POST /api/playground/improve-prompt: validates body via ImprovePromptRequestSchema,
calls /v1/chat/completions internally with the user-chosen model (D8), parses
improved content via parseImprovedContent, returns { improvedSystem?, improvedPrompt?,
tokensIn, tokensOut }. Auth optional (REQUIRE_API_KEY gate). All errors route
through buildErrorBody/sanitizeErrorMessage (Hard Rule #12).
- 14 tests covering all status transitions (configured/missing/rate_limited)
- Validates 12 search + 3 fetch = 15 provider total count
- Asserts kind field correctness per provider type
- Tests back-compat data array with legacy {id,object,created,name,search_types} shape
- Tests perplexity-search credential fallback to perplexity
- Validates response against SearchProviderCatalogResponseSchema (Zod)
- Tests 401 behavior when auth is required
Expande os workflows de release para incluir auditoria de segurança,
CHANGELOG completo por commits, quality gate obrigatório, homologação em
VPS local, publicação oficial, deploy em Akamai e validação de artefatos.
Reorganiza a triagem de features com arquivos permanentes por bucket,
suporte a itens em andamento, regra de reclaim após 15 dias e novo
tratamento para ideias viáveis catalogadas.
Corrige a orientação de revisão de discussões para usar a ordem
cronológica real dos comentários e respostas ao identificar a última
atividade.
- mitm-handler-base: hookBufferStart returns InterceptedRequest with
sanitized headers, extractSourceModel parses body.model, writeError
emits JSON with sanitized message (Hard Rule #12).
- mitm-handler-<id>: nine per-agent happy-path tests (antigravity,
kiro, copilot, codex, cursor, zed, claude-code, open-code) exercise
full intercept() with mocked fetch via _mitmHandlerHarness.ts;
asserts mapped model is forwarded and AgentBridge correlation
headers are present. Trae test confirms intercept() rejects with a
structured error.
- mitm-targets-resolve: ALL_TARGETS contains 9 entries; resolveTarget
is case-insensitive and returns null for unknown hosts.
- mitm-targets-route: bypass > target > passthrough precedence
validated against representative hostnames.
- mitm-detection: DETECTORS covers every AgentId; detectAgent never
throws and returns DetectionResult-shaped objects for all probes.
PRE-hook (before executor dispatch):
- Calls enforceQuotaShare via dynamic import (lazy load, fail-open).
- Returns 429 JSON via buildErrorBody() when decision.kind === 'block' (B25).
- Sets quotaSoftDeprioritize=true when decision.deprioritize=true (B17).
POST-hook (after successful response):
- Calls scheduleRecordConsumption for both streaming and non-streaming paths.
- Fire-and-forget via setImmediate; never blocks the client response (B29).
Both hooks use try/catch outer guards so any unexpected error fails open (B16).
scheduleRecordConsumption() wraps recordConsumption() in setImmediate so it
never adds latency to the client response path. Errors are caught and logged
via pino warn but NEVER propagated to the caller (B29 fail-open contract).
Implements the quota share enforcement gate and consumption recorder:
- enforceQuotaShare(): PRE-request check that returns allow/block/deprioritize
based on fair-share algorithm, saturation signals, and pool allocations.
- recordConsumption(): POST-response tracker that increments per-key counters
for each active plan dimension.
Both functions fail-open per B16/B29: any infra error → allow + warn log.
Adds 5 new settings route handlers for CLIs introduced by plan 14 that
declare configType:"custom" and need automated config file persistence:
forge (~/.forge/config.toml), jcode (~/.jcode/config.json),
deepseek-tui (~/.config/deepseek-tui/config.toml),
smelt (~/.smelt/config.json), pi (~/.pi/config.json).
Also registers the 5 tools in cliRuntime.ts path table so
getCliPrimaryConfigPath() resolves their config paths correctly.
Each handler follows the established pattern: requireCliToolsAuth guard on
every exported method, Zod body validation on POST, buildErrorBody/
sanitizeErrorMessage on all error paths (Hard Rule #12), fs/promises only
(no exec/spawn — Hard Rule #13), saveCliToolLastConfigured on success.
Integration tests: 7 subtests per handler (401 without auth, 200 GET,
400 missing-baseUrl, 400 missing-model, 200 POST writes file, 200 DELETE,
error sanitization + no exec/spawn static audit).
- compliance-tab-actor-filter.test.tsx: 4 tests verifying actor input
presence, initial fetch has no actor param, re-fetch with actor=X
after typing, and clearFilters does not throw.
- compression-log-namespace.test.tsx: 4 tests verifying that the logs
namespace is used (not settings), no _MISSING_ sentinels, and all 4
required keys are covered.
- compliance.actor / compliance.actorPlaceholder added to pt-BR + en
- logs.compressionLogTitle, logs.compressionLogEmpty, logs.tokens copied
from settings to logs namespace in both locales (original keys kept in
settings to avoid breaking other components)
The component was calling useTranslations("settings") which would cause
key misses once the settings namespace is reorganized. Keys used
(loading, compressionLogTitle, compressionLogEmpty, tokens) are now
sourced from the canonical "logs" namespace.
Adds state, fetch param, reset and input+datalist for filtering audit
entries by actor. The actor field is inserted between eventType and
severity in the filter grid. Filter value is sent as ?actor= to the
compliance audit-log API on every change.
