Diego Rodrigues de Sa e Souza 955c7bbf42 fix(security): compare the OIDC state cookie in constant time (#11646) ...

Merged via /merge-batch (2026-08-26, v3.8.51). Boarded no worktree combinado; validação única: typecheck/complexity/cognitive-complexity/file-size/changelog verdes, lint nos mesmos 228 achados pré-existentes confirmados contra o tip puro, testes focados passando. Obrigado pela contribuição.

2026-08-26 17:40:45 -03:00

..

a11yAudit.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

api.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

apiAuth.ts

feat(auth): OIDC as optional dashboard admin login gate (password fallback preserved) (#6973)

2026-07-19 23:21:43 -03:00

apiKey.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

apiKeyPolicy.ts

fix(security): close remaining v3.8.50 advisories (batch 2 — 11 findings) (#11040)

2026-08-21 20:28:16 -03:00

apiResponse.ts

feat: Add dashboard loading and error UIs, introduce standardized API response utilities, enhance call log redaction and configurable retention, and document architectural decisions.

2026-02-18 11:34:05 -03:00

autoDisableBanned.ts

feat(resilience): scope auto-disable banned accounts to subscriptions (#10617)

2026-08-18 10:53:24 -03:00

basePath.ts

fix(client): rewrite absolute fetch/EventSource paths under basePath (#8515)

2026-07-27 21:12:49 -03:00

basePathFetch.ts

fix(client): rewrite absolute fetch/EventSource paths under basePath (#8515)

2026-07-27 21:12:49 -03:00

bulkApiKeyParser.ts

fix(api): bulk-add API keys no longer overwrite existing connections (#7234)

2026-07-17 10:40:29 -03:00

circuitBreaker.ts

maint: follow-up cherry-pick fix-in-place #9510 (fallback resolution) (#9880)

2026-08-09 10:07:10 -03:00

classify429.ts

fix(classify429): add missing 'exhausted their quota' pattern to prevent combo fallback failure (#9269)

2026-08-08 11:26:24 -03:00

cliCompat.ts

fix(cli): add Gemini CLI fingerprint (#1866)

2026-05-02 00:48:54 -03:00

clientApiRouteAuth.ts

fix(api): enforce image generation API key auth (#8306)

2026-07-27 22:38:25 -03:00

clineAuth.ts

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

clipboard.ts

fix(combo): resolve cross-provider thinking 400 and http clipboard (#1444)

2026-04-21 04:36:16 -03:00

cloud.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

cn.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

codexBaseUrl.ts

fix: normalize Codex URLs and dashboard regressions (#8233)

2026-07-23 08:53:03 -03:00

codexConfig.ts

Release v3.8.31 (#4377)

2026-06-20 14:55:24 -03:00

compatibleProviderId.ts

fix(api): accept the current compatible-provider connection id scheme in the models test route (#8326) (#8359)

2026-07-24 11:44:46 -03:00

compressionHeaderEcho.ts

fix(api): echo X-OmniRoute-Compression response header (#6422) (#6441)

2026-07-06 18:38:12 -03:00

connectionStatus.ts

fix(dashboard): hide disabled provider connections from combo builder (#6984)

2026-07-17 10:39:18 -03:00

containerConfigGuard.ts

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

containerEnv.ts

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

cors.ts

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

costEstimator.ts

Release v3.7.6 (#1803)

2026-04-30 14:08:50 -03:00

dashboardCsrf.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

envBoolean.ts

fix(guardrails): align INPUT_SANITIZER request masking gate (#8093) (#8124)

2026-07-23 04:50:43 -03:00

featureFlags.ts

feat(routing): add DISABLE_CONTEXT_WINDOW_CHECKS bypass for the direct-request input/context check (#10927)

2026-08-20 22:04:03 -03:00

fetchError.ts

Release v3.8.14 (#3340)

2026-06-07 07:20:02 -03:00

fetchTimeout.ts

fix: NVIDIA NIM API key validation timeout (bypass proxy fetch patch) (#3226)

2026-06-05 11:52:27 -03:00

formatRemaining.ts

maint: follow-up cherry-pick fix-in-place #9510 (fallback resolution) (#9880)

2026-08-09 10:07:10 -03:00

formatting.ts

fix(dashboard): safely render structured error objects in Request Logs detail (#7845) (#7920)

2026-07-20 22:22:55 -03:00

freeModels.ts

fix(free-models): stop reporting discontinued Pollinations models as free (#11441)

2026-08-25 01:37:45 -03:00

globPattern.ts

feat: replace free-text model inputs with hidePaid-aware Selects (#6540) (#7229)

2026-07-17 10:40:18 -03:00

grokBilling.ts

feat(usage): show Grok Build billing limits (#9205)

2026-08-04 18:07:02 -03:00

httpClientAbortGuard.mjs

fix(sse): prevent client-abort (aborted/ECONNRESET) from crashing the server (#11556)

2026-08-26 08:11:14 -03:00

index.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

injectionSeverity.ts

fix(guardrails): align INPUT_SANITIZER request masking gate (#8093) (#8124)

2026-07-23 04:50:43 -03:00

inputSanitizer.ts

fix(guardrails): align INPUT_SANITIZER request masking gate (#8093) (#8124)

2026-07-23 04:50:43 -03:00

keyedMutex.ts

feat(cursor): proactively renews Cursor sessions and fixes manual refresh (#9173)

2026-08-11 04:31:24 -03:00

kimiBilling.ts

feat(usage): show Kimi Coding Extra Usage (#10712)

