Diego Rodrigues de Sa e Souza 79c4197f07 fix(security): reject unverifiable X-Cloud-Sig in cloud-sync HMAC check (#13679 PR A) (#13804) ...

Merged in the 2026-09-16 sweep of the maintainer's own open PRs, at the owner's explicit instruction. No push was made to the PR branch: the merge took the head as the owning session left it (verified OPEN, non-draft and MERGEABLE against the release tip immediately before merging).

2026-09-16 06:10:58 -03:00

..

a2a

fix(a2a): accept dashboard session auth on /a2a route (#12888) (#13271)

2026-09-11 22:29:21 -03:00

accessTokens

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

acp

fix(acp): bound session output buffers and reset stderr per prompt (#13100)

2026-09-11 13:32:51 -03:00

agentSkills

fix(skills): read positionals declared with .addArgument() (#13009)

2026-09-10 18:13:37 -03:00

api

fix(api): give the #13376 model-test skip a real httpStatus (#13730)

2026-09-15 08:50:58 -03:00

audit

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

auth

fix(security): remove literal secrets from podman manifest, block CHANGEME remote login (#13679) (#13812)

2026-09-16 06:09:29 -03:00

batches

fix(dev): isolate batch dispatch from instrumentation (#12081)

2026-08-31 14:14:02 -03:00

build-profile

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

catalog

chore(startup): remove server-init.ts, a module nothing imports (#10780)

2026-08-20 10:27:26 -03:00

chaos

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

cli-helper

fix(cli-helper): clear the log stream timeout on the abort path (#13114)

2026-09-11 13:30:38 -03:00

cliTools

feat(cli): support Grok Build custom host configuration (#10830)

2026-08-21 00:29:01 -03:00

cloudAgent

fix(orchestration): emit the real task status on non-status updates (#12550)

2026-09-11 17:41:48 -03:00

combos

fix(combos): stop Gemini thinking from failing dashboard combo tests (#13560)

2026-09-16 01:47:32 -03:00

compliance

fix(compliance): redact extra provider API keys (#10521)

2026-08-18 10:51:34 -03:00

compression

perf(executors): lazy-load the executor registry — defer class imports + construction to first use (#11220) (#11421)

2026-08-25 18:22:46 -03:00

conductor

fix(dashboard): orchestration canvas fase 3 — follow-ups da review final (#12639) (#12988)

2026-09-10 10:23:52 -03:00

config

fix(config): persist background-degradation entry deletions (#12647)

2026-09-11 17:41:37 -03:00

copilot

docs(audit): align every published number with the code and harden check:docs-counts (#12200)

2026-08-31 13:39:21 -03:00

credentialHealth

fix(monitoring): expose failed connection ids on credentialHealth (#12876)

2026-09-10 10:42:26 -03:00

cursor

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

db

fix(db): cap per-request batch sweep and guard shared files (#13680, #13681) (#13805)

2026-09-16 06:10:43 -03:00

discovery

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

display

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

embeddings

fix(embeddings): send stored API key on private-host embeddings nodes (#13398)

2026-09-16 02:00:54 -03:00

env

feat(a2a): inbound delegation to the OmniConductor fleet via POST /api/a2a/tasks (PRD RF5) (#8223)

2026-08-12 02:13:41 -03:00

evals

fix(backend): eval runner opts out of output-style and memory injection (#13414)

2026-09-14 23:18:32 -03:00

events

feat(dashboard): orchestration canvas fase 2 — agents WS channel (2.1) (#12409)

2026-09-02 01:19:49 -03:00

freeProxyProviders

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

gamification

feat(gamification): pay the documented streak and badge XP rewards (#12522)

2026-09-11 17:42:32 -03:00

guardrails

fix(security): pin the public-only guard on client-supplied image URLs (#13748)

2026-09-15 13:24:50 -03:00

headroom

Release v3.8.46

2026-07-07 13:14:06 -03:00

images

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

inspector

chore(quality): remove unreachable code and restore test discovery (#11950)

2026-09-01 11:06:04 -03:00

issueAgent

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

jobRegistry

maint: follow-up cherry-pick fix-in-place #9631 (conflict-resolved fallback) (#9886)

2026-08-09 09:54:47 -03:00

jobs

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

kimi

feat(sse): add kimi web token lifecycle manager, rolling auto-refresh and 401 recovery (#10944)

2026-08-21 04:25:56 -03:00

localCorpus

refactor(local-corpus): implement dynamic root resolution and LRU cache (#11491)

2026-08-25 21:08:05 -03:00

logExport

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

memory

fix(ci): clear the release/v3.8.51 base-reds on the PR fast path (#13635)

2026-09-15 08:51:45 -03:00

middleware

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

modelsDevSync

refactor(providers): remove the Puter provider at its owner's request (#10210)

2026-08-12 16:54:50 -03:00

monitoring

fix(monitoring): expose failed connection ids on credentialHealth (#12876)

2026-09-10 10:42:26 -03:00

notion

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

oauth

fix(build): stop the client bundle from reaching server-only modules, and make the guard find them (#13436)

2026-09-15 12:52:41 -03:00

obsidian

feat(observability): add Obsidian context source with 24 MCP tools (#3077)

2026-06-03 06:45:04 -03:00

playground

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690)

2026-08-26 17:54:57 -03:00

plugins

fix(plugins): make SIGKILL escalation idempotent per child (#13092)

2026-09-11 13:27:42 -03:00

promptCache

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

providerModels

feat(models): live account catalog for Claude, Codex, Copilot, AGY (#12866)

2026-09-07 09:02:59 -03:00

providers

fix(dashboard): list and purge leftover gemini-cli rows (#13197)

2026-09-11 19:28:05 -03:00

proxyHealth

fix(proxy-health): refused probe responses reset the consecutive-failure streak (#13608)

2026-09-15 20:01:25 -03:00

proxyRelay

fix(relay): strip unsafe forwarded headers (#11533)

2026-08-25 13:12:50 -03:00

proxySubscription

fix(proxy): keep proxy credentials holding a literal percent (#13605)

2026-09-15 12:59:27 -03:00

quota

fix(quota): bound routing caches with shared boundedMap factory (#13280)

2026-09-15 13:08:21 -03:00

radar

feat(catalog): eligibility-gated free-tier bucket (#12669)

2026-09-04 00:45:38 -03:00

reasoningRouting

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

resilience

fix(resilience): increase requestQueue.maxWaitMs default from 15s to 30s (#13553)

2026-09-14 23:53:18 -03:00

routerEval

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

routing

feat(api): add provider quota telemetry, adaptive routing, and status inventory (#10148)

2026-08-18 11:31:53 -03:00

runtime

feat: enhance port configuration and API bridge support

2026-02-26 15:11:40 +00:00

search

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690)

2026-08-26 17:54:57 -03:00

security

Release v3.8.31 (#4377)

2026-06-20 14:55:24 -03:00

services

fix(providers): resolve the Codex auto-ping model from the live catalog instead of a retired id (#12361)

2026-09-02 03:12:51 -03:00

skills

fix(chatcore): restore provider failure classification and credential refresh on non-streaming leg (#13043) (#13069)

2026-09-11 19:27:36 -03:00

spend

feat(core): add payload rules, tag routing, and scheduled budgets

2026-04-17 09:00:32 -03:00

startup

fix(docker): bind app/sidecar compose ports to loopback by default (#12568, #12578) (#13240)

2026-09-11 22:05:14 -03:00

sync

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

system

fix(system): propagate abort signal to stream reader in HTTP version checks (#12232)

2026-09-01 12:07:02 -03:00

telegram

fix(telegram): bound the per-user API key cache (#13166)

2026-09-11 13:27:30 -03:00

translator

feat(dashboard): add custom CLI builder and eval suite management

2026-04-23 16:57:43 -03:00

usage

fix(call-logs): zod write-point guard for error_type (#13441)

2026-09-15 12:20:19 -03:00

versionManager

fix(cli): complete Windows cliproxy platform handling + pid probe (#11236) (#11263)

2026-08-23 14:25:04 -03:00

vncSession

fix(docker): require a per-session token on the VNC browser CDP bridge (#12571) (#13241)

2026-09-11 22:29:05 -03:00

vscode

fix(reasoning): forward Ollama Cloud thinking (#9290)

2026-08-04 14:34:02 -03:00

warmupScheduler

feat(warmup): proactive Claude warmup scheduler (#8848) (#9449)

2026-08-07 20:53:21 -03:00

webhooks

fix(webhooks): remove 3 declared-but-never-emitted ghost events (#11050)

2026-08-21 20:54:51 -03:00

ws

fix(auth): dashboard session requires the authenticated claim — Cursor CLI tokens are not sessions (#13375)

2026-09-11 22:29:12 -03:00

zed-oauth

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

admissionVirtualLanes.ts

feat: combo-lane awareness + activation UX + MCP visibility (Wave 2 of #9654) (#10039)

