Markus Hartung c1ded0fbfa fix(security): clear new CodeQL code-scanning alerts (round 3) ...

- open-sse/executors/freebuff.ts: swap Math.random() for
  crypto.randomInt() when generating the client session id sent
  upstream — closes js/insecure-randomness with no behavior change
  (still a 13-char lowercase-alnum id).
- open-sse/executors/cursor/agentEndpoint.ts:104 — Cursor Agent RPC
  URL cache key fingerprint (already HMAC-SHA256): dismissed
  js/insufficient-password-hash, same rationale as PR #10739/#10888.
- open-sse/executors/cursor.ts:1229 — already routes through
  sanitizeErrorMessage(): dismissed js/stack-trace-exposure, known
  CodeQL limitation per HR#14 precedent.
- tests/unit/combo-silent-stop-gaps.test.ts:240 — the catastrophic
  (a+)+$ pattern is the intentional G7 test fixture proving the ReDoS
  guard rejects unsafe regexes: dismissed js/redos as "used in tests".

2026-08-21 07:46:20 -03:00

..

antigravity

refactor(antigravity): align official clients and callable catalog (#8013)

2026-07-22 20:41:19 -03:00

base

fix(combo): clear stale sticky pins when stickiness is disabled (#10907)

2026-08-21 02:57:48 -03:00

chatgpt-web

fix(chatgpt-web): refresh current model catalog (#10637)

2026-08-20 11:31:48 -03:00

chatgpt-web-codex

fix(quality): green release/v3.8.50 base-reds round 2 (#9985) (#10131)

2026-08-12 16:09:34 -03:00

claude-web

feat(providers): integrate audited free-tier gateways (#9210)

2026-08-12 16:19:25 -03:00

codex

fix(executors): strip redundant oneOf matching sibling enum (#9828)

2026-08-11 08:35:16 -03:00

cursor

fix(cursor): discover account Agent endpoint (#10804)

2026-08-21 00:07:45 -03:00

deepseek-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

default

fix(types): validate default executor pool config (#9849)

2026-08-09 09:51:37 -03:00

devin-agentic

fix(ci): clear the 08-08 base-red layers — dead-code, prod crash in chat.ts, Responses payload regression, born-red stdio test, gate drifts (#9757)

2026-08-08 09:08:45 -03:00

duckduckgo-web

fix(executors): repair DuckDuckGo AI Chat challenge solver (418 ERR_CHALLENGE) (#9866)

2026-08-09 09:53:39 -03:00

gemini-web

fix(sse): enforce capabilities for gemini-web reasoning and tools (#9356) (#9397)

2026-08-08 12:47:48 -03:00

grok-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

huggingchat

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

kiro

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

lmarena

fix(lmarena): encode SSE stream chunks as Uint8Array to prevent TextDecoder TypeError (#9306)

2026-08-08 11:27:02 -03:00

muse-spark-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

perplexity-web

fix(perplexity-web): make the built-in-search hint opt-in (#10904)

2026-08-20 19:34:18 -03:00

promptql

feat(sse): add PromptQL playground provider (unofficial) (#7911)

2026-07-21 13:16:58 -03:00

zai-web

[v3.8.50] Fix Z.ai web browser transport and model capabilities (#8451)

2026-08-12 08:41:03 -03:00

accountRotation.ts

fix(executors): rotate to the next account on network throws when the account has a dedicated proxy (#10402)

2026-08-16 00:16:04 -03:00

adapta-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

adobe-firefly.ts

feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up #8006) (#8510)

2026-07-26 03:53:10 -03:00

antigravity.ts

fix(antigravity): strip trailing model turn for native Gemini requests too (#10436)

2026-08-18 10:50:05 -03:00

antigravityOutputCap.ts

feat(providers): refresh curated model catalogs and retire Imagen 4 (#10537)

2026-08-18 12:27:46 -03:00

antigravityUpstreamError.ts

fix(antigravity): classify geo-blocked egress, exclude account, real connection probe (#10420)

