Tony Yu 3d3f71f514 fix(oauth): read pollToken body once on non-JSON upstream responses (kimi-coding, github) (#13046) ...

* fix(oauth): read pollToken body once on non-JSON upstream responses

The device-flow pollToken handlers for kimi-coding and github tried
response.json() first and fell back to response.text() in the catch.
Once .json() rejects on a non-JSON body the stream is already consumed,
so the .text() fallback always throws TypeError (Body is unusable) and
pollToken rejects, surfacing as a generic 500 on /api/oauth/<provider>/poll
instead of the intended graceful { error: "invalid_response" } payload.
Non-JSON responses are realistic when the OAuth upstream sits behind a
CDN/anti-bot HTML error page or a proxy interstitial (auth.kimi.com in
particular).

Read the body once as text, then JSON.parse it, preserving the original
invalid_response fallback. Adds a regression test that drives both
providers with a stubbed fetch returning an HTML error page and a JSON
error body. Prunes the two now-unused no-unused-vars suppressions for the
removed catch bindings.

* docs(changelog): fragment for #13046

2026-09-18 11:30:09 -03:00

..

a2a

fix(a2a): accept dashboard session auth on /a2a route (#12888) (#13271)

2026-09-11 22:29:21 -03:00

accessTokens

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

acp

fix(acp): bound session output buffers and reset stderr per prompt (#13100)

2026-09-11 13:32:51 -03:00

agentSkills

fix(skills): read positionals declared with .addArgument() (#13009)

2026-09-10 18:13:37 -03:00

api

fix(api): give the #13376 model-test skip a real httpStatus (#13730)

2026-09-15 08:50:58 -03:00

audit

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

auth

fix(security): remove literal secrets from podman manifest, block CHANGEME remote login (#13679) (#13812)

2026-09-16 06:09:29 -03:00

batches

fix(dev): isolate batch dispatch from instrumentation (#12081)

2026-08-31 14:14:02 -03:00

build-profile

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

catalog

chore(startup): remove server-init.ts, a module nothing imports (#10780)

2026-08-20 10:27:26 -03:00

chaos

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

cli-helper

fix(cli-helper): clear the log stream timeout on the abort path (#13114)

2026-09-11 13:30:38 -03:00

cliTools

feat(cli): support Grok Build custom host configuration (#10830)

2026-08-21 00:29:01 -03:00

cloudAgent

fix(orchestration): emit the real task status on non-status updates (#12550)

2026-09-11 17:41:48 -03:00

combos

fix(vertex): discover and route partner models correctly (#12471)

2026-09-16 16:37:41 -03:00

compliance

fix(compliance): redact extra provider API keys (#10521)

2026-08-18 10:51:34 -03:00

compression

perf(executors): lazy-load the executor registry — defer class imports + construction to first use (#11220) (#11421)

2026-08-25 18:22:46 -03:00

conductor

fix(dashboard): orchestration canvas fase 3 — follow-ups da review final (#12639) (#12988)

2026-09-10 10:23:52 -03:00

config

fix(config): persist background-degradation entry deletions (#12647)

2026-09-11 17:41:37 -03:00

copilot

docs(audit): align every published number with the code and harden check:docs-counts (#12200)

2026-08-31 13:39:21 -03:00

credentialHealth

fix(oauth): soft-fail Claude refresh so CredentialHealth is not sticky-dead (#13185)

2026-09-16 23:10:24 -03:00

cursor

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

db

fix(db): never TRUNCATE-checkpoint a live WAL (SIGBUS under traffic) (#14005)

2026-09-18 10:21:03 -03:00

discovery

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

display

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

embeddings

fix(embeddings): log server-side when a provider can't be resolved (#13687)

2026-09-16 13:38:40 -03:00

env

feat(a2a): inbound delegation to the OmniConductor fleet via POST /api/a2a/tasks (PRD RF5) (#8223)

2026-08-12 02:13:41 -03:00

evals

fix(backend): eval runner opts out of output-style and memory injection (#13414)

2026-09-14 23:18:32 -03:00

events

feat(dashboard): orchestration canvas fase 2 — agents WS channel (2.1) (#12409)

2026-09-02 01:19:49 -03:00

freeProxyProviders

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

gamification

feat(gamification): pay the documented streak and badge XP rewards (#12522)

2026-09-11 17:42:32 -03:00

guardrails

fix(vision-bridge): nested tool_result images + provider-prefix credential check (#12903)

2026-09-17 02:30:54 -03:00

headroom

Release v3.8.46

2026-07-07 13:14:06 -03:00

images

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

inspector

chore(quality): remove unreachable code and restore test discovery (#11950)

2026-09-01 11:06:04 -03:00

issueAgent

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

jobRegistry

maint: follow-up cherry-pick fix-in-place #9631 (conflict-resolved fallback) (#9886)

