mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 12:22:14 +03:00
d9c2c13851
Five issues raised in the v3.8.0 release review, all release-blocking: P1 — open-sse/services/tokenRefresh.ts Read Windsurf Firebase API key from WINDSURF_CONFIG.firebaseApiKey (resolvePublicCred wrapper) instead of process.env directly. Without this, the literal removal from .env.example silently broke browser-flow Windsurf/Devin token refresh. P1 — open-sse/translator/request/openai-to-kiro.ts Mark synthetic "(empty)" turns injected for assistant-first chats as non-enumerable __synthetic and skip them when deriving conversationId via uuidv5. Prevents unrelated chats from colliding on the same upstream Kiro/AWS Builder ID context. P2 — open-sse/utils/publicCreds.ts Harden decodePublicCred against raw credential overrides outside RAW_VALUE_PATTERN: strict-base64 alphabet check + printable-plain check on the decoded result. Buffer.from(v, "base64") is lenient and was silently mangling unrecognized raw values. P2 — src/sse/services/auth.ts Gate the x-api-key fallback on the anthropic-version header. