anhtahaylove 30c96d43a5 fix(telegram): bound the per-user API key cache (#13166) ...

`resolveUserApiKey()` keyed an uncapped Map on an id taken straight from the webhook body. The LRU's recency test is what keeps this from regressing into a clear-when-full cache.

---

Validated in one consolidated worktree cut from `release/v3.8.51`, boarded together with the other 13 PRs of this batch — zero merge conflicts between them.

- `typecheck:core` clean
- complexity 2799 / baseline 3218 and cognitive-complexity 1265 / baseline 1437 — both under baseline
- 71 focused assertions green across the 13 test files this batch adds or touches

⚠️ base-red inherited: #12732 — `Docs Gates (fast-path)`, `Merge integrity`, `No new ESLint warnings`, `Unit Tests fast-path` and `Fast Quality Gates` all reproduce on the pure `release/v3.8.51` tip (provider count 356 vs the 358 the modules define, SKILL.md drift, and `open-sse/utils/stream.ts` at 3115 > frozen 3098). None of them touch this diff.

Thanks @anhtahaylove — the root-cause write-up, the measured before/after numbers and the red-before-green proof on every one of these made the batch reviewable as a unit.

2026-09-11 13:27:30 -03:00

..

a2a

fix(dashboard): orchestration canvas fase 3 — follow-ups da review final (#12639) (#12988)

2026-09-10 10:23:52 -03:00

accessTokens

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

acp

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00

agentSkills

fix(skills): read positionals declared with .addArgument() (#13009)

2026-09-10 18:13:37 -03:00

api

fix(dashboard): test Responses nodes on /v1/responses, not chat completions (#13070) (#13087)

2026-09-10 18:13:08 -03:00

audit

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

auth

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

batches

fix(dev): isolate batch dispatch from instrumentation (#12081)

2026-08-31 14:14:02 -03:00

build-profile

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

catalog

chore(startup): remove server-init.ts, a module nothing imports (#10780)

2026-08-20 10:27:26 -03:00

chaos

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

cli-helper

fix(cli): preserve Claude settings on config set (#12432)

2026-09-03 23:26:59 -03:00

cliTools

feat(cli): support Grok Build custom host configuration (#10830)

2026-08-21 00:29:01 -03:00

cloudAgent

feat(dashboard): orchestration canvas fase 2 — agents WS channel (2.1) (#12409)

2026-09-02 01:19:49 -03:00

combos

fix(dashboard): test Responses nodes on /v1/responses, not chat completions (#13070) (#13087)

2026-09-10 18:13:08 -03:00

compliance

fix(compliance): redact extra provider API keys (#10521)

2026-08-18 10:51:34 -03:00

compression

perf(executors): lazy-load the executor registry — defer class imports + construction to first use (#11220) (#11421)

2026-08-25 18:22:46 -03:00

conductor

fix(dashboard): orchestration canvas fase 3 — follow-ups da review final (#12639) (#12988)

2026-09-10 10:23:52 -03:00

config

feat(config): add support for runtime system prompt configuration and hot-reloading (#11841)

2026-08-30 02:51:34 -03:00

copilot

docs(audit): align every published number with the code and harden check:docs-counts (#12200)

2026-08-31 13:39:21 -03:00

credentialHealth

fix(monitoring): expose failed connection ids on credentialHealth (#12876)

2026-09-10 10:42:26 -03:00

cursor

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

db

fix(api): scope batch bulk-delete to the calling API key (#13211)

2026-09-10 13:27:10 -03:00

discovery

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

display

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

embeddings

fix(combo): do not treat credits-exhausted 401 as auth skip (#12449)

2026-09-03 23:38:57 -03:00

env

feat(a2a): inbound delegation to the OmniConductor fleet via POST /api/a2a/tasks (PRD RF5) (#8223)

2026-08-12 02:13:41 -03:00

evals

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

events

feat(dashboard): orchestration canvas fase 2 — agents WS channel (2.1) (#12409)

2026-09-02 01:19:49 -03:00

freeProxyProviders

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

gamification

feat(gamification): show the real daily streak on the profile page (#12377)

2026-09-02 03:14:41 -03:00

guardrails

fix(security): scan both ends of an oversized body, not just the front (#13104)

2026-09-10 18:13:20 -03:00

headroom

Release v3.8.46

2026-07-07 13:14:06 -03:00

images

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

inspector

chore(quality): remove unreachable code and restore test discovery (#11950)

2026-09-01 11:06:04 -03:00

issueAgent

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

jobRegistry

maint: follow-up cherry-pick fix-in-place #9631 (conflict-resolved fallback) (#9886)

2026-08-09 09:54:47 -03:00

jobs

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

kimi

feat(sse): add kimi web token lifecycle manager, rolling auto-refresh and 401 recovery (#10944)

2026-08-21 04:25:56 -03:00

localCorpus

refactor(local-corpus): implement dynamic root resolution and LRU cache (#11491)

2026-08-25 21:08:05 -03:00

logExport

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

memory

fix(memory): list and serve embedding/rerank models from every configured provider (#11390)

2026-09-02 00:27:29 -03:00

middleware

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

modelsDevSync

refactor(providers): remove the Puter provider at its owner's request (#10210)

2026-08-12 16:54:50 -03:00

monitoring

fix(monitoring): expose failed connection ids on credentialHealth (#12876)

2026-09-10 10:42:26 -03:00

notion

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

oauth

feat(models): live account catalog for Claude, Codex, Copilot, AGY (#12866)

2026-09-07 09:02:59 -03:00

obsidian

feat(observability): add Obsidian context source with 24 MCP tools (#3077)

2026-06-03 06:45:04 -03:00

playground

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690)

2026-08-26 17:54:57 -03:00

plugins

fix(plugins): refresh stored manifest from disk on activate so new hook fields reach existing installs (#12120)

2026-08-30 11:11:29 -03:00

promptCache

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

providerModels

feat(models): live account catalog for Claude, Codex, Copilot, AGY (#12866)

2026-09-07 09:02:59 -03:00

providers

fix(credentialHealth): do not poison multi-upstream openai-compat conn on one model 402 (#12875)

2026-09-10 10:42:34 -03:00

proxyHealth

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

proxyRelay

fix(relay): strip unsafe forwarded headers (#11533)

2026-08-25 13:12:50 -03:00

proxySubscription

fix(proxy-subscriptions): allow local/loopback proxy-subscription fetch URLs (#10416)

2026-08-18 10:49:52 -03:00

quota

fix(quota): dedup concurrent getSaturation misses with singleflight (#12787)

2026-09-08 09:29:38 -03:00

radar

feat(catalog): eligibility-gated free-tier bucket (#12669)

2026-09-04 00:45:38 -03:00

reasoningRouting

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

resilience

fix(resilience): stop unbounded queue that hangs 6min until Aborted (#12715)

2026-09-10 10:49:34 -03:00

routerEval

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

routing

feat(api): add provider quota telemetry, adaptive routing, and status inventory (#10148)

2026-08-18 11:31:53 -03:00

runtime

feat: enhance port configuration and API bridge support

2026-02-26 15:11:40 +00:00

search

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690)

2026-08-26 17:54:57 -03:00

security

Release v3.8.31 (#4377)

2026-06-20 14:55:24 -03:00

services

fix(providers): resolve the Codex auto-ping model from the live catalog instead of a retired id (#12361)

2026-09-02 03:12:51 -03:00

skills

fix(chat): continue after a server-owned tool on Chat Completions (#12867)

2026-09-07 09:15:00 -03:00

spend

feat(core): add payload rules, tag routing, and scheduled budgets

2026-04-17 09:00:32 -03:00

sync

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

system

fix(system): propagate abort signal to stream reader in HTTP version checks (#12232)

2026-09-01 12:07:02 -03:00

telegram

fix(telegram): bound the per-user API key cache (#13166)

2026-09-11 13:27:30 -03:00

translator

feat(dashboard): add custom CLI builder and eval suite management

2026-04-23 16:57:43 -03:00

usage

fix(responses-continuation): bridge the write-in-flight window with an in-memory pending store (#12854)

2026-09-10 10:23:26 -03:00

versionManager

fix(cli): complete Windows cliproxy platform handling + pid probe (#11236) (#11263)

