diegosouzapw c93d4542bb merge release/v3.8.51: keep this branch's module split, add the one pattern #12620 had that it lacked ...

#12620 landed first and fixed GHSA-qv45-56jc-4wmj by adding
RAW_CREDENTIAL_PATTERNS to error.ts and importing them from
upstreamErrorPassthrough.ts. This branch fixes the same class differently, by
splitting error.ts into errorSanitization.ts + errorPathRedaction.ts.

Kept this branch's split. Its STRONG_CREDENTIAL_TOKEN already covered sk-/sk_
(with a lookbehind and an embedded-prefix variant that catches sk-proj-…),
plus Slack xox-, AWS AKIA/ASIA, github_pat_/ghp_/glpat- and three-segment JWTs
— a strictly wider vocabulary than the three patterns #12620 introduced. The
one shape #12620 carried and this set did not is Google's AIza…, now added
here with the same bounded quantifier its siblings use.

Verified against #12620's own suites rather than by inspection: 48/48 across
error-sanitizer-sk-key-qv45, bifrost-relay-response-leak-9m72,
search-baseurl-client-override-3f8g and search-baseurl-ssrf-guard — including
that suite's anti-drift assertion (for every body the passthrough layer refuses
as leaky, the fallback sanitizer must not return it unchanged). This branch's
own 21 test files: 259/259. typecheck:core clean.

2026-09-03 21:30:07 -03:00

..

antigravity

perf(stream): compile hot-path regexes once, bound token caches, fix quadratic buffering (#12179)

2026-09-03 08:29:14 -03:00

base

feat(sse): support native max reasoning effort and per-model clamping (#11875)

2026-09-02 00:12:13 -03:00

chatgpt-web-codex

feat(providers): refresh vendored ChatGPT Web connector to v4.0.7 (#12181)

2026-09-01 00:50:15 -03:00

claude-web

fix(security): harden public error boundaries

2026-09-02 07:14:27 -03:00

codex

fix(codex): fail over image generation for imported free plans (#11948)

2026-08-30 05:10:39 -03:00

cursor

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

deepseek-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

default

fix(types): validate default executor pool config (#9849)

2026-08-09 09:51:37 -03:00

devin-agentic

fix(ci): clear the 08-08 base-red layers — dead-code, prod crash in chat.ts, Responses payload regression, born-red stdio test, gate drifts (#9757)

2026-08-08 09:08:45 -03:00

duckduckgo-web

fix(providers): route duckduckgo-web via duck.ai and self-heal stale model catalog (#11597)

2026-08-26 08:09:38 -03:00

gemini-web

fix(sse): enforce capabilities for gemini-web reasoning and tools (#9356) (#9397)

2026-08-08 12:47:48 -03:00

grok-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

huggingchat

fix(huggingchat): surface HTTP 200 JSONL failures (#12456)

2026-09-03 20:59:31 -03:00

kiro

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

lmarena

fix(providers): migrate web cookie TLS transport to wreq-js (#12429)

2026-09-02 10:41:00 -03:00

maxai

fix(security): unbiased maxai X-Random nonce + stricter URL/regex assertions (#12502)

2026-09-02 15:56:49 -03:00

muse-spark-web

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

perplexity-web

fix(sse): preserve Perplexity stream failures (#12465)

2026-09-03 21:00:14 -03:00

promptql

feat(sse): add PromptQL playground provider (unofficial) (#7911)

2026-07-21 13:16:58 -03:00

uc

fix(uc): route UC error strings through sanitizeErrorMessage; allowlist the retired codex id (#12437)

2026-09-02 05:12:11 -03:00

zai-web

fix(zai): treat HTTP 200 stream errors as failures (#12454)

2026-09-03 20:58:22 -03:00

accountRotation.ts

fix(executors): rotate on upstream 400 empty-body rejections (opencode) (#11158)

2026-08-22 21:51:22 -03:00

adapta-web.ts

fix(sse): surface Adapta non-stream SSE errors (#12459)

2026-09-03 20:57:21 -03:00

adobe-firefly.ts

feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up #8006) (#8510)

2026-07-26 03:53:10 -03:00

antigravity.ts

fix(quota): keep Antigravity Gemini usable when Claude weekly is empty (#12566)

2026-09-03 12:40:21 -03:00

antigravityOutputCap.ts

feat(providers): refresh curated model catalogs and retire Imagen 4 (#10537)

