Diego Rodrigues de Sa e Souza 2904cf849d fix(security): clear new CodeQL code-scanning alerts (round 4) (#11293) ...

- open-sse/executors/github.ts: replace the Math.random() fallback in
  the Copilot correlation-id generators (x-request-id,
  x-interaction-id, x-client-session-id, x-agent-task-id) with a
  CSPRNG-backed randomIdFallback() (node:crypto randomBytes) — closes
  js/insecure-randomness with no behavior change (crypto.randomUUID
  stays the primary path).
- tests/unit/cli/_helpers/shellArgs.mjs: collapse the two sequential
  global .replace() unescape passes into a single left-to-right regex
  replace with alternation — closes js/double-escaping. The prior
  two-pass form let the first pass's output feed the second, which is
  exactly the double-(un)escaping bug pattern the query flags (e.g. an
  escaped-backslash-then-quote sequence could be misread depending on
  pass order).

Co-authored-by: Markus Hartung <mail@hartmark.se>

2026-08-23 19:06:53 -03:00

..

antigravity

refactor(antigravity): align official clients and callable catalog (#8013)

2026-07-22 20:41:19 -03:00

base

fix(providers): clamp reasoning_effort to the declared vocabulary of models that expose one (#11274)

2026-08-23 18:10:21 -03:00

chatgpt-web

fix(chatgpt-web): refresh current model catalog (#10637)

2026-08-20 11:31:48 -03:00

chatgpt-web-codex

fix(quality): green release/v3.8.50 base-reds round 2 (#9985) (#10131)

2026-08-12 16:09:34 -03:00

claude-web

feat(providers): integrate audited free-tier gateways (#9210)

2026-08-12 16:19:25 -03:00

codex

fix(security): harden codex app-server transport (#11205 post-merge review) (#11281)

2026-08-23 16:49:19 -03:00

cursor

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

deepseek-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

default

fix(types): validate default executor pool config (#9849)

2026-08-09 09:51:37 -03:00

devin-agentic

fix(ci): clear the 08-08 base-red layers — dead-code, prod crash in chat.ts, Responses payload regression, born-red stdio test, gate drifts (#9757)

2026-08-08 09:08:45 -03:00

duckduckgo-web

fix(executors): repair DuckDuckGo AI Chat challenge solver (418 ERR_CHALLENGE) (#9866)

2026-08-09 09:53:39 -03:00

gemini-web

fix(sse): enforce capabilities for gemini-web reasoning and tools (#9356) (#9397)

2026-08-08 12:47:48 -03:00

grok-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

huggingchat

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

kiro

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

lmarena

fix(lmarena): encode SSE stream chunks as Uint8Array to prevent TextDecoder TypeError (#9306)

2026-08-08 11:27:02 -03:00

muse-spark-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

perplexity-web

fix(perplexity-web): make the built-in-search hint opt-in (#10904)

2026-08-20 19:34:18 -03:00

promptql

feat(sse): add PromptQL playground provider (unofficial) (#7911)

2026-07-21 13:16:58 -03:00

zai-web

[v3.8.50] Fix Z.ai web browser transport and model capabilities (#8451)

2026-08-12 08:41:03 -03:00

accountRotation.ts

fix(executors): rotate on upstream 400 empty-body rejections (opencode) (#11158)

2026-08-22 21:51:22 -03:00

adapta-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

adobe-firefly.ts

feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up #8006) (#8510)

2026-07-26 03:53:10 -03:00

antigravity.ts

fix(antigravity): strip trailing model turn for native Gemini requests too (#10436)

2026-08-18 10:50:05 -03:00

antigravityOutputCap.ts

feat(providers): refresh curated model catalogs and retire Imagen 4 (#10537)

2026-08-18 12:27:46 -03:00

antigravityUpstreamError.ts

fix(antigravity): classify geo-blocked egress, exclude account, real connection probe (#10420)

2026-08-16 00:16:27 -03:00

auggie.ts

refactor(sse): narrow three result unions via type predicates (#8499)

2026-07-26 03:51:45 -03:00

awsPollyTts.ts

feat: add EdgeTTS audio-tts provider (#6668) (#7605)