2026-08-18 11:31:46 -03:00

apiBridgeServer.ts

fix(docker): bind app/sidecar compose ports to loopback by default (#12568, #12578) (#13240)

2026-09-11 22:05:14 -03:00

apiKeyExposure.ts

Release v3.8.27 (#3968)

2026-06-17 02:43:21 -03:00

arenaEloSync.ts

fix(db): rate-limit Arena ELO fetch-failure warnings on repeated timeouts (#11500) (#11989)

2026-08-29 08:10:17 -03:00

buildPhase.ts

Integration: security tier + self-hosted operator blockers (rebased onto v3.8.51) (#10952)

2026-08-23 16:51:25 -03:00

cacheControlSettings.ts

feat: add cache control settings and token-based metrics

2026-03-29 14:37:55 +02:00

cacheLayer.ts

fix(build): remove node: protocol prefix from all src/ imports (#turbopack-compat)

2026-03-17 04:24:46 -03:00

ccDiscoveryAliasResolve.ts

fix(sse): route claude/<provider>/<model> aliases for catalog-only providers (#9856)

2026-08-09 09:52:28 -03:00

cloudflaredTunnel.ts

feat(tunnels): support named cloudflared tunnels via CLOUDFLARED_CONFIG (#11561)

2026-08-26 08:11:09 -03:00

cloudSync.stub.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

cloudSync.ts

fix(security): reject unverifiable X-Cloud-Sig in cloud-sync HMAC check (#13679 PR A) (#13804)

2026-09-16 06:10:58 -03:00

consoleInterceptor.ts

fix(logging): keep the component and apply printf formats in the app log (#10770)

2026-08-20 06:29:42 -03:00

container.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

contextWindowResolver.ts

feat(models): unify token limit overrides (#8908)

2026-08-05 22:41:38 -03:00

dataPaths.ts

fix(db): harden migration recovery snapshots (#12435)

2026-09-03 21:01:09 -03:00

docsI18nPath.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

docsLinkResolver.ts

fix(docs): resolve relative markdown and wiki links across Fumadocs and GitHub wiki (#11834)

2026-08-30 09:09:36 -03:00

docsSanitizer.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

exclusiveLeaseIsolation.ts

fix(lease): remove global static reservation and gate routing on live active lease occupancy (#11775)

2026-08-30 09:21:53 -03:00

freeProviderRankings.ts

feat(rankings): order free providers by measured reliability (#12218)

2026-09-01 11:58:15 -03:00

freeProviderRankingsAuthType.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

freeProviderRankingsUsage.ts

feat(rankings): order free providers by measured reliability (#12218)

2026-09-01 11:58:15 -03:00

gracefulShutdown.ts

fix(dev): make logging resources HMR-singleton (#12079)

2026-08-31 14:13:53 -03:00

healthzLag.ts

feat(resilience): warn on slow /healthz event-loop lag (#10827)

2026-08-20 11:47:38 -03:00

idempotencyLayer.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

initCloudSync.ts

feat(dashboard): continuous call-log export to pluggable destinations (BigQuery first) (#11945)

2026-08-30 09:16:52 -03:00

instrumentationBootError.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

ipUtils.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

localHealthCheck.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

logEnv.ts

fix(logging): raise chat-log array truncation cap to 1000 and unify duplicate implementations (#11499)

2026-08-25 20:11:56 -03:00

logPayloads.ts

fix(logging): mask *-api-key headers in request-log pipeline (#13273) (#13401)

2026-09-14 23:14:35 -03:00

logRotation.ts

fix(dev): make logging resources HMR-singleton (#12079)

2026-08-31 14:13:53 -03:00

machineToken.ts

fix(dev): silence webpack runtime module warnings (#12228)

2026-09-01 00:50:58 -03:00

modelAliasResolver.ts

fix(routing): preserve combo precedence and skip hidden models in alias resolver (#11107)

2026-08-23 07:01:07 -03:00

modelAliasSeed.ts

fix(routing): fallback to default model alias seeds when unmapped in database (#10124)

2026-08-17 08:21:53 -03:00

modelCapabilities.ts

fix(vision): honor Custom Models vision flag on advertised aliases (#12974)

2026-09-11 19:28:32 -03:00

modelCapabilityModalities.ts

feat: add Video Bridge frame sampling (#10483)

2026-08-15 14:23:29 -03:00

modelCapabilityOverrideTargets.ts

cherry-pick(pr-9569): fix(settings): use provider prefixes in model overrides (#9878)

