Diego Rodrigues de Sa e Souza 898e2bfcaa fix(sse): replace spoofable .includes() PromptQL issuer check with hostname comparison (#8029) (#8042) ...

isDdnProjectPromptQlToken() (jwt.ts) and isLikelyDdnToken() (usage/promptql.ts) used
`iss.includes("auth.pro.hasura.io")`, which a spoofed issuer like
"https://auth.pro.hasura.io.evil.com/ddn/token" also satisfies
(js/incomplete-url-substring-sanitization, 2 open CodeQL high alerts).

Adds a shared issuerHostIsTrusted() helper in jwt.ts that parses `iss` with `new URL()`
and compares the hostname (exact match or trusted subdomain), and points both call
sites at it, de-duplicating the previously copy-pasted predicate.

2026-07-21 21:42:36 -03:00

..

__tests__

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

accountFallback

perf(db): cap modelLockouts eviction at 1000 entries (#6923)

2026-07-18 11:33:53 -03:00

autoCombo

fix(auto): pool accounts by provider model (#7928)

2026-07-21 12:17:18 -03:00

combo

[defer] feat(combo): universal cooldown-aware retry & auto-strategy combo-ref guard (#7301)

2026-07-21 16:30:37 -03:00

compression

fix(compression): skip CCR on tool outputs to preserve agent loop (#7869)

2026-07-20 15:56:27 -03:00

promptql

fix(sse): replace spoofable .includes() PromptQL issuer check with hostname comparison (#8029) (#8042)

2026-07-21 21:42:36 -03:00

rateLimitManager

feat: rate-limit queue admission control (maxQueueDepth + 15s default) (#6593) (#7649)

2026-07-18 03:07:20 -03:00

sessionPool

Release v3.8.40

2026-06-29 08:40:06 -03:00

tokenRefresh

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

usage

fix(sse): replace spoofable .includes() PromptQL issuer check with hostname comparison (#8029) (#8042)

2026-07-21 21:42:36 -03:00

accountFallback.ts

fix: parse Gemini 429 RetryInfo.retryDelay for model lockout (#7940) (#7961)

2026-07-21 09:15:27 -03:00

accountSelector.ts

Potential fix for code scanning alert no. 54: Insecure randomness

2026-03-05 08:41:44 -03:00

accountSemaphore.ts

fix(combo): stabilize provider routing at 500+ connections (Issue #1846) (#1854)

2026-05-01 12:37:09 -03:00

agentrouterQuotaFetcher.ts

feat(sse): quota tracking for AgentRouter, v0 (Vercel), FreeModel (#6850, #6845, #7075) (#7653)

2026-07-18 03:17:09 -03:00

AGENTS.md

Fix routed target request parameters (#7323)

2026-07-18 21:18:34 -03:00

antigravity429Engine.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

antigravityClientProfile.ts

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

antigravityCredits.ts

fix: resolve migration abort on fresh database #1328 and missing getCreditsMode export

2026-04-16 16:07:44 -03:00

antigravityHeaders.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

antigravityHeaderScrub.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

antigravityIdentity.ts

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

antigravityObfuscation.ts

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

antigravityProjectBootstrap.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

antigravityQuotaFamily.ts

fix(quota): fix antigravity/agy multi-model quota skipping in combos (#7695)

2026-07-19 14:46:33 -03:00

antigravityVersion.ts

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

apiKeyRotator.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

autoRefreshDaemon.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

backgroundTaskDetector.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

bailianQuotaFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

batchProcessor.ts

perf: lazy provider init, P2C quota cache, structuredClone elimination, getSettings→getCachedSettings (batch 2) (#7893)

2026-07-21 11:50:14 -03:00

bedrock.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

browserBackedChat.ts

fix(claude-web): unify Turnstile/executor/fast-path User-Agents behind one fingerprint (#7548) (#7711)

2026-07-19 02:31:26 -03:00

browserPool.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

ccBridgeTransforms.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

ccOpenAiMediaBlocks.ts

fix(sse): CC bridge loses OpenAI-format image input (OpenCode/Kilo/Cline → AgentRouter) (#7888)