2026-07-17 11:32:25 -03:00

azure-ai.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

azure-openai.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

azureParamRules.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

base.ts

fix(sse): learn accepted reasoning_effort sets and clamp downgrade-only (#11232)

2026-08-23 14:21:27 -03:00

bedrock.ts

[v3.8.50] fix: passthrough non-standard cache token fields for DeepSeek / MiniMax / Bedrock across streaming, non-streaming, and Dashboard paths (#8591)

2026-08-11 07:15:08 -03:00

blackbox-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

chatgpt-web-codex.ts

Add native ChatGPT Web provider for Codex clients (#8949)

2026-08-11 09:53:39 -03:00

chatgpt-web.ts

fix(chatgpt-web): refresh current model catalog (#10637)

2026-08-20 11:31:48 -03:00

chatgptWebErrors.ts

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

chatgptWebTools.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

cheaperinference.ts

feat(sse): Cheaper Inference provider — chat + native Responses + images, sponsor rail 2nd (#9043)

2026-07-31 07:53:41 -03:00

chipotle.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

claude-web.ts

fix(providers): treat claude-web 429 as unhealthy and forward Retry-After (#9406)

2026-08-04 23:28:41 -03:00

claudeIdentity.ts

feat(radar): flag-gated signed free-model catalog overlay (#9515)

2026-08-06 05:58:58 -03:00

cliproxyapi.ts

maint: final follow-up cherry-pick #9783 (#9904)

2026-08-09 09:52:23 -03:00

cloudflare-ai.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

cloudflare-playground.ts

feat(gemini-web): expose image generation through /v1/images/generations (closes #10466) (#10494)

2026-08-18 11:43:16 -03:00

codebuddy-cn.ts

fix(codebuddy-cn): replace agent system prompts to bypass Tencent content filter (#9723)

2026-08-11 09:06:47 -03:00

codex-app-server.ts

fix(security): harden codex app-server transport (#11205 post-merge review) (#11281)

2026-08-23 16:49:19 -03:00

codex.ts

feat(codex): self-contained codex app-server transport (executor + provider + sign-in) (#11205)

2026-08-23 10:20:06 -03:00

commandCode.ts

fix(command-code): use the documented /provider/v1 chat endpoint (#10265) (#11072)

2026-08-21 22:16:45 -03:00

conol-web.ts

fix(ci): clear base-reds on release/v3.8.50 (round 3) (#10213)

2026-08-13 00:02:25 -03:00

context7-fetch.ts

feat(search): add context7 as a library-docs search and fetch provider (#11140)

2026-08-23 02:24:01 -03:00

copilot-m365-connection.ts

feat(providers): tool calling for copilot-m365-web via router planning (#10948)

2026-08-21 08:50:24 -03:00

copilot-m365-frames.ts

fix(m365): BizChat invocation shape drift + HAR-import UX + Antigravity alias note (#11069)

2026-08-21 22:32:19 -03:00

copilot-m365-web.ts

feat(providers): tool calling for copilot-m365-web via router planning (#10948)

2026-08-21 08:50:24 -03:00

copilot-web.ts

fix(copilot-web): restore browser authentication (#9984)

2026-08-11 08:40:48 -03:00

cursor.ts

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

dario.ts

[v3.8.50] feat(services): add Dario as a 5th embedded service (Claude Code toggle/failover) (#8523)

2026-08-06 06:05:46 -03:00

deepseek-web-done-terminator.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

deepseek-web-with-auto-refresh.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

deepseek-web.ts

fix: auto-replay bounded trajectory in DeepSeek Web prompt builder for non-tool-calling agentic clients (#10527) (#10741)

2026-08-19 11:08:07 -03:00

default.ts

feat(providers): add tabitoken gateway and serve hcnsec's four protocols (#10668)

2026-08-20 20:24:42 -03:00

devin-cli-agentic.ts

feat(executors): add isolated Claude Code bridge over Devin ACP (#8914)

2026-08-06 11:08:37 -03:00

devin-cli.ts

fix(windows): request shell when spawning bare qoder binary name on Windows (fixes #8590) (#8633)