2026-08-09 09:54:47 -03:00

jobs

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

kimi

feat(sse): add kimi web token lifecycle manager, rolling auto-refresh and 401 recovery (#10944)

2026-08-21 04:25:56 -03:00

localCorpus

refactor(local-corpus): implement dynamic root resolution and LRU cache (#11491)

2026-08-25 21:08:05 -03:00

logExport

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

memory

fix(resilience): name collision keys, surface header drops, retry embeds, skip far-reset pings (#13766)

2026-09-16 13:36:35 -03:00

middleware

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

modelsDevSync

refactor(providers): remove the Puter provider at its owner's request (#10210)

2026-08-12 16:54:50 -03:00

monitoring

fix(monitoring): expose failed connection ids on credentialHealth (#12876)

2026-09-10 10:42:26 -03:00

notion

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

oauth

fix(oauth): read pollToken body once on non-JSON upstream responses (kimi-coding, github) (#13046)

2026-09-18 11:30:09 -03:00

obsidian

feat(observability): add Obsidian context source with 24 MCP tools (#3077)

2026-06-03 06:45:04 -03:00

playground

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690)

2026-08-26 17:54:57 -03:00

plugins

fix(plugins): make SIGKILL escalation idempotent per child (#13092)

2026-09-11 13:27:42 -03:00

promptCache

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

providerModels

fix(providers): read the vLLM context window from max_model_len (#12897)

2026-09-17 18:37:34 -03:00

providers

fix(models): reconcile provider dashboards with active live catalogs (#13434)

2026-09-16 16:56:28 -03:00

proxyHealth

fix(proxy-health): refused probe responses reset the consecutive-failure streak (#13608)

2026-09-15 20:01:25 -03:00

proxyRelay

fix(relay): strip unsafe forwarded headers (#11533)

2026-08-25 13:12:50 -03:00

proxySubscription

fix(proxy): keep proxy credentials holding a literal percent (#13605)

2026-09-15 12:59:27 -03:00

quota

fix(quota): apply the equal-split fallback in the pool usage snapshot (#13159)

2026-09-16 21:01:24 -03:00

radar

feat(catalog): eligibility-gated free-tier bucket (#12669)

2026-09-04 00:45:38 -03:00

reasoningRouting

fix(resilience): honor declared effort vocabulary in reasoning rule gate (#12686)

2026-09-17 16:24:58 -03:00

resilience

fix(resilience): allow maxWaitMs=0 as disable sentinel for execution expiration (#12902)

2026-09-17 10:44:30 -03:00

routerEval

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

routing

feat(api): add provider quota telemetry, adaptive routing, and status inventory (#10148)

2026-08-18 11:31:53 -03:00

runtime

feat: enhance port configuration and API bridge support

2026-02-26 15:11:40 +00:00

search

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690)

2026-08-26 17:54:57 -03:00

security

Release v3.8.31 (#4377)

2026-06-20 14:55:24 -03:00

services

fix(resilience): name collision keys, surface header drops, retry embeds, skip far-reset pings (#13766)

2026-09-16 13:36:35 -03:00

skills

fix(thinking): parse/scrub DSML tool-call markers and recognize adaptive thinking (#12905)

2026-09-17 12:56:30 -03:00

spend

feat(core): add payload rules, tag routing, and scheduled budgets

2026-04-17 09:00:32 -03:00

startup

fix(docker): bind app/sidecar compose ports to loopback by default (#12568, #12578) (#13240)

2026-09-11 22:05:14 -03:00

sync

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

system

fix(system): propagate abort signal to stream reader in HTTP version checks (#12232)

2026-09-01 12:07:02 -03:00

telegram

fix(telegram): bound the per-user API key cache (#13166)

2026-09-11 13:27:30 -03:00

translator

feat(dashboard): add custom CLI builder and eval suite management

2026-04-23 16:57:43 -03:00

usage

fix(ci): repair the API Route Typecheck base-red blocking every PR (#14079)

2026-09-18 08:13:43 -03:00

versionManager

fix(cli): complete Windows cliproxy platform handling + pid probe (#11236) (#11263)

2026-08-23 14:25:04 -03:00

vncSession

fix(docker): require a per-session token on the VNC browser CDP bridge (#12571) (#13241)

2026-09-11 22:29:05 -03:00

vscode

fix(reasoning): forward Ollama Cloud thinking (#9290)

2026-08-04 14:34:02 -03:00

warmupScheduler

fix(redis): namespace warmup circuit-breaker keys with REDIS_KEY_PREFIX (#13328)

2026-09-16 21:09:38 -03:00

webhooks

fix(webhooks): remove 3 declared-but-never-emitted ghost events (#11050)

2026-08-21 20:54:51 -03:00

ws

fix(auth): dashboard session requires the authenticated claim — Cursor CLI tokens are not sessions (#13375)