2026-08-09 09:55:16 -03:00

modelCapabilityResolutionSnapshot.ts

fix(catalog): scope combo reasoning efforts by connection (#10723)

2026-08-20 09:31:12 -03:00

modelMetadataRegistry.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

modelsDevSync.ts

fix(catalog): degrade unknown combo targets in LCD modalities (#12613) (#13042)

2026-09-11 19:28:21 -03:00

ngrokTunnel.ts

Release v3.7.5 (#1753)

2026-04-30 01:27:03 -03:00

obsidianSync.ts

fix(auth): close the JWT_SECRET bootstrap chain — real-peer loopback, obsidian always-protected, DATA_DIR vault refusal (#13791)

2026-09-15 16:58:24 -03:00

omnirouteStatus.ts

feat(api): add provider quota telemetry, adaptive routing, and status inventory (#10148)

2026-08-18 11:31:53 -03:00

piiSanitizer.ts

fix(pii): preserve custom event names and apply stream PII sanitization fixes (#3056)

2026-06-01 23:13:19 -03:00

pricingSync.ts

fix(pricing): 3 dead entries in LITELLM_PROVIDER_MAP silently drop synced pricing (#10636)

2026-08-20 13:11:03 -03:00

providerNodePrefixes.ts

fix(providers): retire common ChatGPT Web provider (#11754)

2026-08-28 06:52:46 -03:00

proxyEchoTarget.ts

fix(proxy): stop reporting IPv4-only proxies as dead (#10868)

2026-08-20 15:19:32 -03:00

proxyEgress.ts

fix(proxies): preserve inactive and dead statuses during pool validation (#13612)

2026-09-15 10:11:44 -03:00

proxyHealth.ts

feat(proxies): stop re-serving a proxy that just failed (#13578)

2026-09-15 18:09:02 -03:00

proxyLogger.ts

feat(proxy-logs): keep the HTTP status the provider actually returned (#13580)

2026-09-15 18:26:15 -03:00

proxyPoolEgressObservation.ts

feat(proxies): show how many egress IPs actually served a proxy pool (#13581)

2026-09-15 19:48:52 -03:00

semanticCache.ts

fix(cache): include tool_choice/tools/response_format in semantic cache signature (#12734) (#13267)

2026-09-11 22:29:29 -03:00

serverLifecycle.ts

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

sessionObservability.ts

feat(dashboard): surface exclusive managed leases in Sessions view (#11389)

2026-08-25 01:38:59 -03:00

source.ts

fix(bun): make server child and outbound fetch Bun-safe (#9761)

2026-08-11 09:16:23 -03:00

sseTextTransform.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

streamingPiiTransform.ts

fix(types): preserve streaming PII choice keys (#9566)

2026-08-07 20:54:11 -03:00

tailscaleTunnel.ts

fix(tailscale): validate ports and quote MSI paths (#11534)

2026-08-25 13:12:38 -03:00

tokenHealthCheck.ts

fix(auth): do not park healthy quota accounts as expired (#12452)

2026-09-03 23:39:22 -03:00

tokenHealthCheckCopilot.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

tokenHealthCheckCursor.ts

fix(barrel): delete the @/lib/localDb barrel — every consumer migrated (#11795 Phase 5) (#12055)

2026-08-30 02:36:26 -03:00

tokenHealthCheckKimi.ts

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

tokenHealthCheckWebCookie.ts

feat(providers): verify-only health sweep for web-cookie connections (#11488) (#11495)

2026-08-26 08:11:30 -03:00

toolPolicy.ts

feat(phase2+3): DI container, plugins, PII sanitizer, tool policy, audit log, cache invalidation, ARIA, CSS vars

2026-02-18 14:43:57 -03:00

translatorEvents.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

usageAnalytics.ts

fix(barrel): migrate src/lib/ off the localDb barrel to direct db imports (#59) (#12052)

2026-08-30 02:27:25 -03:00

usageDb.ts

Release v3.8.18 (#3482)

2026-06-09 15:56:24 -03:00

warmupScheduler.ts

feat(routing): add exclusive managed session connection leases (#10362)

2026-08-18 11:25:46 -03:00

webhookDispatcher.ts

fix(api): close DNS-rebinding SSRF gap in webhook outbound-URL guard (#12569) (#13243)

2026-09-11 22:04:21 -03:00

wellKnown.ts

fix: make release/v3.8.50 CI gates green (run 32786966560 root causes) (#11450)

2026-08-25 18:55:18 -03:00