2026-07-27 19:08:12 -03:00

devin-desktop.ts

[v3.8.50] feat(devin-desktop): replace public Windsurf provider (#8228)

2026-08-12 08:40:18 -03:00

doubao-web.ts

Release v3.8.46

2026-07-07 13:14:06 -03:00

duckduckgo-web.ts

fix(executors): repair DuckDuckGo AI Chat challenge solver (418 ERR_CHALLENGE) (#9866)

2026-08-09 09:53:39 -03:00

edgeTts.ts

fix(types): preserve array-buffer response bodies (#9092)

2026-08-05 22:29:49 -03:00

felo-web.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

firecrawl-fetch.ts

feat(providers): add comprehensive support for self-hosted Firecrawl via FIRECRAWL_BASE_URL and custom base URLs (#9052)

2026-08-06 11:07:42 -03:00

forceResponsesUpstream.ts

fix(executor): respect apiType="chat" in forceResponsesUpstream (#5483 regression) (#10946)

2026-08-21 08:25:03 -03:00

freebuff.ts

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

gemini-business.ts

fix(types): normalize Gemini Business credentials (#9851)

2026-08-09 09:51:49 -03:00

gemini-web.ts

fix(security): zero out open CodeQL code-scanning alerts (#10739)

2026-08-19 12:10:15 -03:00

ghe-copilot.ts

Integration: security tier + self-hosted operator blockers (rebased onto v3.8.51) (#10952)

2026-08-23 16:51:25 -03:00

github.ts

fix(security): clear new CodeQL code-scanning alerts (round 4) (#11293)

2026-08-23 19:06:53 -03:00

gitlab.ts

fix(probe): isolate probe-origin failures from all deactivation sites (#10694)

2026-08-20 10:30:29 -03:00

gitlabResponses.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

glm.ts

fix(release): repair v3.8.50 base-red tail after latest root lift (#10964)

2026-08-22 23:09:16 -03:00

grok-cli.ts

fix(catalog): scope combo reasoning efforts by connection (#10723)

2026-08-20 09:31:12 -03:00

grok-web.ts

feat: classify grok-web Cloudflare anti-bot blocks + gated browser-backed cf_clearance path (#8019) (#8241)

2026-07-23 01:33:32 -03:00

gtts.ts

refactor(sse): declare the ArrayBuffer backing on media byte producers (#8665)

2026-07-27 17:24:23 -03:00

hailuo-web.ts

fix(tests): update translate-path golden snapshot and docs for hailuo-web (#11000) (#11161)

2026-08-22 20:10:24 -03:00

huggingchat.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

hyperagent.ts

fix(hyperagent): sticky thread for agentic tool loops (Claude Code) (#8470)

2026-07-27 21:12:45 -03:00

index.ts

feat(codex): self-contained codex app-server transport (executor + provider + sign-in) (#11205)

2026-08-23 10:20:06 -03:00

inner-ai.ts

fix(types): align web executor event contracts (#9138)

2026-08-05 22:31:30 -03:00

jina-reader-fetch.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

kie.ts

fix: address kie provider review feedback

2026-05-07 00:01:54 +07:00

kimi-web.ts

fix(kimi): point kimi-web to international www.kimi.ai (#11045)

2026-08-22 18:55:23 -03:00

kimi.ts

fix(kimi): normalize MFJS tool schemas (#10079)

2026-08-13 07:52:41 -03:00

kimiToolNames.ts

fix(executors): backfill missing tool message names for Kimi K3 and strict BYOK providers (#9005)

2026-08-06 00:09:11 -03:00

kiro.ts

fix(kiro): complete cache-only usage totals (#9753)

2026-08-08 07:15:34 -03:00

kiroThinking.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

kiroToolCallValidation.ts

fix(kiro): validate completed nested tool_call payloads (#9314)

2026-08-05 22:41:25 -03:00

lmarena.ts

refactor(sse): stop three executors shadowing BaseExecutor.buildHeaders (#8498)

