Diego Rodrigues de Sa e Souza a9d73bcbfb fix(security): polynomial ReDoS in comboAgentMiddleware regex (#3982) ...

* fix(security): eliminate polynomial ReDoS in comboAgentMiddleware <omniModel> regex (CodeQL js/polynomial-redos)

CACHE_TAG_PATTERN wrapped the tag in an unbounded `(?:\\n|\n|\r)*` prefix/suffix.
On an unanchored `.test()`/`.exec()` that is O(n²) on inputs with many newlines
(CodeQL js/polynomial-redos, alerts #612/#613). The surrounding runs are irrelevant
to detecting/capturing the tag, so the detection pattern now matches only the core
`<omniModel>([^<]+)</omniModel>`; the global strip pattern still consumes the
wrapping newlines (combo.ts streaming, #531) but BOUNDED ({0,16}) so it stays linear.

Behavior preserved: detection, model extraction, multi-tag stripping (#454) and
blank-line cleanup all unchanged (107 related tests green). Adds ReDoS-safety
regression tests (50k-newline inputs complete in <1ms).

* docs(changelog): add #3982 ReDoS fix to [3.8.27]

2026-06-16 08:42:58 -03:00

..

__tests__

fix(grok-web): add TLS fingerprint impersonation to bypass Cloudflare anti-bot (#3180) (#3249)

2026-06-06 00:20:51 -03:00

autoCombo

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

compression

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

sessionPool

fix(pollinations/duckduckgo): wire session pool for fingerprint rotation (#3049)

2026-06-01 19:46:58 -03:00

accountFallback.ts

Release v3.8.23

2026-06-12 23:49:22 -03:00

accountSelector.ts

Potential fix for code scanning alert no. 54: Insecure randomness

2026-03-05 08:41:44 -03:00

accountSemaphore.ts

fix(combo): stabilize provider routing at 500+ connections (Issue #1846) (#1854)

2026-05-01 12:37:09 -03:00

AGENTS.md

Release v3.7.9 (#1917)

2026-05-04 01:36:53 -03:00

antigravity429Engine.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

antigravityClientProfile.ts

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

antigravityCredits.ts

fix: resolve migration abort on fresh database #1328 and missing getCreditsMode export

2026-04-16 16:07:44 -03:00

antigravityHeaders.ts

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

antigravityHeaderScrub.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

antigravityIdentity.ts

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

antigravityObfuscation.ts

Merge PR #1203

2026-04-13 13:13:37 -03:00

antigravityProjectBootstrap.ts

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

antigravityVersion.ts

Release v3.8.1 (#2441)

2026-05-21 01:29:12 -03:00

apiKeyRotator.ts

fix: address Gemini Code Review feedback on PR #2951

2026-05-30 13:03:02 -05:00

autoRefreshDaemon.ts

Release v3.8.13 (#3327)

2026-06-06 19:13:11 -03:00

backgroundTaskDetector.ts

feat: Add requested model to logs, enhance background task detection, and introduce AI SDK compatibility utilities.

2026-03-23 11:08:14 -03:00

bailianQuotaFetcher.ts

fix: replace unit test with integration test for proactive context compression (#1378)

2026-04-17 21:02:26 -03:00

batchProcessor.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

bedrock.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

browserBackedChat.ts

Release v3.8.14 (#3340)

2026-06-07 07:20:02 -03:00

browserPool.ts

Release v3.8.18 (#3482)

2026-06-09 15:56:24 -03:00

ccBridgeTransforms.ts

chore: bump Claude Code identity to 2.1.158 + sync beta flags from HAR captures

2026-05-31 18:17:34 -03:00

chatgptImageCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

chatgptTlsClient.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

claudeCodeCCH.ts

fix(open-sse): serialize xxhash startup in cch hashing

2026-04-13 14:43:32 -03:00

claudeCodeCompatible.ts

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

claudeCodeCompatibleBeta.ts

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

claudeCodeConstraints.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

claudeCodeExtraRemap.ts

Release v3.6.9 (#1404)

2026-04-19 19:50:30 -03:00

claudeCodeFingerprint.ts

feat(claude-code): PR #1188 — Native parity with CCH signing, tool remapping, and API constraints

2026-04-12 22:41:12 -03:00

claudeCodeObfuscation.ts

Release v3.6.9 (#1404)

2026-04-19 19:50:30 -03:00

claudeCodeToolRemapper.ts

fix(claude): harden tool cloak + schema sanitizer (adversarial review round)

2026-05-30 14:35:53 +00:00

claudeTlsClient.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

claudeTurnstileSolver.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

claudeWebAutoRefresh.ts

feat(claude-web): implement session-based executor with auto-refresh (#2283)

2026-05-15 12:51:07 -03:00

cloudCodeHeaders.ts

fix(cli): add Gemini CLI fingerprint (#1866)

2026-05-02 00:48:54 -03:00

cloudCodeThinking.ts

fix(ci): align cloud code thinking and model catalog tests

2026-05-12 20:28:02 -03:00

codeAssistSubscription.ts

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

codexQuotaFetcher.ts

fix: address Gemini Code Review feedback on PR #2951

2026-05-30 13:03:02 -05:00

combo.ts

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

comboAgentMiddleware.ts

fix(security): polynomial ReDoS in comboAgentMiddleware regex (#3982)

2026-06-16 08:42:58 -03:00

comboConfig.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

comboManifestMetrics.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

comboMetrics.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

contextHandoff.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

contextManager.ts

Release v3.8.22 (#3623)

2026-06-11 18:52:29 -03:00

credentialGate.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

crofUsageFetcher.ts

feat(providers): wire CrofAI /usage_api/ into quota preflight, monitor & Limits page (#1606)