2026-08-18 12:27:46 -03:00

antigravityUpstreamError.ts

fix(antigravity): classify geo-blocked egress, exclude account, real connection probe (#10420)

2026-08-16 00:16:27 -03:00

anysearch-fetch.ts

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690)

2026-08-26 17:54:57 -03:00

auggie.ts

refactor(sse): narrow three result unions via type predicates (#8499)

2026-07-26 03:51:45 -03:00

awsPollyTts.ts

chore(audio): retire EdgeTTS pending provenance review (#11711)

2026-08-28 04:45:17 -03:00

azure-ai.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

azure-openai.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

azureParamRules.ts

cherry-pick(pr-9787): fix(sse): apply Azure param rules on azure-ai and clamp gpt-4o-mini output tokens (#9855)

2026-08-09 09:52:16 -03:00

base.ts

fix(sse): preserve store parameter semantics for openai-compatible responses (#11826) (#11916)

2026-08-28 16:25:19 -03:00

bedrock.ts

[v3.8.50] fix: passthrough non-standard cache token fields for DeepSeek / MiniMax / Bedrock across streaming, non-streaming, and Dashboard paths (#8591)

2026-08-11 07:15:08 -03:00

blackbox-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

chatgpt-web-codex.ts

feat(providers): refresh vendored ChatGPT Web connector to v4.0.7 (#12181)

2026-09-01 00:50:15 -03:00

chatgpt-web.ts

feat(providers): restore ChatGPT Web via clean-room browser transport (#12239)

2026-09-02 10:31:41 -03:00

chatgptWebTools.ts

fix(providers): retire common ChatGPT Web provider (#11754)

2026-08-28 06:52:46 -03:00

cheaperinference.ts

feat(sse): Cheaper Inference provider — chat + native Responses + images, sponsor rail 2nd (#9043)

2026-07-31 07:53:41 -03:00

chipotle.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

claude-web.ts

fix(security): harden public error boundaries

2026-09-02 07:14:27 -03:00

claudeIdentity.ts

feat(radar): flag-gated signed free-model catalog overlay (#9515)

2026-08-06 05:58:58 -03:00

cliproxyapi.ts

maint: final follow-up cherry-pick #9783 (#9904)

2026-08-09 09:52:23 -03:00

cloudflare-ai.ts

fix(providers): cloudflare-ai flattens message content unconditionally, but the #2539 constraint is model-scoped — this blocks image input to Cloudflare vision models (#12002)

2026-08-30 11:09:37 -03:00

cloudflare-playground.ts

feat(browser): adopt Obscura as primary headless browser engine with Chromium fallback (#12286)

2026-09-03 08:24:32 -03:00

clova-studio.ts

feat(providers): modernize CLOVA Studio chat and embeddings (#12277)

2026-09-03 07:50:22 -03:00

codebuddy-cn.ts

fix(codebuddy-cn): replace agent system prompts to bypass Tencent content filter (#9723)

2026-08-11 09:06:47 -03:00

codex-app-server.ts

fix(security): harden codex app-server transport (#11205 post-merge review) (#11281)

2026-08-23 16:49:19 -03:00

codex.ts

fix(codex): close response failure boundary (#12444)

2026-09-03 20:59:14 -03:00

commandCode.ts

fix(command-code): fallback to /alpha/generate for Go plan without Provider API access (#11455)

2026-08-25 21:15:24 -03:00

conol-web.ts

fix(ci): clear base-reds on release/v3.8.50 (round 3) (#10213)

2026-08-13 00:02:25 -03:00

context7-fetch.ts

feat(search): add context7 as a library-docs search and fetch provider (#11140)

2026-08-23 02:24:01 -03:00

copilot-m365-connection.ts

feat(providers): tool calling for copilot-m365-web via router planning (#10948)

2026-08-21 08:50:24 -03:00

copilot-m365-frames.ts

fix(m365): BizChat invocation shape drift + HAR-import UX + Antigravity alias note (#11069)

2026-08-21 22:32:19 -03:00

copilot-m365-web.ts

feat(providers): tool calling for copilot-m365-web via router planning (#10948)

2026-08-21 08:50:24 -03:00

copilot-web.ts

fix(copilot-web): restore browser authentication (#9984)

2026-08-11 08:40:48 -03:00

credential.ts

[URGENT] fix(dev): reduce instrumentation executor fan-out (phase 3) (#12078)

2026-08-31 14:13:46 -03:00

cursor.ts

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

dario.ts

[v3.8.50] feat(services): add Dario as a 5th embedded service (Claude Code toggle/failover) (#8523)

