Nguyen Thanh Dat 751247a143 fix(security): scan both ends of an oversized body, not just the front (#13104) ...

Boarded with 13 sibling PRs into one worktree off release/v3.8.51 and validated as a set: 132 focused tests pass across all 15 test files in the batch, typecheck:core is clean, check-changelog-integrity reports no lost base bullets, and check-file-size is green. Your PR merged without conflict against its siblings.

Thank you — the write-up made this reviewable: measuring the behaviour on the release tip and showing the before/after table meant the defect could be confirmed rather than taken on faith.

2026-09-10 18:13:20 -03:00

..

a11yAudit.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

api.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

apiAuth.ts

fix(barrel): migrate open-sse, src/shared, src/sse, src/models, src/domain off the @/lib/localDb barrel import (#11795 Phase 4) (#12053)

2026-08-30 02:31:09 -03:00

apiKey.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

apiKeyPolicy.ts

fix(security): harden public error boundaries (#12506)

2026-09-03 21:31:13 -03:00

autoDisableBanned.ts

feat(resilience): scope auto-disable banned accounts to subscriptions (#10617)

2026-08-18 10:53:24 -03:00

basePath.ts

fix(client): rewrite absolute fetch/EventSource paths under basePath (#8515)

2026-07-27 21:12:49 -03:00

basePathFetch.ts

fix(client): rewrite absolute fetch/EventSource paths under basePath (#8515)

2026-07-27 21:12:49 -03:00

bulkApiKeyParser.ts

fix(api): bulk-add API keys no longer overwrite existing connections (#7234)

2026-07-17 10:40:29 -03:00

circuitBreaker.ts

fix(resilience): keep Overloaded STREAM_EARLY_EOF off the provider breaker (#12626)

2026-09-03 23:45:47 -03:00

classify429.ts

feat(quota): Moonshot Open Platform balance and TPD lock for custom nodes (#12590)

2026-09-03 12:47:50 -03:00

cliCompat.ts

fix(cli): add Gemini CLI fingerprint (#1866)

2026-05-02 00:48:54 -03:00

clientApiRouteAuth.ts

fix(api): enforce image generation API key auth (#8306)

2026-07-27 22:38:25 -03:00

clineAuth.ts

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

clipboard.ts

fix(combo): resolve cross-provider thinking 400 and http clipboard (#1444)

2026-04-21 04:36:16 -03:00

cloud.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

cn.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

codexBaseUrl.ts

fix: normalize Codex URLs and dashboard regressions (#8233)

2026-07-23 08:53:03 -03:00

codexConfig.ts

Release v3.8.31 (#4377)

2026-06-20 14:55:24 -03:00

compatibleProviderId.ts

fix(api): accept the current compatible-provider connection id scheme in the models test route (#8326) (#8359)

2026-07-24 11:44:46 -03:00

compressionHeaderEcho.ts

fix(api): echo X-OmniRoute-Compression response header (#6422) (#6441)

2026-07-06 18:38:12 -03:00

connectionStatus.ts

fix(dashboard): hide disabled provider connections from combo builder (#6984)

2026-07-17 10:39:18 -03:00

containerConfigGuard.ts

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

containerEnv.ts

fix(cli): do not treat a tmpfs mount as proof a config path reaches the host

2026-08-25 08:12:51 +00:00

correlationPreserve.ts

fix(api): preserve caller-provided X-Correlation-Id on chat completions (#11760)

2026-08-30 04:06:52 -03:00

cors.ts

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

dashboardCsrf.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

envBoolean.ts

fix(guardrails): align INPUT_SANITIZER request masking gate (#8093) (#8124)

2026-07-23 04:50:43 -03:00

featureFlags.ts

fix(chat): continue after a server-owned tool on Chat Completions (#12867)

2026-09-07 09:15:00 -03:00

fetchError.ts

Release v3.8.14 (#3340)

2026-06-07 07:20:02 -03:00

fetchTimeout.ts

fix: NVIDIA NIM API key validation timeout (bypass proxy fetch patch) (#3226)

2026-06-05 11:52:27 -03:00

formatRemaining.ts

maint: follow-up cherry-pick fix-in-place #9510 (fallback resolution) (#9880)

2026-08-09 10:07:10 -03:00

formatting.ts

feat(dashboard): show cache percentage in request logs (#11970)

2026-08-30 09:13:39 -03:00

freeModels.ts

fix(models): stop treating provider-supplied free flags as trusted without a documented free tier (#12744)

2026-09-10 09:12:07 -03:00

globPattern.ts

feat: replace free-text model inputs with hidePaid-aware Selects (#6540) (#7229)

2026-07-17 10:40:18 -03:00

grokBilling.ts

feat(usage): show Grok Build billing limits (#9205)

2026-08-04 18:07:02 -03:00

httpClientAbortGuard.mjs

fix(sse): absorb AbortError/request_signal_aborted in the client-abort crash guard (#12165)

2026-08-31 14:10:33 -03:00

index.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

injectionSeverity.ts

fix(guardrails): align INPUT_SANITIZER request masking gate (#8093) (#8124)

2026-07-23 04:50:43 -03:00

inputSanitizer.ts

fix(security): scan both ends of an oversized body, not just the front (#13104)

2026-09-10 18:13:20 -03:00

keyedMutex.ts

feat(cursor): proactively renews Cursor sessions and fixes manual refresh (#9173)

2026-08-11 04:31:24 -03:00

kimiBilling.ts

feat(usage): show Kimi Coding Extra Usage (#10712)

2026-08-20 06:28:37 -03:00

linkify.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

logger.ts

fix(dev): make logging resources HMR-singleton (#12079)

2026-08-31 14:13:53 -03:00

loggerResource.ts

fix(dev): make logging resources HMR-singleton (#12079)

