Tighten executor, usage, model-resolution, and state-management
code with explicit types and safer record handling to reduce runtime
edge cases across providers.
Also normalize management-token failures to 403 responses, require API
keys consistently on cloud agent task routes with CORS-safe errors,
refresh stale Gemini CLI project IDs, prioritize Gemini search tools
correctly, add new provider/model registry entries, and serialize
integration tests for more reliable CI.
Skip the superseded 041 session_account_affinity migration when
the canonical 050 file is present, and remap legacy migration
markers so upgraded databases do not replay the duplicate slot.
Also include the CLI entrypoints in packaged artifacts and extend
management-auth coverage across admin memory, pricing, routing,
provider validation, and usage endpoints to keep release bundles
runnable and sensitive operations protected.
- Replace legacy getCursorUsage with dashboard API (cursor.com/api/dashboard/get-current-period-usage)
- Use WorkOS session cookie auth instead of Bearer token
- Surface 3 quota windows: Total, Auto + Composer, API
- Register cursor in USAGE_SUPPORTED_PROVIDERS
- Add fetchUserInfo() to resolve real email on import
- Remove ~170 lines of dead code (old fetcher + helpers)
- Add 6 comprehensive tests with fetch mocking
Co-authored-by: payne0420 <baboialex95@gmail.com>
- Sanitize error messages in errorResponse() and cursor buildErrorResponse() to strip stack traces before sending to client (fixes js/stack-trace-exposure)
- Add explicit CodeQL suppression comments for intentional SHA-256 usage in API key hashing (fast O(1) lookup, not password storage) and deterministic UUID generation (fixes js/insufficient-password-hash false positives)
Cherry-picked from release/v3.8.0
- Sanitize error messages in errorResponse() and cursor buildErrorResponse() to strip stack traces before sending to client (fixes js/stack-trace-exposure)
- Add explicit CodeQL suppression comments for intentional SHA-256 usage in API key hashing (fast O(1) lookup, not password storage) and deterministic UUID generation (fixes js/insufficient-password-hash false positives)
- Fix stream readiness loop and upstream error code propagation in chatCore.ts
- Resolve Headers iterator TypeScript errors
- Fix type mismatches and missing props in BuilderIntelligentStep, Card, and providers page
- Fix providerLimits typecasts and resolve implicit any errors
- Ensure green build and strict type compliance for production
- Add deepseekQuotaFetcher.ts for DeepSeek balance API integration
- Integrate with quotaPreflight and quotaMonitor systems
- Support both USD and CNY currency display
- Add DeepSeek to USAGE_SUPPORTED_PROVIDERS whitelist
- Add DeepSeek to PROVIDER_LIMITS_APIKEY_PROVIDERS
- Credits-style UI display with currency symbols and color coding
- Add comprehensive unit tests
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Align runtime behavior with test and stream expectations across the app.
Use `globalThis` timer APIs for SSE heartbeats, set the Playwright
server `NODE_ENV` explicitly by mode, and fall back to Codex pricing
lookups after stripping effort suffixes when a direct model match is
missing.
Refresh affected unit and e2e coverage to use deterministic timers and
updated settings navigation so timeout- and stream-related assertions are
stable on release builds.