2026-07-26 03:51:42 -03:00

microsoft-designer-web.ts

feat: add Microsoft Designer as image provider (#6672) (#7609)

2026-07-17 12:09:12 -03:00

moonshot.ts

fix(kimi): normalize MFJS tool schemas (#10079)

2026-08-13 07:52:41 -03:00

muse-spark-web.ts

fix(executors): report WS readyState in Meta AI timeout error (#10727) (#10916)

2026-08-21 08:02:19 -03:00

ninerouter.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

nlpcloud.ts

fix(security): close remaining v3.8.50 advisories (batch 2 — 11 findings) (#11040)

2026-08-21 20:28:16 -03:00

notion-web.ts

Stabilize Notion web sessions and JSON output (#8751)

2026-07-27 17:25:43 -03:00

opencode.ts

fix(sse): floor muse-spark output budget to prevent empty-content 502s (#11214)

2026-08-23 09:47:10 -03:00

perplexity-web.ts

fix(perplexity-web): update catalog to use 'copilot' mode and fix model IDs (#8989)

2026-08-04 21:36:13 -03:00

poe-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

pollinations.ts

fix(sse): stop keyless pollinations 401s from poisoning the noauth pool (#9827) (#11194)

2026-08-23 07:01:04 -03:00

promptql.ts

feat(sse): add PromptQL playground provider (unofficial) (#7911)

2026-07-21 13:16:58 -03:00

qoder.ts

fix(qoder): surface qodercli stderr in error message instead of generic 502 (#9319) (#9412)

2026-08-07 20:52:54 -03:00

qwen-web.ts

feat(providers): refresh Qwen3.8 model catalogs (#10226)

2026-08-18 10:57:20 -03:00

raycast.ts

fix(ci): clear the 08-08 base-red layers — dead-code, prod crash in chat.ts, Responses payload regression, born-red stdio test, gate drifts (#9757)

2026-08-08 09:08:45 -03:00

registry.ts

refactor(sse): ExecutorRegistry — route executor lookup through a runtime registry (R0.3) (#10633)

2026-08-18 12:08:38 -03:00

t3-chat-web.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

tavily-fetch.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

tencent-aistudio-web.ts

feat(providers): add tencent-aistudio-web cookie provider (tasw) (#10174)

2026-08-15 05:15:17 -03:00

theoldllm.ts

fix(types): preserve The Old LLM proxy contracts (#9850)

2026-08-09 09:51:44 -03:00

tinycms.ts

fix(security): correct XML double-unescape and non-CSPRNG nonce from CodeQL sweep (#10154)

2026-08-12 16:03:58 -03:00

tinycmsSigner.ts

fix(build): repair broken production build, red lint gate and SWR crash (#10198)

2026-08-12 15:58:40 -03:00

tinyfish-fetch.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

trae.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

v0-vercel-web.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

venice-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

veoaifree-web.ts

fix(types): preserve Veo polling delay result (#9104)

2026-08-05 22:30:08 -03:00

vertex.ts

fix(vertex): route Claude models to native rawPredict and respect targetFormat overrides (#8994)

2026-08-07 11:23:19 -03:00

vertexMedia.ts

refactor(sse): declare the ArrayBuffer backing on media byte producers (#8665)

2026-07-27 17:24:23 -03:00

xai.ts

fix(xai): cap chat history at xAI 800-message limit (#10601)

2026-08-18 10:52:52 -03:00

yuanbao-web.ts

fix(yuanbao-web): accept content field in SSE text events (upstream format change) (#8739)

2026-08-07 11:23:07 -03:00

zai-web.ts

fix(ci): clear base-reds on release/v3.8.50 (round 3) (#10213)

2026-08-13 00:02:25 -03:00

zcode.ts

fix(catalog): declare GLM reasoning effort tiers (#10963)

2026-08-22 22:54:49 -03:00

zcodeProtocol.ts

feat(providers): add local ZCode ACP backend (#10184)

2026-08-16 00:13:36 -03:00

zed-hosted.ts

fix(zed-hosted): send the provider wire values cloud.zed.dev accepts (#10051)

2026-08-13 07:52:27 -03:00

zenmux-free.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00