2026-08-31 14:13:53 -03:00

logRedaction.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

m365HarImport.ts

fix(m365): BizChat invocation shape drift + HAR-import UX + Antigravity alias note (#11069)

2026-08-21 22:32:19 -03:00

machine.ts

Release v3.8.22 (#3623)

2026-06-11 18:52:29 -03:00

machineId.ts

fix: avoid cmd.exe spawn on Windows by using os.hostname() before execSync fallback (#7841)

2026-07-20 15:56:15 -03:00

maskEmail.ts

feat(settings): unify routing rules and model aliases controls

2026-04-12 18:43:19 -03:00

modelCatalogSearch.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

modelExposureList.ts

feat(api): explicit model exposure allow/deny list for /v1/models (#11481) (#11997)

2026-08-29 15:40:32 -03:00

modelListResolution.ts

fix(pool): diagnose empty pools, align catalog filter, and surface drop reasons (#12795)

2026-09-10 09:25:59 -03:00

noAuthProviders.ts

feat(mcp): implement dynamic runtime tool schema plumbing for blocked providers (#11100) (#11155)

2026-08-22 20:23:04 -03:00

nodeRuntimeSupport.ts

feat(cli): add native Bun backend support and Dockerfile.bun (#11039)

2026-08-21 21:28:43 -03:00

numeric.ts

feat: canonical numeric helpers + tier-1 (analytics) migration (#7879) (#7969)

2026-07-22 02:35:08 -03:00

parseApiKeys.ts

feat(providers): implement bulk paste for extra API keys (#1916)

2026-05-03 16:17:38 -03:00

probeOrigin.ts

fix(probe): isolate probe-origin failures from all deactivation sites (#10694)

2026-08-20 10:30:29 -03:00

providerBilling.ts

feat(usage): show Kimi Coding Extra Usage (#10712)

2026-08-20 06:28:37 -03:00

providerConnectionStatus.ts

fix(providers): unify connection and routing flows (#7629)

2026-07-18 21:20:09 -03:00

providerCredentialRequirement.ts

fix(providers): retire Qwen Web pending provenance review (#11713)

2026-08-28 06:01:21 -03:00

providerDisplayLabel.ts

fix(dashboard): resolve custom provider display name across surfaces (#2968)

2026-05-31 09:34:16 -03:00

providerFallbackColor.ts

fix(dashboard): show custom provider_nodes providers in the Topology view instead of only AI_PROVIDERS (#8328) (#8357)

2026-07-24 11:44:29 -03:00

providerHints.ts

Merge remote-tracking branch 'origin/release/v3.8.0' into feat/zero-config-auto-routing

2026-05-10 18:33:20 -03:00

providerModelAliases.ts

fix openrouter available models sync

2026-03-30 17:07:46 -04:00

providerQuotaVisibility.ts

feat(quota): Moonshot Open Platform balance and TPD lock for custom nodes (#12590)

2026-09-03 12:47:50 -03:00

rateLimiter.ts

feat(redis): add configurable key namespace prefix (#11042)

2026-08-22 18:56:45 -03:00

releaseNotes.ts

fix(radar): close cumulative quality regressions

2026-08-14 19:47:07 -03:00

requestId.ts

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

requestTelemetry.ts

Release v3.7.6 (#1803)

2026-04-30 14:08:50 -03:00

requestTimeout.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

resolveOmniRouteBaseUrl.ts

chore(release): v3.5.6 — email masking, model toggle, OpenRouter registries & bug fixes (#1080)

2026-04-09 15:55:59 -03:00

runtimeTimeouts.ts

maint: follow-up cherry-pick fix-in-place #9711 (conflict-resolved fallback) (#9891)

2026-08-09 10:08:25 -03:00

secretsValidator.ts

chore(security): drop the unused enforceSecrets() duplicate (#10775)

2026-08-20 06:30:05 -03:00

secureRandom.ts

Release v3.8.32 (#4418)

2026-06-21 08:56:51 -03:00

serviceTierLabels.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

shuffleDeck.ts

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

sidebarExpansionState.ts

Restore proxy navigation and sidebar accordion state (#7381)

2026-07-18 15:13:19 -03:00

sidebarRouteMatch.ts

feat: implement email masking for test result labels and refactor sidebar route matching logic

2026-04-13 17:39:45 -03:00

sidebarSearch.ts

feat: sidebar search/filter input (#4013) (#6810)

2026-07-11 05:04:13 -03:00

structuredLogger.ts

fix(logs): stop the async-EPIPE log-flood loop at its ignition point (#8207)

2026-07-23 05:11:11 -03:00

terminalStatus.ts

fix(security): harden public error boundaries (#12506)

2026-09-03 21:31:13 -03:00

testProcess.ts

fix(base-red): correct swapped isAutomatedTestProcess(argv, env) call

2026-07-18 22:23:48 -03:00

tiktokenCounter.ts

perf(compression): OOM mitigations for large payload hashing, memoization, and token estimation (#7847) (#11844)

2026-09-02 00:01:59 -03:00

timingSafeCompare.ts

fix(security): compare the OIDC state cookie in constant time (#11646)

2026-08-26 17:40:45 -03:00

turkishText.ts

fix(providers): handle space-separated search queries via matchesAnyToken (#8660)

2026-07-27 17:24:04 -03:00

upstreamError.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

webCookieExpiry.ts

feat(providers): derive + surface expiry for JWT-bearing web cookies (#11497) (#11505)

2026-08-25 18:22:34 -03:00

wsPath.ts

chore(release): clear release/v3.8.51 base-red gates — docs count, stryker list, lockfile host, stale suppressions, 7 lint regressions (#11502)

2026-08-25 13:51:18 -03:00