2026-09-11 22:29:12 -03:00

zed-oauth

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

admissionVirtualLanes.ts

feat: combo-lane awareness + activation UX + MCP visibility (Wave 2 of #9654) (#10039)

2026-08-18 11:31:46 -03:00

apiBridgeServer.ts

fix(docker): bind app/sidecar compose ports to loopback by default (#12568, #12578) (#13240)

2026-09-11 22:05:14 -03:00

apiKeyExposure.ts

Release v3.8.27 (#3968)

2026-06-17 02:43:21 -03:00

arenaEloSync.ts

fix(db): rate-limit Arena ELO fetch-failure warnings on repeated timeouts (#11500) (#11989)

2026-08-29 08:10:17 -03:00

buildPhase.ts

Integration: security tier + self-hosted operator blockers (rebased onto v3.8.51) (#10952)

2026-08-23 16:51:25 -03:00

cacheControlSettings.ts

feat: add cache control settings and token-based metrics

2026-03-29 14:37:55 +02:00

cacheLayer.ts

fix(build): remove node: protocol prefix from all src/ imports (#turbopack-compat)

2026-03-17 04:24:46 -03:00

ccDiscoveryAliasResolve.ts

fix(sse): route claude/<provider>/<model> aliases for catalog-only providers (#9856)

2026-08-09 09:52:28 -03:00

cloudflaredTunnel.ts

feat(tunnels): support named cloudflared tunnels via CLOUDFLARED_CONFIG (#11561)

2026-08-26 08:11:09 -03:00

cloudSync.stub.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

cloudSync.ts

fix(security): reject unverifiable X-Cloud-Sig in cloud-sync HMAC check (#13679 PR A) (#13804)

2026-09-16 06:10:58 -03:00

consoleInterceptor.ts

fix(logging): keep the component and apply printf formats in the app log (#10770)

2026-08-20 06:29:42 -03:00

container.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

contextWindowResolver.ts

fix(vertex): discover and route partner models correctly (#12471)

2026-09-16 16:37:41 -03:00

dataPaths.ts

fix(db): harden migration recovery snapshots (#12435)

2026-09-03 21:01:09 -03:00

docsI18nPath.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

docsLinkResolver.ts

fix(docs): resolve relative markdown and wiki links across Fumadocs and GitHub wiki (#11834)

2026-08-30 09:09:36 -03:00

docsSanitizer.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

exclusiveLeaseIsolation.ts

fix(lease): remove global static reservation and gate routing on live active lease occupancy (#11775)

2026-08-30 09:21:53 -03:00

freeProviderRankings.ts

feat(rankings): order free providers by measured reliability (#12218)

2026-09-01 11:58:15 -03:00

freeProviderRankingsAuthType.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

freeProviderRankingsUsage.ts

feat(rankings): order free providers by measured reliability (#12218)

2026-09-01 11:58:15 -03:00

gracefulShutdown.ts

fix(db): bound health scans and isolate native diagnostics (#13717)

2026-09-16 12:59:45 -03:00

healthzLag.ts

feat(resilience): warn on slow /healthz event-loop lag (#10827)

2026-08-20 11:47:38 -03:00

idempotencyLayer.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

initCloudSync.ts

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

instrumentationBootError.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

ipUtils.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

localHealthCheck.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

logEnv.ts

fix(logging): raise chat-log array truncation cap to 1000 and unify duplicate implementations (#11499)

2026-08-25 20:11:56 -03:00

logPayloads.ts

fix(logging): mask *-api-key headers in request-log pipeline (#13273) (#13401)

2026-09-14 23:14:35 -03:00

logRotation.ts

fix(dev): make logging resources HMR-singleton (#12079)

2026-08-31 14:13:53 -03:00

machineToken.ts

fix(security): generate a random per-install CLI token salt (#13679) (#13909)

2026-09-17 10:45:43 -03:00

modelAliasResolver.ts

fix(routing): preserve combo precedence and skip hidden models in alias resolver (#11107)

2026-08-23 07:01:07 -03:00

modelAliasSeed.ts

fix(routing): fallback to default model alias seeds when unmapped in database (#10124)

2026-08-17 08:21:53 -03:00

modelCapabilities.ts

fix(vision): honor Custom Models vision flag on advertised aliases (#12974)

2026-09-11 19:28:32 -03:00

modelCapabilityModalities.ts

feat: add Video Bridge frame sampling (#10483)

2026-08-15 14:23:29 -03:00

modelCapabilityOverrideTargets.ts

cherry-pick(pr-9569): fix(settings): use provider prefixes in model overrides (#9878)

2026-08-09 09:55:16 -03:00

modelCapabilityResolutionSnapshot.ts

fix(catalog): scope combo reasoning efforts by connection (#10723)

