Markus Hartung 528fba953d fix(security): redact NVIDIA_API_KEY at the log sink in the ad-hoc diag script ...

CodeQL alert #866 (js/clear-text-logging) flagged the console.log wrapper
in nvidia-startswith-diag.ts, attributing the source to an unrelated
NOAUTH_IDS constant in tests/unit/executor-web-cookie-sweep.test.ts — no
real import/dataflow connects the two files.

The genuine risk in this script is independent of that attribution: an
upstream error or a validateProviderApiKey() result could echo the raw
NVIDIA_API_KEY back through err.stack/err.message/result, which the
script logs verbatim. The line() sink now strips any literal occurrence
of the key before it reaches the terminal, closing the clear-text-logging
class regardless of the exact taint path CodeQL reported.

2026-08-26 10:13:45 -03:00

..

ad-hoc

fix(security): redact NVIDIA_API_KEY at the log sink in the ad-hoc diag script

2026-08-26 10:13:45 -03:00

build

test(build): pin the bundler flag to OMNIROUTE_USE_TURBOPACK, the contract it implements (#11583)

2026-08-26 08:10:20 -03:00

check

fix(check): await the now-async getExecutor in the known-symbols gate (#11421) (#11582)

2026-08-26 08:10:24 -03:00

ci

fix(ci): skip stale release Docker publishes (#11527)

2026-08-25 13:12:02 -03:00

cli

fix(cli): generated combo PATCH sends literal {id} — resolve $ref params + requestBody (#10955) (#11013)

2026-08-21 13:57:46 -03:00

compression

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

compression-eval

Release v3.8.35 (#4743)

2026-06-23 17:06:18 -03:00

dev

fix(sse): prevent client-abort (aborted/ECONNRESET) from crashing the server (#11556)

2026-08-26 08:11:14 -03:00

devin-bridge

feat(executors): add isolated Claude Code bridge over Devin ACP (#8914)

2026-08-06 11:08:37 -03:00

docker

fix(docker): real image tags (bifrost/cliproxyapi) + complete OMNIROUTE_BASE_PATH runtime patcher (#10482)

2026-08-17 08:24:27 -03:00

docs

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

features

feat: gamification & leaderboard system (#2405)

2026-05-19 09:46:20 -03:00

homolog

feat(homolog): real-environment E2E homologation suite (npm run homolog) (#7133)

2026-07-14 16:24:11 -03:00

i18n

fix(i18n): stop rendering the Disabled status as "person with a disability" (#10853)

2026-08-20 15:20:19 -03:00

ops

fix(ops): judge the canary install by the SHA on disk, not npm's exit code (#10699)

2026-08-18 21:51:01 -03:00

packs

fix(deps): upgrade @atjsh/llmlingua-2 to 2.0.5 and drop @tensorflow/tfjs (#10610)

2026-08-20 22:02:14 -03:00

perf

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

quality

fix(autoCombo,sse): catalog hygiene — retire dead FITNESS_TABLE rows, fix 7 BUILT_IN_ALIASES targets, add model-lifecycle gate (#11503) (#11507)

2026-08-25 13:52:23 -03:00

raycast

feat(oauth): add Raycast Pro provider with local auto-import (#8895)

2026-08-06 11:08:44 -03:00

release

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

research

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

router-eval

fix(router-eval): retained-optimization gate cleanup (#7318)

2026-07-18 15:13:39 -03:00

skills

feat(agent-skills): add CLI wrapper scripts/skills/generate-agent-skills.mjs

2026-05-27 21:54:50 -03:00

sre

cherry-pick(pr-9744): test(integration): add general live-test tool for the real "default" combo + rootless wire capture (#9862)

2026-08-09 09:53:07 -03:00

test

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

vps

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

check-permissions.sh

fix(docker): honor OMNIROUTE_BASE_PATH behind reverse-proxy subpaths (#8615)

2026-07-27 19:07:58 -03:00

postinstall.mjs

feat(runtime): dynamic SQLite runtime installer with 5-step fallback chain

2026-05-15 00:05:49 -03:00

start-ws-server.mjs

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00