2026-08-20 06:28:37 -03:00

linkify.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

logger.ts

fix(logger): tolerate write to removed DATA_DIR so tests don't crash on teardown (#6360) (#6599)

2026-07-07 21:01:11 -03:00

logRedaction.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

m365HarImport.ts

fix(m365): BizChat invocation shape drift + HAR-import UX + Antigravity alias note (#11069)

2026-08-21 22:32:19 -03:00

machine.ts

Release v3.8.22 (#3623)

2026-06-11 18:52:29 -03:00

machineId.ts

fix: avoid cmd.exe spawn on Windows by using os.hostname() before execSync fallback (#7841)

2026-07-20 15:56:15 -03:00

maskEmail.ts

feat(settings): unify routing rules and model aliases controls

2026-04-12 18:43:19 -03:00

modelCatalogSearch.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

noAuthProviders.ts

feat(mcp): implement dynamic runtime tool schema plumbing for blocked providers (#11100) (#11155)

2026-08-22 20:23:04 -03:00

nodeRuntimeSupport.ts

feat(cli): add native Bun backend support and Dockerfile.bun (#11039)

2026-08-21 21:28:43 -03:00

numeric.ts

feat: canonical numeric helpers + tier-1 (analytics) migration (#7879) (#7969)

2026-07-22 02:35:08 -03:00

parseApiKeys.ts

feat(providers): implement bulk paste for extra API keys (#1916)

2026-05-03 16:17:38 -03:00

probeOrigin.ts

fix(probe): isolate probe-origin failures from all deactivation sites (#10694)

2026-08-20 10:30:29 -03:00

providerBilling.ts

feat(usage): show Kimi Coding Extra Usage (#10712)

2026-08-20 06:28:37 -03:00

providerConnectionStatus.ts

fix(providers): unify connection and routing flows (#7629)

2026-07-18 21:20:09 -03:00

providerCredentialRequirement.ts

refactor(providers): remove the Puter provider at its owner's request (#10210)

2026-08-12 16:54:50 -03:00

providerDisplayLabel.ts

fix(dashboard): resolve custom provider display name across surfaces (#2968)

2026-05-31 09:34:16 -03:00

providerFallbackColor.ts

fix(dashboard): show custom provider_nodes providers in the Topology view instead of only AI_PROVIDERS (#8328) (#8357)

2026-07-24 11:44:29 -03:00

providerHints.ts

Merge remote-tracking branch 'origin/release/v3.8.0' into feat/zero-config-auto-routing

2026-05-10 18:33:20 -03:00

providerModelAliases.ts

fix openrouter available models sync

2026-03-30 17:07:46 -04:00

providerQuotaVisibility.ts

Add per-connection Provider Quota visibility (#7360)

2026-07-18 15:12:52 -03:00

rateLimiter.ts

feat(redis): add configurable key namespace prefix (#11042)

2026-08-22 18:56:45 -03:00

releaseNotes.ts

fix(radar): close cumulative quality regressions

2026-08-14 19:47:07 -03:00

requestId.ts

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

requestTelemetry.ts

Release v3.7.6 (#1803)

2026-04-30 14:08:50 -03:00

requestTimeout.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

resolveOmniRouteBaseUrl.ts

chore(release): v3.5.6 — email masking, model toggle, OpenRouter registries & bug fixes (#1080)

2026-04-09 15:55:59 -03:00

runtimeTimeouts.ts

maint: follow-up cherry-pick fix-in-place #9711 (conflict-resolved fallback) (#9891)

2026-08-09 10:08:25 -03:00

secretsValidator.ts

chore(security): drop the unused enforceSecrets() duplicate (#10775)

2026-08-20 06:30:05 -03:00

secureRandom.ts

Release v3.8.32 (#4418)

2026-06-21 08:56:51 -03:00

serviceTierLabels.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

shuffleDeck.ts

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

sidebarExpansionState.ts

Restore proxy navigation and sidebar accordion state (#7381)

2026-07-18 15:13:19 -03:00

sidebarRouteMatch.ts

feat: implement email masking for test result labels and refactor sidebar route matching logic

2026-04-13 17:39:45 -03:00

sidebarSearch.ts

feat: sidebar search/filter input (#4013) (#6810)

2026-07-11 05:04:13 -03:00

streamTracker.ts

feat(phase4): focus indicators, session management, k6 load tests, remove @ts-check

2026-02-18 14:51:15 -03:00

structuredLogger.ts

fix(logs): stop the async-EPIPE log-flood loop at its ignition point (#8207)

2026-07-23 05:11:11 -03:00

terminalStatus.ts

fix(providers): route terminal testStatus writes through a single origin-aware passage (#11009)

2026-08-21 13:58:48 -03:00

testProcess.ts

fix(base-red): correct swapped isAutomatedTestProcess(argv, env) call

2026-07-18 22:23:48 -03:00

tiktokenCounter.ts

fix(compression): cap countTextTokens at 50k chars and strip base64 data URIs (#10118)

2026-08-14 00:57:19 -03:00

timingSafeCompare.ts

fix(security): compare the OIDC state cookie in constant time (#11646)

2026-08-26 17:40:45 -03:00

turkishText.ts

fix(providers): handle space-separated search queries via matchesAnyToken (#8660)

2026-07-27 17:24:04 -03:00

upstreamError.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

webCookieExpiry.ts

feat(providers): derive + surface expiry for JWT-bearing web cookies (#11497) (#11505)

2026-08-25 18:22:34 -03:00

wsPath.ts

chore(release): clear release/v3.8.51 base-red gates — docs count, stryker list, lockfile host, stale suppressions, 7 lint regressions (#11502)

2026-08-25 13:51:18 -03:00