2026-08-23 14:25:04 -03:00

vncSession

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

vscode

fix(reasoning): forward Ollama Cloud thinking (#9290)

2026-08-04 14:34:02 -03:00

warmupScheduler

feat(warmup): proactive Claude warmup scheduler (#8848) (#9449)

2026-08-07 20:53:21 -03:00

webhooks

fix(webhooks): remove 3 declared-but-never-emitted ghost events (#11050)

2026-08-21 20:54:51 -03:00

ws

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

zed-oauth

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

admissionVirtualLanes.ts

feat: combo-lane awareness + activation UX + MCP visibility (Wave 2 of #9654) (#10039)

2026-08-18 11:31:46 -03:00

apiBridgeServer.ts

fix(sse): import httpClientAbortGuard with explicit .mjs extension (#11671)

2026-08-26 17:40:22 -03:00

apiKeyExposure.ts

Release v3.8.27 (#3968)

2026-06-17 02:43:21 -03:00

arenaEloSync.ts

fix(db): rate-limit Arena ELO fetch-failure warnings on repeated timeouts (#11500) (#11989)

2026-08-29 08:10:17 -03:00

buildPhase.ts

Integration: security tier + self-hosted operator blockers (rebased onto v3.8.51) (#10952)

2026-08-23 16:51:25 -03:00

cacheControlSettings.ts

feat: add cache control settings and token-based metrics

2026-03-29 14:37:55 +02:00

cacheLayer.ts

fix(build): remove node: protocol prefix from all src/ imports (#turbopack-compat)

2026-03-17 04:24:46 -03:00

ccDiscoveryAliasResolve.ts

fix(sse): route claude/<provider>/<model> aliases for catalog-only providers (#9856)

2026-08-09 09:52:28 -03:00

cloudflaredTunnel.ts

feat(tunnels): support named cloudflared tunnels via CLOUDFLARED_CONFIG (#11561)

2026-08-26 08:11:09 -03:00

cloudSync.stub.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

cloudSync.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

consoleInterceptor.ts

fix(logging): keep the component and apply printf formats in the app log (#10770)

2026-08-20 06:29:42 -03:00

container.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

contextWindowResolver.ts

feat(models): unify token limit overrides (#8908)

2026-08-05 22:41:38 -03:00

dataPaths.ts

fix(db): harden migration recovery snapshots (#12435)

2026-09-03 21:01:09 -03:00

docsI18nPath.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

docsLinkResolver.ts

fix(docs): resolve relative markdown and wiki links across Fumadocs and GitHub wiki (#11834)

2026-08-30 09:09:36 -03:00

docsSanitizer.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

exclusiveLeaseIsolation.ts

fix(lease): remove global static reservation and gate routing on live active lease occupancy (#11775)

2026-08-30 09:21:53 -03:00

freeProviderRankings.ts

feat(rankings): order free providers by measured reliability (#12218)

2026-09-01 11:58:15 -03:00

freeProviderRankingsAuthType.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

freeProviderRankingsUsage.ts

feat(rankings): order free providers by measured reliability (#12218)

2026-09-01 11:58:15 -03:00

gracefulShutdown.ts

fix(dev): make logging resources HMR-singleton (#12079)

2026-08-31 14:13:53 -03:00

healthzLag.ts

feat(resilience): warn on slow /healthz event-loop lag (#10827)

2026-08-20 11:47:38 -03:00

idempotencyLayer.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

initCloudSync.ts

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

instrumentationBootError.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

ipUtils.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

localHealthCheck.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

logEnv.ts

fix(logging): raise chat-log array truncation cap to 1000 and unify duplicate implementations (#11499)

2026-08-25 20:11:56 -03:00

logPayloads.ts

fix(security): harden public error boundaries (#12506)

2026-09-03 21:31:13 -03:00

logRotation.ts

fix(dev): make logging resources HMR-singleton (#12079)

2026-08-31 14:13:53 -03:00

machineToken.ts

fix(dev): silence webpack runtime module warnings (#12228)