2026-07-20 15:56:40 -03:00

ccWireImageBuiltins.ts

Release v3.8.45 (#6202)

2026-07-06 02:25:17 -03:00

chatgptImageCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

chatgptTlsClient.ts

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

claudeAdaptiveThinking.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

claudeCodeCCH.ts

fix(open-sse): serialize xxhash startup in cch hashing

2026-04-13 14:43:32 -03:00

claudeCodeCompatible.ts

fix(sse): CC bridge loses OpenAI-format image input (OpenCode/Kilo/Cline → AgentRouter) (#7888)

2026-07-20 15:56:40 -03:00

claudeCodeCompatibleBeta.ts

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

claudeCodeCompatibleThinkingDisplay.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

claudeCodeConstraints.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

claudeCodeExtraRemap.ts

Release v3.6.9 (#1404)

2026-04-19 19:50:30 -03:00

claudeCodeFingerprint.ts

feat(claude-code): PR #1188 — Native parity with CCH signing, tool remapping, and API constraints

2026-04-12 22:41:12 -03:00

claudeCodeObfuscation.ts

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

claudeCodeToolRemapper.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

claudeHaikuConstraints.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

claudeTlsClient.ts

fix: surface real claude-web error body for non-SSE 400s (#7134) (#7196)

2026-07-14 21:14:01 -03:00

claudeTurnstileSolver.ts

fix(claude-web): unify Turnstile/executor/fast-path User-Agents behind one fingerprint (#7548) (#7711)

2026-07-19 02:31:26 -03:00

claudeUsageCooldown.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

claudeWebAutoRefresh.ts

feat(claude-web): implement session-based executor with auto-refresh (#2283)

2026-05-15 12:51:07 -03:00

clinepassModels.ts

feat(cline): align ClinePass catalog and request protocol (#7914)

2026-07-21 12:19:01 -03:00

cloudCodeHeaders.ts

fix(cli): add Gemini CLI fingerprint (#1866)

2026-05-02 00:48:54 -03:00

cloudCodeThinking.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

codeAssistSubscription.ts

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

codexQuotaFetcher.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

codexUsageQuotas.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

codexVerbosity.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

combo.ts

[defer] feat(combo): universal cooldown-aware retry & auto-strategy combo-ref guard (#7301)

2026-07-21 16:30:37 -03:00

comboAgentMiddleware.ts

fix(security): polynomial ReDoS in comboAgentMiddleware regex → main (#3983)

2026-06-16 08:46:03 -03:00

comboConfig.ts

[defer] feat(combo): universal cooldown-aware retry & auto-strategy combo-ref guard (#7301)

2026-07-21 16:30:37 -03:00

comboManifestMetrics.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

comboMetrics.ts

Release v3.8.34 (#4614)

2026-06-23 03:08:29 -03:00

contextHandoff.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

contextManager.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

credentialGate.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

crofUsageFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

cursorSessionManager.ts

feat(cursor): vision (image_url) input + tool-commit/output-constraint enhancements (#3104)

2026-06-03 18:24:41 -03:00

deepseekQuotaFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

defaultReasoningEffort.ts

feat(api): sync upstream reasoning.supported_efforts into synced-model catalog (#7694) (#7767)

2026-07-19 20:52:54 -03:00

deviceTracker.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

emergencyFallback.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

errorClassifier.ts

fix(sse): 401 model-not-supported lockout + sticky quota-exhausted release (#7268, #7387) (#7580)

2026-07-17 06:11:51 -03:00

evalRouting.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

freeModelQuotaFetcher.ts

feat(sse): quota tracking for AgentRouter, v0 (Vercel), FreeModel (#6850, #6845, #7075) (#7653)

2026-07-18 03:17:09 -03:00

freeWebSearch.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

fusion.ts

feat(sse): preserve tools/tool_choice for tool-bearing requests through fusion combos (#6771) (#7235)

