Close two defense-in-depth gaps surfaced by the v3.8.1 release vulnerability scan:
- Field-level credential encryption (src/lib/db/encryption.ts) and the CLI
decrypt path (bin/cli/encryption.mjs) now pass authTagLength: 16 to every
createDecipheriv call. Authentication was already enforced via setAuthTag +
final(), but pinning the tag length rejects truncated GCM tags up front,
closing the tag-truncation forgery vector (Semgrep gcm-no-tag-length).
- MermaidDiagram switches securityLevel from "loose" to "strict" (Mermaid's
default), so the rendered SVG is sanitized by Mermaid's bundled DOMPurify
before the innerHTML assignment.
Adds a regression test asserting decrypt() fails closed on a truncated auth tag.
Repeat markup stripping until the input stabilizes so malformed or
nested tags do not survive a single replacement pass.
This prevents incomplete sanitization from leaving tag fragments in
removed text and improves i18n key candidate extraction from diffs.
Replace compile-time-only 'as string' casts with runtime String() conversions
and instanceof Date check. gray-matter parses unquoted YAML dates as Date
objects, causing 'Objects are not valid as a React child' crashes on docs pages.
Co-authored-by: Mr. Meowgi <ovehbe@users.noreply.github.com>
Replace all Database.Database and import("better-sqlite3").Database
references in migrationRunner.ts, stats.ts, jsonMigration.ts, and
compliance/index.ts with SqliteAdapter from db/adapters/types.ts.
Also removes the now-unnecessary @ts-expect-error comment on
db.immediate() in migrationRunner.ts.
Follow-up to PR #2440 review. Today the toggle is a single boolean that
injects service_tier=priority globally for every Codex request. Two small
extensions that came up:
- Tier dropdown (default / priority / flex). Default = no override; flex
routes the request through OpenAI's lower-priority queue and is cheap
enough that some users want to opt in globally for batch/eval work.
- Per-model gate. The toggle's intent is "Fast tier for the models that
actually support it" — gpt-5.5 and gpt-5.4 per OpenAI's models_cache.json
(service_tiers: priority). Other Codex slugs were silently receiving the
service_tier header and getting a tier-related error from OpenAI. The
checkbox list lets users curate the supported set without code changes
when a future Codex release adds Fast eligibility to more slugs.
Schema (settingsSchemas.ts):
codexServiceTier: z.object({
enabled: z.boolean().optional(),
tier: z.enum(["default", "priority", "flex"]).optional(),
supportedModels: z.array(z.string()).optional(),
}).optional()
Back-compat: rows with just `{ enabled: true }` from PR #2440 still work —
resolveCodexGlobalFastServiceTier() defaults `tier` to "priority" and
`supportedModels` to ["gpt-5.5", "gpt-5.4"] when those fields are absent.
The legacy boolean shape and the older `codexFastServiceTier: true` flag
are also still honored.
Middleware (open-sse/handlers/chatCore.ts):
- applyCodexGlobalFastServiceTier now takes an optional { model, body }.
- Gate: skip injection when the request's target model does not match the
supportedModels prefix list (case-insensitive). Calls without a model
argument keep the original behavior, so any other call sites stay safe.
- For tier=flex, the helper writes body.service_tier directly because
requestDefaults goes through normalizeCodexServiceTier which only
canonicalizes priority/fast. Per-connection requestDefaults.serviceTier
still wins over the global override.
UI (CodexFastTierTab.tsx):
- Top-level boolean toggle stays unchanged.
- When enabled: tier <Select> and a collapsible "Applied to models" list
with checkboxes. Initial selection matches the Fast-eligible catalog;
users can add slugs by storing them in supportedModels.
i18n: en/fr/es/de hand-translated. The other 38 locales get the standard
__MISSING__: sentinel so scripts/i18n/sync-ui-keys.mjs can fill them in a
subsequent translator pass — same pattern PR #2440 used.
Default behavior is unchanged: existing connections keep their
requestDefaults.serviceTier precedence, the toggle still defaults off,
and old enabled=true rows continue to inject service_tier=priority for
gpt-5.5 / gpt-5.4.
Happy to revise if you'd prefer a different shape.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds an opt-in toggle for Anthropic Fast Mode (speed:"fast") on the
Settings > AI page, mirroring the existing CodexFastTierTab pattern. The
behavior pairs with a CLIProxyAPI build that opts SDK-shaped traffic into
the Fast Mode entrypoint; OmniRoute signals the intent via a single
outbound header. Builds of CPA that do not recognize the header forward
it harmlessly.
- New helper: src/lib/providers/claudeFastMode.ts exposes
isClaudeFastModeEnabled / getClaudeFastModeSupportedModels /
shouldRequestClaudeFastMode plus the CPA_FORCE_FAST_MODE_HEADER
constant ("X-CPA-Force-Fast-Mode").
- New Card component: ClaudeFastModeTab.tsx — same Card+Toggle shape
as CodexFastTierTab.tsx, with a collapsible per-model checkbox group
(defaults to claude-opus-4-7 and claude-opus-4-6, matching the binary
KT() gate observed in claude-code v2.1.145).
- Schema: claudeFastMode { enabled?, supportedModels? } added to
updateSettingsSchema and to the getSettings() defaults.
- Middleware: buildUpstreamHeadersForExecute in chatCore.ts now sets
X-CPA-Force-Fast-Mode: 1 when provider === "claude" and the model
matches the configured supportedModels list.
- i18n: 6 new keys added with hand translations for en/fr/es/de and
__MISSING__: sentinels for the remaining 38 locales so a subsequent
scripts/i18n/sync-ui-keys.mjs pass can fill them in.
Default behavior is unchanged: the toggle defaults off, so accounts
that have not opted in keep their existing claude request flow. Even
when enabled, Anthropic enforces subscription tier and Fast Mode credit
balance server-side — the toggle may still surface out_of_credits or a
similar 429 from upstream.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- map is_error to status "error"/"success" instead of hardcoding "success"
- add serializeToolResultContent() to handle image/JSON content blocks;
avoids sending text:\"\" which Kiro rejects as improperly formed
- use deterministic uuidv5 for toolUseId when tool_call has no id, preventing
id mismatch between assistant toolUse and subsequent tool_result
Closes#2446
openAIToClaude now extracts developer-role messages into systemParts
(alongside system role) and filters them from nonSystemMessages, so
identity context injected via the Responses API developer role reaches
the Claude system field instead of silently becoming an assistant turn.
The cliproxyapi sidecar (service + named volume + DOCKER_GUIDE.md docs)
was accidentally dropped in 3ff3e3dd1, a commit whose message only
mentioned a ChatPlayground guard. Restore the pre-removal version of
docker-compose.yml and docs/guides/DOCKER_GUIDE.md from 49fe356b9 —
re-adds the `cliproxyapi` profile on port 8317 and the cliproxyapi-data
volume while preserving the docs YAML frontmatter.