2026-08-20 09:31:12 -03:00

modelMetadataRegistry.ts

fix(resilience): name collision keys, surface header drops, retry embeds, skip far-reset pings (#13766)

2026-09-16 13:36:35 -03:00

modelsDevSync.ts

fix(catalog): degrade unknown combo targets in LCD modalities (#12613) (#13042)

2026-09-11 19:28:21 -03:00

ngrokTunnel.ts

Release v3.7.5 (#1753)

2026-04-30 01:27:03 -03:00

obsidianSync.ts

fix(auth): close the JWT_SECRET bootstrap chain — real-peer loopback, obsidian always-protected, DATA_DIR vault refusal (#13791)

2026-09-15 16:58:24 -03:00

omnirouteStatus.ts

feat(api): add provider quota telemetry, adaptive routing, and status inventory (#10148)

2026-08-18 11:31:53 -03:00

piiSanitizer.ts

fix(pii): preserve custom event names and apply stream PII sanitization fixes (#3056)

2026-06-01 23:13:19 -03:00

pricingSync.ts

fix(pricing): 3 dead entries in LITELLM_PROVIDER_MAP silently drop synced pricing (#10636)

2026-08-20 13:11:03 -03:00

providerNodePrefixes.ts

fix(providers): retire common ChatGPT Web provider (#11754)

2026-08-28 06:52:46 -03:00

proxyEchoTarget.ts

fix(proxy): stop reporting IPv4-only proxies as dead (#10868)

2026-08-20 15:19:32 -03:00

proxyEgress.ts

fix(proxies): preserve inactive and dead statuses during pool validation (#13612)

2026-09-15 10:11:44 -03:00

proxyHealth.ts

feat(proxies): stop re-serving a proxy that just failed (#13578)

2026-09-15 18:09:02 -03:00

proxyLogger.ts

feat(proxy-logs): keep the HTTP status the provider actually returned (#13580)

2026-09-15 18:26:15 -03:00

proxyPoolEgressObservation.ts

feat(proxies): show how many egress IPs actually served a proxy pool (#13581)

2026-09-15 19:48:52 -03:00

semanticCache.ts

fix(semantic-cache): never cache a truncated completion (#7) (#12885)

2026-09-16 13:46:04 -03:00

serverLifecycle.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

sessionObservability.ts

feat(dashboard): surface exclusive managed leases in Sessions view (#11389)

2026-08-25 01:38:59 -03:00

source.ts

fix(bun): make server child and outbound fetch Bun-safe (#9761)

2026-08-11 09:16:23 -03:00

sseTextTransform.ts

fix(sse): stop PII sanitizer splicing OpenRouter metadata into content (#13488) (#13792)

2026-09-16 06:13:14 -03:00

streamingPiiTransform.ts

fix(sse): stop PII sanitizer splicing OpenRouter metadata into content (#13488) (#13792)

2026-09-16 06:13:14 -03:00

tailscaleTunnel.ts

fix(tailscale): validate ports and quote MSI paths (#11534)

2026-08-25 13:12:38 -03:00

tokenHealthCheck.ts

fix(oauth): soft-fail Claude refresh so CredentialHealth is not sticky-dead (#13185)

2026-09-16 23:10:24 -03:00

tokenHealthCheckCopilot.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

tokenHealthCheckCursor.ts

fix(barrel): delete the @/lib/localDb barrel — every consumer migrated (#11795 Phase 5) (#12055)

2026-08-30 02:36:26 -03:00

tokenHealthCheckKimi.ts

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

tokenHealthCheckProxyGuard.ts

fix(sse): fail closed on background token-refresh for dead proxy pools (#13470) (#13793)

2026-09-16 06:12:59 -03:00

tokenHealthCheckWebCookie.ts

feat(providers): verify-only health sweep for web-cookie connections (#11488) (#11495)

2026-08-26 08:11:30 -03:00

tokenRefreshCircuit.ts

fix(oauth): soft-fail Claude refresh so CredentialHealth is not sticky-dead (#13185)

2026-09-16 23:10:24 -03:00

toolPolicy.ts

feat(phase2+3): DI container, plugins, PII sanitizer, tool policy, audit log, cache invalidation, ARIA, CSS vars

2026-02-18 14:43:57 -03:00

translatorEvents.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

usageAnalytics.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

usageDb.ts

Release v3.8.18 (#3482)

2026-06-09 15:56:24 -03:00

warmupScheduler.ts

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

webhookDispatcher.ts

fix(api): close DNS-rebinding SSRF gap in webhook outbound-URL guard (#12569) (#13243)

2026-09-11 22:04:21 -03:00

wellKnown.ts

fix: make release/v3.8.50 CI gates green (run 32786966560 root causes) (#11450)

2026-08-25 18:55:18 -03:00