2026-09-01 00:50:58 -03:00

modelAliasResolver.ts

fix(routing): preserve combo precedence and skip hidden models in alias resolver (#11107)

2026-08-23 07:01:07 -03:00

modelAliasSeed.ts

fix(routing): fallback to default model alias seeds when unmapped in database (#10124)

2026-08-17 08:21:53 -03:00

modelCapabilities.ts

fix(combo): resolve effort variants via base model capabilities (#11034)

2026-08-21 14:58:53 -03:00

modelCapabilityModalities.ts

feat: add Video Bridge frame sampling (#10483)

2026-08-15 14:23:29 -03:00

modelCapabilityOverrideTargets.ts

cherry-pick(pr-9569): fix(settings): use provider prefixes in model overrides (#9878)

2026-08-09 09:55:16 -03:00

modelCapabilityResolutionSnapshot.ts

fix(catalog): scope combo reasoning efforts by connection (#10723)

2026-08-20 09:31:12 -03:00

modelMetadataRegistry.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

modelsDevSync.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

ngrokTunnel.ts

Release v3.7.5 (#1753)

2026-04-30 01:27:03 -03:00

obsidianSync.ts

feat(observability): add Obsidian context source with 24 MCP tools (#3077)

2026-06-03 06:45:04 -03:00

omnirouteStatus.ts

feat(api): add provider quota telemetry, adaptive routing, and status inventory (#10148)

2026-08-18 11:31:53 -03:00

piiSanitizer.ts

fix(pii): preserve custom event names and apply stream PII sanitization fixes (#3056)

2026-06-01 23:13:19 -03:00

pricingSync.ts

fix(pricing): 3 dead entries in LITELLM_PROVIDER_MAP silently drop synced pricing (#10636)

2026-08-20 13:11:03 -03:00

providerNodePrefixes.ts

fix(providers): retire common ChatGPT Web provider (#11754)

2026-08-28 06:52:46 -03:00

proxyEchoTarget.ts

fix(proxy): stop reporting IPv4-only proxies as dead (#10868)

2026-08-20 15:19:32 -03:00

proxyEgress.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

proxyHealth.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

proxyLogger.ts

fix(security): harden public error boundaries (#12506)

2026-09-03 21:31:13 -03:00

semanticCache.ts

fix(cache): expire a semantic-cache row on its TTL, not at UTC midnight (#11559) (#11573)

2026-08-26 08:10:51 -03:00

serverLifecycle.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

sessionObservability.ts

feat(dashboard): surface exclusive managed leases in Sessions view (#11389)

2026-08-25 01:38:59 -03:00

source.ts

fix(bun): make server child and outbound fetch Bun-safe (#9761)

2026-08-11 09:16:23 -03:00

sseTextTransform.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

streamingPiiTransform.ts

fix(types): preserve streaming PII choice keys (#9566)

2026-08-07 20:54:11 -03:00

tailscaleTunnel.ts

fix(tailscale): validate ports and quote MSI paths (#11534)

2026-08-25 13:12:38 -03:00

tokenHealthCheck.ts

fix(auth): do not park healthy quota accounts as expired (#12452)

2026-09-03 23:39:22 -03:00

tokenHealthCheckCopilot.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

tokenHealthCheckCursor.ts

fix(barrel): delete the @/lib/localDb barrel — every consumer migrated (#11795 Phase 5) (#12055)

2026-08-30 02:36:26 -03:00

tokenHealthCheckKimi.ts

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

tokenHealthCheckWebCookie.ts

feat(providers): verify-only health sweep for web-cookie connections (#11488) (#11495)

2026-08-26 08:11:30 -03:00

toolPolicy.ts

feat(phase2+3): DI container, plugins, PII sanitizer, tool policy, audit log, cache invalidation, ARIA, CSS vars

2026-02-18 14:43:57 -03:00

translatorEvents.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

usageAnalytics.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

usageDb.ts

Release v3.8.18 (#3482)

2026-06-09 15:56:24 -03:00

warmupScheduler.ts

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

webhookDispatcher.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

wellKnown.ts

fix: make release/v3.8.50 CI gates green (run 32786966560 root causes) (#11450)

2026-08-25 18:55:18 -03:00