Increase PBKDF2 iterations for federation auth and server API key
hashes to better resist brute-force attacks and keep hashing behavior
aligned across leaderboard, score, and server connection flows.
Regenerate auto-generated docs entries for the Kiro setup,
gamification, and dashboard shakedown guides.
Error message sanitization (Hard Rule #12):
- claude-auth/export, codex-auth/export, gemini-cli-auth/export routes: replace
raw err.message with sanitizeErrorMessage() from open-sse/utils/error.ts
- imageGeneration, musicGeneration, videoGeneration handlers: import
sanitizeErrorMessage and replace all err.message in return values
- veoaifree-web executor: replace raw upstream response data in errResp() calls
with static strings
OAuth callback page (callback/page.tsx):
- Remove useSearchParams/Suspense dependency that caused hydration failures in
popup windows navigating back from Google OAuth (COOP header severs opener)
- Use window.location.search directly in useEffect with three send methods:
postMessage, BroadcastChannel, localStorage
- Fix postMessage target from "*" to window.location.origin (semgrep finding)
- Move setCurrentUrl call to manual-only branch to avoid unnecessary renders
copilot-web executor:
- Move accessToken from WebSocket URL query string to Authorization header
(avoids credential exposure in server logs)
- Add MAX_POOL_SIZE=100 cap to sessionPool with LRU eviction of oldest entry
CodeQL ReDoS fixes (js/polynomial-redos #233-240):
- Replace while(s.endsWith("/")) s=s.slice(0,-1) pattern (O(n²) allocations)
with index-based loop (O(n) time, single final slice) in:
bin/cli/api.mjs, all 6 cli-helper config generators, opencode-provider
Gemini OAuth:
- mapTokens: add idToken field to fix "missing id_token" export error
Every .md under docs/{architecture,guides,reference,frameworks,routing,
security,compression,ops,diagrams} plus docs/README.md now opens with:
---
title: "<inferred from first H1>"
version: 3.8.0
lastUpdated: 2026-05-13
---
46 files updated (no docs were skipped — none had pre-existing
frontmatter). [slug]/page.tsx already reads frontmatter.version and
frontmatter.lastUpdated via gray-matter and renders a "v3.8.0" pill
plus a "Last updated" caption, so the UI picks these up automatically.
Helper: scripts/docs/add-frontmatter.mjs — idempotent (skips files that
already start with `---`), falls back to a humanized basename when no
leading H1 exists. Excludes docs/i18n/, docs/screenshots/,
docs/superpowers/, docs/diagrams/exported/. Re-runnable safely.
Also regenerated src/app/docs/lib/docs-auto-generated.ts: 44 docs across
8 sections (Architecture / Guides / Reference / Frameworks / Routing /
Security / Compression / Ops), which now includes the 14 docs that were
missing from the v3.7 sidebar (Cloud Agents, Guardrails, Memory, Skills,
Webhooks, Evals, Authz, Agent Protocols, Repository Map, Provider
Reference, Reasoning Replay, Stealth Guide, Tunnels Guide, Electron
Guide).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reorganizes /docs into 8 subfolders (architecture, guides, reference, frameworks,
routing, security, compression, ops). Resolves two conflicts:
- scripts/docs/gen-provider-reference.ts: combined FASE 1's new __dirname-based
ROOT (two levels up from scripts/docs/) with FASE 3's new output path
(docs/reference/PROVIDER_REFERENCE.md).
- scripts/check-env-doc-sync.mjs: deleted by FASE 1, modified by FASE 3; FASE 1's
delete wins (file is at scripts/check/ now). The FASE 3 intent (point to
docs/reference/ENVIRONMENT.md) was applied to the strict checker at the new path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- src/app/docs/lib/docs-auto-generated.ts is regenerated from docs/<sub>/ with
fileName values like "architecture/ARCHITECTURE.md". The dynamic slug page
joins these against process.cwd()/docs so resolution still works.
- src/app/api/openapi/spec/route.ts now looks for the spec at
docs/reference/openapi.yaml first, with the flat-path fallback retained for
older bundles.
- tests updated: integration-wiring expects docs/reference/{API_REFERENCE.md,
openapi.yaml}; docs-site-overhaul reflects the new 8-section nav titles
(Architecture, Guides, Reference, Frameworks, Routing, Security, Compression,
Ops) and the new section for setup-guide ("Guides").
- open-sse/mcp-server/README.md picks up the rewritten docs/ reference.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tighten executor, usage, model-resolution, and state-management
code with explicit types and safer record handling to reduce runtime
edge cases across providers.
Also normalize management-token failures to 403 responses, require API
keys consistently on cloud agent task routes with CORS-safe errors,
refresh stale Gemini CLI project IDs, prioritize Gemini search tools
correctly, add new provider/model registry entries, and serialize
integration tests for more reliable CI.
* chore: add GPT-5.5 Instant and support Node 26 (#1977)
chore: add GPT-5.5 Instant model to Codex registry + Node 26 support with CI + improved native SQLite error handling. Integrated into release/v3.7.9
* feat: enhance cost formatting and add Codex GPT-5.5 pricing support
* fix formatting
---------
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Jan Leon <jan.gaschler@gmail.com>
Co-authored-by: 05dunski <05dunski-kredo@icloud.com>
