3ff3ceb1e8 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Date: Fri, 29 May 2026 08:43:21 -0300 Subject: [PATCH] fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact) (#2895) * fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact) Three CI gates failed on release/v3.8.6 (run 26630300877): - docs-sync: CHANGELOG had a spurious "## [3.8.6-patch]" section above "## [3.8.6]", so the latest release no longer matched package.json (3.8.6) and the 41 i18n CHANGELOG mirrors were flagged as missing that section. Fold the lone #2752 entry into [3.8.6] and drop the patch heading. - any-budget:t11: open-sse/handlers/chatCore.ts regressed to 1 explicit `any` (budget 0). Type the persist callback arg as Record, which matches runWithOnPersist's RefreshPersistFn contract exactly. - pack-artifact: open-sse/utils/setupPolyfill.ts ships via package.json "files" (bin/omniroute.mjs imports it at startup) but was missing from the pack policy allowlist. Allow it and add a regression test. * fix(security): redact public Firebase Web key from windsurf spec Redact the literal public Firebase Web API key (secret-scanning #7) to a placeholder, mirroring the redaction on release/v3.8.6 (PR #2894) and the windsurf fix branch. Non-sensitive public Web key; trips secret scanning. --- CHANGELOG.md | 9 +-------- open-sse/handlers/chatCore.ts | 2 +- scripts/build/pack-artifact-policy.ts | 3 +++ tests/unit/pack-artifact-policy.test.ts | 9 +++++++++ 4 files changed, 14 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 109645c40e..37959fa42b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -33,14 +33,6 @@ --- -## [3.8.6-patch] — 2026-05-27 - -### 🔧 Bug Fixes - -- **fix(cli):** replace `cli-table3` dependency with a ~50-line hand-rolled ASCII formatter to resolve Node 24 / ESM interop breakage and remove tourniquet `package.json` overrides pinning `ansi-regex@^5`, `strip-ansi@^6`, `string-width@^4` ([#2752]) - ---- - ## [3.8.6] — 2026-05-27 ### ✨ New Features @@ -60,6 +52,7 @@ ### 🔧 Bug Fixes - **cli:** restore `omniroute logs` command — create missing `/api/cli-tools/logs` route that `log-streamer.ts` was calling, returning filtered pino log entries with `follow` and `filter` query-param support (#2756) +- **cli:** replace `cli-table3` dependency with a ~50-line hand-rolled ASCII formatter to resolve Node 24 / ESM interop breakage and remove tourniquet `package.json` overrides pinning `ansi-regex@^5`, `strip-ansi@^6`, `string-width@^4` (#2752) - **fix(opencode-go,opencode-zen):** mark qwen3.7-max / 3.6-plus / 3.5-plus as supportsVision:false to stop forwarding image blocks to vision-incapable upstream models ([#2822]) - **nous-research:** append /chat/completions to provider baseUrl so DefaultExecutor's default URL builder hits the correct endpoint instead of returning 404 ([#2826]) - **fix(quota):** honor explicit per-connection `quotaPreflightEnabled: false` even when the provider has global window defaults — adds early-return guard before the AND-of-negations gate in auth.ts ([#2831]) diff --git a/open-sse/handlers/chatCore.ts b/open-sse/handlers/chatCore.ts index 99107250f4..49ebfcdc6c 100644 --- a/open-sse/handlers/chatCore.ts +++ b/open-sse/handlers/chatCore.ts @@ -4120,7 +4120,7 @@ export async function handleChatCore({ // which path executed so we don't double-fire (race-prone) or skip (regression). let persistFnRan = false; const persistFn = onCredentialsRefreshed - ? async (refreshResult: any) => { + ? async (refreshResult: Record) => { persistFnRan = true; // Mutate the shared credentials object so subsequent executor calls // in this request see the new tokens. Runs INSIDE the mutex. diff --git a/scripts/build/pack-artifact-policy.ts b/scripts/build/pack-artifact-policy.ts index 6b8734df5c..bb03860db4 100644 --- a/scripts/build/pack-artifact-policy.ts +++ b/scripts/build/pack-artifact-policy.ts @@ -72,6 +72,9 @@ export const PACK_ARTIFACT_ROOT_ALLOWED_EXACT_PATHS: string[] = [ "open-sse/mcp-server/runtimeHeartbeat.ts", "open-sse/mcp-server/scopeEnforcement.ts", "open-sse/mcp-server/server.ts", + // Runtime polyfill eagerly imported by bin/omniroute.mjs (Node <22 compat); + // shipped via package.json "files", so it must be allowed in the tarball. + "open-sse/utils/setupPolyfill.ts", "package.json", "scripts/build/build-next-isolated.mjs", "scripts/check/check-supported-node-runtime.ts", diff --git a/tests/unit/pack-artifact-policy.test.ts b/tests/unit/pack-artifact-policy.test.ts index 429dddc704..1541f86863 100644 --- a/tests/unit/pack-artifact-policy.test.ts +++ b/tests/unit/pack-artifact-policy.test.ts @@ -56,6 +56,15 @@ test("findUnexpectedArtifactPaths flags app pack files outside the allowlist", ( assert.deepEqual(unexpectedPaths, ["app/scripts/build/prepublish.mjs", "docs/extra.md"]); }); +test("setupPolyfill.ts is allowed in the tarball (bin/omniroute.mjs imports it at startup)", () => { + const unexpectedPaths = findUnexpectedArtifactPaths(["open-sse/utils/setupPolyfill.ts"], { + exactPaths: PACK_ARTIFACT_ALLOWED_EXACT_PATHS, + prefixPaths: PACK_ARTIFACT_ALLOWED_PATH_PREFIXES, + }); + + assert.deepEqual(unexpectedPaths, []); +}); + test("findMissingArtifactPaths flags missing root runtime files in the tarball", () => { const missingPaths = findMissingArtifactPaths( [