2026-07-17 10:40:33 -03:00

geminiRateLimitTracker.ts

Release v3.8.23

2026-06-12 23:49:22 -03:00

geminiThoughtSignatureStore.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

genericQuotaFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

gigachatAuth.ts

feat: global email privacy toggle with eye icon button

2026-04-11 09:38:17 -03:00

githubCopilotModels.ts

feat(providers): Complete GHE Copilot OAuth provider implementation (#7546)

2026-07-19 21:22:37 -03:00

gpt5SamplingGuard.ts

fix(openai): strip reasoning_effort when GPT-5.x models carry function tools (#7101)

2026-07-17 10:43:37 -03:00

grokCliQuotaFetcher.ts

feat: add live gRPC-web quota fetcher for grok-cli (#6844) (#7714)

2026-07-20 15:57:29 -03:00

grokCliQuotaFrame.ts

feat: add live gRPC-web quota fetcher for grok-cli (#6844) (#7714)

2026-07-20 15:57:29 -03:00

grokTlsClient.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

hfModelSuggestions.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

httpBackedChatFingerprint.ts

fix(claude-web): unify Turnstile/executor/fast-path User-Agents behind one fingerprint (#7548) (#7711)

2026-07-19 02:31:26 -03:00

inAppLoginService.ts

Release v3.8.13 (#3327)

2026-06-06 19:13:11 -03:00

intentClassifier.ts

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

ipFilter.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

keyGroupAuth.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

kiroExternalIdp.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

kiroModels.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

kiroRegion.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

lmarenaTlsClient.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

manifestAdapter.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

mimoThinking.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

model.ts

perf(memory): mitigate event-loop starvation under 3000+ provider connections (#7719)

2026-07-19 22:31:08 -03:00

modelCapabilities.ts

feat: v3.6.4 — Combo Builder v2, Composite Tiers, P2C Credentials, Observability Layer

2026-04-12 10:34:10 -03:00

modelDeprecation.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

modelFamilyFallback.ts

fix(sse): 401 model-not-supported lockout + sticky quota-exhausted release (#7268, #7387) (#7580)

2026-07-17 06:11:51 -03:00

modelscopePolicy.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

modelStrip.ts

feat(release): implement Hermes CLI config and message content stripping (#1475, #1387)

2026-04-22 01:39:49 -03:00

notionWebFallbackModels.ts

fix(notion-web): add browser fingerprint headers to reduce Cloudflare challenges (#7864)

2026-07-20 15:57:15 -03:00

notionWebModels.ts

fix(notion-web): add browser fingerprint headers to reduce Cloudflare challenges (#7864)

2026-07-20 15:57:15 -03:00

opencodeOllamaUsage.ts

fix: stop opencode-go quota lookup defaulting to Z.AI endpoint (#7022) (#7187)

2026-07-14 21:45:23 -03:00

opencodeQuotaFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

opencodeReasoningSanitizer.ts

fix(combo): strip boolean reasoning field for opencode-go providers (#7891)

2026-07-20 22:26:13 -03:00

openrouterFreeWindow.ts

feat: OpenRouter quota tracking (key/credits + free-window counter) (#6842) (#7651)

2026-07-18 03:11:01 -03:00

openrouterQuotaFetcher.ts

feat: OpenRouter quota tracking (key/credits + free-window counter) (#6842) (#7651)

2026-07-18 03:11:01 -03:00

payloadRules.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

perplexityTlsClient.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

pipeline.ts

fix(combo): retry transient errors in pipeline strategy (#7794)

2026-07-19 20:53:01 -03:00

promptqlModels.ts

fix: repair pre-existing red gates on the release/v3.8.49 tip (#8055)

2026-07-21 21:25:00 -03:00

provider.ts

fix(antigravity): allow cloudcode envelope through messages guard (#7582)

2026-07-18 22:09:43 -03:00

providerCooldownTracker.ts

Release v3.8.34 (#4614)

2026-06-23 03:08:29 -03:00

providerCostData.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

providerDefaultRateLimit.ts

feat(sse): add nvidia NIM local RPM budget + concurrency cap (#6846) (#7726)

2026-07-19 14:37:18 -03:00

providerRequestDefaults.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

proxyAutoSelector.ts

Release v3.8.14 (#3340)