2026-08-06 06:05:46 -03:00

deepseek-web-done-terminator.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

deepseek-web-with-auto-refresh.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

deepseek-web.ts

fix(deepseek-web): replace unlicensed PoW artifacts (#11732)

2026-08-28 04:44:34 -03:00

default.ts

feat(zai): add GLM-5.3-Flash Coding Plan support (#11801)

2026-08-30 11:37:32 -03:00

defaultResolver.ts

[URGENT] fix(dev): reduce instrumentation executor fan-out (phase 3) (#12078)

2026-08-31 14:13:46 -03:00

devin-cli-agentic.ts

feat(executors): add isolated Claude Code bridge over Devin ACP (#8914)

2026-08-06 11:08:37 -03:00

devin-cli.ts

fix(windows): request shell when spawning bare qoder binary name on Windows (fixes #8590) (#8633)

2026-07-27 19:08:12 -03:00

devin-desktop.ts

[v3.8.50] feat(devin-desktop): replace public Windsurf provider (#8228)

2026-08-12 08:40:18 -03:00

doubao-web.ts

Release v3.8.46

2026-07-07 13:14:06 -03:00

duckduckgo-web.ts

fix(executors): DuckDuckGo ERR_BN_LIMIT without blind retry + proxy pool support (#12110)

2026-08-30 11:10:47 -03:00

firecrawl-fetch.ts

feat(providers): add comprehensive support for self-hosted Firecrawl via FIRECRAWL_BASE_URL and custom base URLs (#9052)

2026-08-06 11:07:42 -03:00

forceResponsesUpstream.ts

fix(executor): respect apiType="chat" in forceResponsesUpstream (#5483 regression) (#10946)

2026-08-21 08:25:03 -03:00

freebuff.ts

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

gemini-business.ts

fix(types): normalize Gemini Business credentials (#9851)

2026-08-09 09:51:49 -03:00

gemini-web.ts

fix(providers): retire common ChatGPT Web provider (#11754)

2026-08-28 06:52:46 -03:00

geminiTts.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

ghe-copilot.ts

Integration: security tier + self-hosted operator blockers (rebased onto v3.8.51) (#10952)

2026-08-23 16:51:25 -03:00

github.ts

fix(security): clear new CodeQL code-scanning alerts (round 4) (#11293)

2026-08-23 19:06:53 -03:00

gitlab.ts

fix(providers): retire Qwen Web pending provenance review (#11713)

2026-08-28 06:01:21 -03:00

gitlabResponses.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

glm.ts

perf(stream): compile hot-path regexes once, bound token caches, fix quadratic buffering (#12179)

2026-09-03 08:29:14 -03:00

grok-cli.ts

fix(catalog): scope combo reasoning efforts by connection (#10723)

2026-08-20 09:31:12 -03:00

grok-web.ts

fix(grok-web): stop streaming errors from reporting false success (#12458)

2026-09-03 20:59:56 -03:00

gtts.ts

chore(audio): retire EdgeTTS pending provenance review (#11711)

2026-08-28 04:45:17 -03:00

huggingchat.ts

fix(huggingchat): surface HTTP 200 JSONL failures (#12456)

2026-09-03 20:59:31 -03:00

hyperagent.ts

fix(hyperagent): sticky thread for agentic tool loops (Claude Code) (#8470)

2026-07-27 21:12:45 -03:00

index.ts

feat(providers): modernize CLOVA Studio chat and embeddings (#12277)

2026-09-03 07:50:22 -03:00

inner-ai.ts

fix(types): align web executor event contracts (#9138)

2026-08-05 22:31:30 -03:00

jina-reader-fetch.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

kie.ts

fix: address kie provider review feedback

2026-05-07 00:01:54 +07:00

kimi-web.ts

fix(kimi): point kimi-web to international www.kimi.ai (#11045)

2026-08-22 18:55:23 -03:00

kimi.ts

fix(kimi): normalize MFJS tool schemas (#10079)

2026-08-13 07:52:41 -03:00

kimiToolNames.ts

fix(executors): backfill missing tool message names for Kimi K3 and strict BYOK providers (#9005)

2026-08-06 00:09:11 -03:00

kiro.ts

fix(kiro): add runtime.us-east-1.kiro.dev as first-attempt endpoint (#11517)

2026-08-26 09:21:44 -03:00

kiroThinking.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

kiroToolCallValidation.ts

fix(kiro): validate completed nested tool_call payloads (#9314)