2026-08-16 00:16:27 -03:00

auggie.ts

refactor(sse): narrow three result unions via type predicates (#8499)

2026-07-26 03:51:45 -03:00

awsPollyTts.ts

feat: add EdgeTTS audio-tts provider (#6668) (#7605)

2026-07-17 11:32:25 -03:00

azure-ai.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

azure-openai.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

azureParamRules.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

base.ts

fix(probe): isolate probe-origin failures from all deactivation sites (#10694)

2026-08-20 10:30:29 -03:00

bedrock.ts

[v3.8.50] fix: passthrough non-standard cache token fields for DeepSeek / MiniMax / Bedrock across streaming, non-streaming, and Dashboard paths (#8591)

2026-08-11 07:15:08 -03:00

blackbox-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

chatgpt-web-codex.ts

Add native ChatGPT Web provider for Codex clients (#8949)

2026-08-11 09:53:39 -03:00

chatgpt-web.ts

fix(chatgpt-web): refresh current model catalog (#10637)

2026-08-20 11:31:48 -03:00

chatgptWebErrors.ts

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

chatgptWebTools.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

cheaperinference.ts

feat(sse): Cheaper Inference provider — chat + native Responses + images, sponsor rail 2nd (#9043)

2026-07-31 07:53:41 -03:00

chipotle.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

claude-web.ts

fix(providers): treat claude-web 429 as unhealthy and forward Retry-After (#9406)

2026-08-04 23:28:41 -03:00

claudeIdentity.ts

feat(radar): flag-gated signed free-model catalog overlay (#9515)

2026-08-06 05:58:58 -03:00

cliproxyapi.ts

maint: final follow-up cherry-pick #9783 (#9904)

2026-08-09 09:52:23 -03:00

cloudflare-ai.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

cloudflare-playground.ts

feat(gemini-web): expose image generation through /v1/images/generations (closes #10466) (#10494)

2026-08-18 11:43:16 -03:00

codebuddy-cn.ts

fix(codebuddy-cn): replace agent system prompts to bypass Tencent content filter (#9723)

2026-08-11 09:06:47 -03:00

codex.ts

fix(reasoning): preserve compatible response state (#10574)

2026-08-20 22:20:54 -03:00

commandCode.ts

fix(combo): clear stale sticky pins when stickiness is disabled (#10907)

2026-08-21 02:57:48 -03:00

conol-web.ts

fix(ci): clear base-reds on release/v3.8.50 (round 3) (#10213)

2026-08-13 00:02:25 -03:00

copilot-m365-connection.ts

fix(providers): rename Freepik slug to Magnific and validate Magnific API keys (#10594)

2026-08-20 22:15:48 -03:00

copilot-m365-frames.ts

fix(providers): copilot-m365-web invocation dropped by substrate + token refresh (#10732)

2026-08-20 06:29:30 -03:00

copilot-m365-web.ts

fix(providers): rename Freepik slug to Magnific and validate Magnific API keys (#10594)

2026-08-20 22:15:48 -03:00

copilot-web.ts

fix(copilot-web): restore browser authentication (#9984)

2026-08-11 08:40:48 -03:00

cursor.ts

fix(cursor): discover account Agent endpoint (#10804)

2026-08-21 00:07:45 -03:00

dario.ts

[v3.8.50] feat(services): add Dario as a 5th embedded service (Claude Code toggle/failover) (#8523)

2026-08-06 06:05:46 -03:00

deepseek-web-done-terminator.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

deepseek-web-with-auto-refresh.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

deepseek-web.ts

fix: auto-replay bounded trajectory in DeepSeek Web prompt builder for non-tool-calling agentic clients (#10527) (#10741)

2026-08-19 11:08:07 -03:00

default.ts

feat(providers): add tabitoken gateway and serve hcnsec's four protocols (#10668)

2026-08-20 20:24:42 -03:00

devin-cli-agentic.ts

feat(executors): add isolated Claude Code bridge over Devin ACP (#8914)

2026-08-06 11:08:37 -03:00

devin-cli.ts

fix(windows): request shell when spawning bare qoder binary name on Windows (fixes #8590) (#8633)