2026-06-07 07:20:02 -03:00

qoderCli.ts

feat(qwen): add Qwen3.8 Max Preview catalogs [Part 2/3] (#7874)

2026-07-20 18:48:16 -03:00

qoderCliResolve.ts

Release v3.8.46

2026-07-07 13:14:06 -03:00

quotaFetchThrottle.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

quotaMonitor.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

quotaPreflight.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

quotaResetParsing.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

quotaTextCooldowns.ts

fix: recognize Ollama Cloud session usage-limit 429 as quota-exhausted (#7071) (#7181)

2026-07-14 21:45:20 -03:00

quotaTrackersBatch.ts

feat: add live gRPC-web quota fetcher for grok-cli (#6844) (#7714)

2026-07-20 15:57:29 -03:00

qwenThinking.ts

feat(core): add db health checks and provider interoperability

2026-04-13 13:11:30 -03:00

rateLimitManager.ts

fix(ci): repair release regressions exposed by clean runs (#7812)

2026-07-20 10:08:25 -03:00

rateLimitSemaphore.ts

Release v3.8.32 (#4418)

2026-06-21 08:56:51 -03:00

reasoningCache.ts

fix(kimi-coding): capture and replay reasoning for thinking-mode turns (#7673)

2026-07-19 20:52:46 -03:00

reasoningTokenBuffer.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

refreshSerializer.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

requestDedup.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

responseModelEcho.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

responsesInputSanitizer.ts

fix(codex): normalize nested Responses output content (#7269)

2026-07-18 15:12:28 -03:00

retryAfterJson.ts

fix: parse Gemini 429 RetryInfo.retryDelay for model lockout (#7940) (#7961)

2026-07-21 09:15:27 -03:00

roleNormalizer.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

rotationConfig.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

searchCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

sessionManager.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

signatureCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

slidingWindowLimiter.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

specificityDetector.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

specificityRules.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

specificityTypes.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

streamRecovery.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

systemPrompt.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

systemTransforms.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

targetRequestSanitizer.ts

Fix routed target request parameters (#7323)

2026-07-18 21:18:34 -03:00

taskAwareRouter.ts

feat: improvements from 9router analysis (T01/T08-T13) (#351)

2026-03-14 10:59:15 -03:00

taskAwareRouting.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

thinkingBudget.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

tierConfig.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

tierDefaults.json

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

tierResolver.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tierTypes.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tlsClientProxy.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

tokenExtractionConfig.ts

feat(kimi): sync Code, Web, and Moonshot providers (#7531)

2026-07-18 21:19:42 -03:00

tokenLimitCounter.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

tokenRefresh.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

toolLatencyTracker.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

toolLimitDetector.ts

Release v3.8.45 (#6202)

2026-07-06 02:25:17 -03:00

toolSchemaSanitizer.ts

Release v3.8.46

2026-07-07 13:14:06 -03:00

usage.ts

feat(sse): add PromptQL playground provider (unofficial) (#7911)

2026-07-21 13:16:58 -03:00

v0QuotaFetcher.ts

feat(sse): quota tracking for AgentRouter, v0 (Vercel), FreeModel (#6850, #6845, #7075) (#7653)

2026-07-18 03:17:09 -03:00

volumeDetector.ts

feat(ui): integrate FSM, adaptive routing, and provider diversity

2026-03-30 12:58:45 -03:00

webFetchInterception.ts

feat(routing): wire interceptFetch tool interception into the chat pipeline (#7339) (#7736)

2026-07-19 14:37:30 -03:00

webSearchFallback.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

webSearchRouting.ts

Release v3.8.33 (#4515)

2026-06-22 03:17:02 -03:00

webSessionPoolHealth.ts

feat: add web-session pool observability (MCP tool + health-matrix) (#3395)

2026-06-08 00:48:01 -03:00

wildcardRouter.ts

fix(build): unblock release build and settings state updates

2026-04-17 23:21:02 -03:00

workflowFSM.ts

chore(release): v3.4.8 — security compliance and fix algorithms

2026-04-03 00:15:35 -03:00