2026-08-05 22:41:25 -03:00

lmarena.ts

fix(providers): migrate web cookie TLS transport to wreq-js (#12429)

2026-09-02 10:41:00 -03:00

maxai.ts

feat(providers): add MaxAI — signed OpenAI-compatible provider (chat, tools, vision, image-gen, doc-RAG) (#11461)

2026-09-02 01:55:42 -03:00

moonshot.ts

fix(kimi): normalize MFJS tool schemas (#10079)

2026-08-13 07:52:41 -03:00

muse-spark-web.ts

fix(executors): report WS readyState in Meta AI timeout error (#10727) (#10916)

2026-08-21 08:02:19 -03:00

nimble-fetch.ts

feat(providers): add Nimble web search and fetch (#11620)

2026-08-26 09:22:03 -03:00

ninerouter.ts

fix(security): harden public error boundaries

2026-09-02 07:14:27 -03:00

nlpcloud.ts

fix(security): close remaining v3.8.50 advisories (batch 2 — 11 findings) (#11040)

2026-08-21 20:28:16 -03:00

notion-web.ts

fix(providers): migrate web cookie TLS transport to wreq-js (#12429)

2026-09-02 10:41:00 -03:00

oneminai.ts

fix(sse): preserve 1min.ai partial output before stream errors (#12466)

2026-09-03 21:06:28 -03:00

opencode.ts

fix(executors): let the ambient proxy stand when an OpenCode account has none (#12380)

2026-09-02 03:14:13 -03:00

perplexity-web.ts

fix(sse): preserve Perplexity stream failures (#12465)

2026-09-03 21:00:14 -03:00

poe-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

pollinations.ts

fix(sse): stop keyless pollinations 401s from poisoning the noauth pool (#9827) (#11194)

2026-08-23 07:01:04 -03:00

promptql.ts

feat(sse): add PromptQL playground provider (unofficial) (#7911)

2026-07-21 13:16:58 -03:00

qoder.ts

fix(qoder): surface qodercli stderr in error message instead of generic 502 (#9319) (#9412)

2026-08-07 20:52:54 -03:00

registry.ts

perf(executors): lazy-load the executor registry — defer class imports + construction to first use (#11220) (#11421)

2026-08-25 18:22:46 -03:00

t3-chat-web.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

tavily-fetch.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

tencent-aistudio-web.ts

feat(providers): add tencent-aistudio-web cookie provider (tasw) (#10174)

2026-08-15 05:15:17 -03:00

tinycms.ts

perf(stream): compile hot-path regexes once, bound token caches, fix quadratic buffering (#12179)

2026-09-03 08:29:14 -03:00

tinycmsSigner.ts

fix(build): repair broken production build, red lint gate and SWR crash (#10198)

2026-08-12 15:58:40 -03:00

tinyfish-fetch.ts

fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699)

2026-07-27 17:24:39 -03:00

trae.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

uc.ts

feat(providers): add UC (uncensored.com) — persona (un-metered) + direct (metered) (#11513)

2026-09-02 02:23:33 -03:00

v0-vercel-web.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

venice-web.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

veoaifree-web.ts

fix(types): preserve Veo polling delay result (#9104)

2026-08-05 22:30:08 -03:00

vertex.ts

fix(vertex): route Claude models to native rawPredict and respect targetFormat overrides (#8994)

2026-08-07 11:23:19 -03:00

vertexMedia.ts

chore(release): merge release/v3.8.50 tip into release/v3.8.51 — sync-back step 1/2

2026-08-28 14:07:39 -03:00

xai.ts

fix(xai): cap chat history at xAI 800-message limit (#10601)

2026-08-18 10:52:52 -03:00

yuanbao-web.ts

fix(yuanbao-web): accept content field in SSE text events (upstream format change) (#8739)

2026-08-07 11:23:07 -03:00

zai-web.ts

feat(providers): refresh Z.ai Web models and browser transport (#12524)

2026-09-03 07:49:42 -03:00

zcode.ts

fix(catalog): declare GLM reasoning effort tiers (#10963)

2026-08-22 22:54:49 -03:00

zcodeProtocol.ts

perf(stream): compile hot-path regexes once, bound token caches, fix quadratic buffering (#12179)

2026-09-03 08:29:14 -03:00

zed-hosted.ts

fix(sse): fail Zed streams without false success (#12455)

2026-09-03 20:58:39 -03:00

zenmux-free.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00