2026-07-27 19:08:12 -03:00

devin-desktop.ts

[v3.8.50] feat(devin-desktop): replace public Windsurf provider (#8228)

2026-08-12 08:40:18 -03:00

doubao-web.ts

Release v3.8.46

2026-07-07 13:14:06 -03:00

duckduckgo-web.ts

fix(executors): repair DuckDuckGo AI Chat challenge solver (418 ERR_CHALLENGE) (#9866)

2026-08-09 09:53:39 -03:00

edgeTts.ts

fix(types): preserve array-buffer response bodies (#9092)

2026-08-05 22:29:49 -03:00

felo-web.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

firecrawl-fetch.ts

feat(providers): add comprehensive support for self-hosted Firecrawl via FIRECRAWL_BASE_URL and custom base URLs (#9052)

2026-08-06 11:07:42 -03:00

forceResponsesUpstream.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

freebuff.ts

fix(security): clear new CodeQL code-scanning alerts (round 3)

2026-08-21 07:46:20 -03:00

gemini-business.ts

fix(types): normalize Gemini Business credentials (#9851)

2026-08-09 09:51:49 -03:00

gemini-web.ts

fix(security): zero out open CodeQL code-scanning alerts (#10739)

2026-08-19 12:10:15 -03:00

ghe-copilot.ts

fix(ghe-copilot): route OpenAI-native models via Responses API (#8835)

2026-07-28 10:24:45 -03:00

github.ts

fix(types): preserve GHE Copilot executor configuration (#9988)

2026-08-11 08:46:32 -03:00

gitlab.ts

fix(probe): isolate probe-origin failures from all deactivation sites (#10694)

2026-08-20 10:30:29 -03:00

gitlabResponses.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

glm.ts

fix(model): return model_not_found for unrecognized prefix models when provider is inactive (#10856) (#10894)

2026-08-21 03:49:01 -03:00

grok-cli.ts

fix(catalog): scope combo reasoning efforts by connection (#10723)

2026-08-20 09:31:12 -03:00

grok-web.ts

feat: classify grok-web Cloudflare anti-bot blocks + gated browser-backed cf_clearance path (#8019) (#8241)

2026-07-23 01:33:32 -03:00

gtts.ts

refactor(sse): declare the ArrayBuffer backing on media byte producers (#8665)

2026-07-27 17:24:23 -03:00

hailuo-web.ts

refactor(sse): stop three executors shadowing BaseExecutor.buildHeaders (#8498)

2026-07-26 03:51:42 -03:00

huggingchat.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

hyperagent.ts

fix(hyperagent): sticky thread for agentic tool loops (Claude Code) (#8470)

2026-07-27 21:12:45 -03:00

index.ts

feat(providers): implement native support for Freebuff AI gateway (#6793) (#10531)

2026-08-20 22:53:24 -03:00

inner-ai.ts

fix(types): align web executor event contracts (#9138)

2026-08-05 22:31:30 -03:00

jina-reader-fetch.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

kie.ts

fix: address kie provider review feedback

2026-05-07 00:01:54 +07:00

kimi-web.ts

feat(sse): add kimi web token lifecycle manager, rolling auto-refresh and 401 recovery (#10944)

2026-08-21 04:25:56 -03:00

kimi.ts

fix(kimi): normalize MFJS tool schemas (#10079)

2026-08-13 07:52:41 -03:00

kimiToolNames.ts

fix(executors): backfill missing tool message names for Kimi K3 and strict BYOK providers (#9005)

2026-08-06 00:09:11 -03:00

kiro.ts

fix(kiro): complete cache-only usage totals (#9753)

2026-08-08 07:15:34 -03:00

kiroThinking.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

kiroToolCallValidation.ts

fix(kiro): validate completed nested tool_call payloads (#9314)

2026-08-05 22:41:25 -03:00

lmarena.ts

refactor(sse): stop three executors shadowing BaseExecutor.buildHeaders (#8498)

2026-07-26 03:51:42 -03:00

microsoft-designer-web.ts

feat: add Microsoft Designer as image provider (#6672) (#7609)