2026-04-25 23:51:18 -03:00

cursorSessionManager.ts

feat(cursor): vision (image_url) input + tool-commit/output-constraint enhancements (#3104)

2026-06-03 18:24:41 -03:00

deepseekQuotaFetcher.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

emergencyFallback.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

errorClassifier.ts

Release v3.8.21 (#3593)

2026-06-11 04:01:24 -03:00

evalRouting.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

geminiCliHeaders.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

geminiRateLimitTracker.ts

Release v3.8.23

2026-06-12 23:49:22 -03:00

geminiThoughtSignatureStore.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

genericQuotaFetcher.ts

feat(limits): per-window quota cutoffs across all providers with usage data (#2267)

2026-05-14 20:19:55 -03:00

gigachatAuth.ts

feat: global email privacy toggle with eye icon button

2026-04-11 09:38:17 -03:00

githubCopilotModels.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

grokTlsClient.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

inAppLoginService.ts

Release v3.8.13 (#3327)

2026-06-06 19:13:11 -03:00

intentClassifier.ts

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

ipFilter.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

keyGroupAuth.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

kiroModels.ts

feat(connections): per-connection disable-cooldown opt-out (#2997) (#3852)

2026-06-14 10:32:26 -03:00

manifestAdapter.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

model.ts

Release v3.8.22 (#3623)

2026-06-11 18:52:29 -03:00

modelCapabilities.ts

feat: v3.6.4 — Combo Builder v2, Composite Tiers, P2C Credentials, Observability Layer

2026-04-12 10:34:10 -03:00

modelDeprecation.ts

fix(types): cast extracted usage to Record<string,number> in stream.ts to resolve TS property errors

2026-03-23 09:21:03 -03:00

modelFamilyFallback.ts

Release v3.8.23

2026-06-12 23:49:22 -03:00

modelscopePolicy.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

modelStrip.ts

feat(release): implement Hermes CLI config and message content stripping (#1475, #1387)

2026-04-22 01:39:49 -03:00

opencodeQuotaFetcher.ts

fix(quota): surface OpenCode Go missing-quota-API as a latched diagnostic (#3838)

2026-06-14 10:27:39 -03:00

payloadRules.ts

fix(payload-rules): read DB-persisted rules when no in-memory override (#2986)

2026-05-31 11:31:34 -03:00

perplexityTlsClient.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

provider.ts

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

providerCooldownTracker.ts

Release v3.8.20 (#3547)

2026-06-10 13:49:08 -03:00

providerCostData.ts

Release v3.8.20 (#3547)

2026-06-10 13:49:08 -03:00

providerRequestDefaults.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

proxyAutoSelector.ts

Release v3.8.14 (#3340)

2026-06-07 07:20:02 -03:00

qoderCli.ts

fix(sse): don't mark a valid Qoder PAT expired on a generic Cosy 500 (#3247) (#3283)

2026-06-06 03:11:58 -03:00

quotaMonitor.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

quotaPreflight.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

qwenThinking.ts

feat(core): add db health checks and provider interoperability

2026-04-13 13:11:30 -03:00

rateLimitManager.ts

Release v3.8.13 (#3327)

2026-06-06 19:13:11 -03:00

rateLimitSemaphore.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

reasoningCache.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

reasoningTokenBuffer.ts

Release v3.8.23

2026-06-12 23:49:22 -03:00

refreshSerializer.ts

fix(sse): stop Codex multi-account family-revocation cascade on quota-sync

2026-05-31 19:13:41 -03:00

requestDedup.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

responsesInputSanitizer.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

roleNormalizer.ts

fix(translator): map developer→system by default for non-openai providers (#2281)

2026-05-16 10:13:08 -03:00

searchCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

sessionManager.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

signatureCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

specificityDetector.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

specificityRules.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

specificityTypes.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

systemPrompt.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

systemTransforms.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

taskAwareRouter.ts

feat: improvements from 9router analysis (T01/T08-T13) (#351)

2026-03-14 10:59:15 -03:00

thinkingBudget.ts

fix(sse): strip reasoning_effort for non-reasoning Groq models (#3258) (#3277)

2026-06-06 02:48:38 -03:00

tierConfig.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tierDefaults.json

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tierResolver.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tierTypes.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tlsClientProxy.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

tokenExtractionConfig.ts

Release v3.8.23

2026-06-12 23:49:22 -03:00

tokenLimitCounter.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

tokenRefresh.ts

Release v3.8.23

2026-06-12 23:49:22 -03:00

toolLatencyTracker.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

toolLimitDetector.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

toolSchemaSanitizer.ts

fix(tools): keep opaque object schemas open (#3097)

2026-06-03 18:29:31 -03:00

usage.ts

fix(quota): surface OpenCode Go missing-quota-API as a latched diagnostic (#3838)

2026-06-14 10:27:39 -03:00

volumeDetector.ts

feat(ui): integrate FSM, adaptive routing, and provider diversity

2026-03-30 12:58:45 -03:00

webSearchFallback.ts

fix(sse): bypass web-search fallback on Claude -> Claude passthrough (#2960)

2026-05-30 21:17:52 -03:00

webSessionPoolHealth.ts

feat: add web-session pool observability (MCP tool + health-matrix) (#3395)

2026-06-08 00:48:01 -03:00

wildcardRouter.ts

fix(build): unblock release build and settings state updates

2026-04-17 23:21:02 -03:00

workflowFSM.ts

chore(release): v3.4.8 — security compliance and fix algorithms

2026-04-03 00:15:35 -03:00