2026-07-17 12:09:12 -03:00

moonshot.ts

fix(kimi): normalize MFJS tool schemas (#10079)

2026-08-13 07:52:41 -03:00

muse-spark-web.ts

fix(muse-spark-web): document the ecto1: WS auth token requirement in credential hint, spec, and error message (#9502)

2026-08-05 16:49:04 -03:00

ninerouter.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

nlpcloud.ts

feat(providers): add GitLab Duo, NLP Cloud, and enterprise gateways

2026-04-24 07:00:21 -03:00

notion-web.ts

Stabilize Notion web sessions and JSON output (#8751)

2026-07-27 17:25:43 -03:00

opencode.ts

feat(opencode-go): expose Muse Spark reasoning effort aliases (#10883)

2026-08-21 02:12:53 -03:00

perplexity-web.ts

fix(perplexity-web): update catalog to use 'copilot' mode and fix model IDs (#8989)

2026-08-04 21:36:13 -03:00

poe-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

pollinations.ts

refactor(sse): declare the executor execute() result contract (#8489)

2026-07-25 02:53:19 -03:00

promptql.ts

feat(sse): add PromptQL playground provider (unofficial) (#7911)

2026-07-21 13:16:58 -03:00

qoder.ts

fix(qoder): surface qodercli stderr in error message instead of generic 502 (#9319) (#9412)

2026-08-07 20:52:54 -03:00

qwen-web.ts

feat(providers): refresh Qwen3.8 model catalogs (#10226)

2026-08-18 10:57:20 -03:00

raycast.ts

fix(ci): clear the 08-08 base-red layers — dead-code, prod crash in chat.ts, Responses payload regression, born-red stdio test, gate drifts (#9757)

2026-08-08 09:08:45 -03:00

registry.ts

refactor(sse): ExecutorRegistry — route executor lookup through a runtime registry (R0.3) (#10633)

2026-08-18 12:08:38 -03:00

t3-chat-web.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

tavily-fetch.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

tencent-aistudio-web.ts

feat(providers): add tencent-aistudio-web cookie provider (tasw) (#10174)

2026-08-15 05:15:17 -03:00

theoldllm.ts

fix(types): preserve The Old LLM proxy contracts (#9850)

2026-08-09 09:51:44 -03:00

tinycms.ts

fix(security): correct XML double-unescape and non-CSPRNG nonce from CodeQL sweep (#10154)

2026-08-12 16:03:58 -03:00

tinycmsSigner.ts

fix(build): repair broken production build, red lint gate and SWR crash (#10198)

2026-08-12 15:58:40 -03:00

tinyfish-fetch.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

trae.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

v0-vercel-web.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

venice-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

veoaifree-web.ts

fix(types): preserve Veo polling delay result (#9104)

2026-08-05 22:30:08 -03:00

vertex.ts

fix(vertex): route Claude models to native rawPredict and respect targetFormat overrides (#8994)

2026-08-07 11:23:19 -03:00

vertexMedia.ts

refactor(sse): declare the ArrayBuffer backing on media byte producers (#8665)

2026-07-27 17:24:23 -03:00

xai.ts

fix(xai): cap chat history at xAI 800-message limit (#10601)

2026-08-18 10:52:52 -03:00

yuanbao-web.ts

fix(yuanbao-web): accept content field in SSE text events (upstream format change) (#8739)

2026-08-07 11:23:07 -03:00

zai-web.ts

fix(ci): clear base-reds on release/v3.8.50 (round 3) (#10213)

2026-08-13 00:02:25 -03:00

zcode.ts

feat(providers): add local ZCode ACP backend (#10184)

2026-08-16 00:13:36 -03:00

zcodeProtocol.ts

feat(providers): add local ZCode ACP backend (#10184)

2026-08-16 00:13:36 -03:00

zed-hosted.ts

fix(zed-hosted): send the provider wire values cloud.zed.dev accepts (#10051)

2026-08-13 07:52:27 -03:00

zenmux-free.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00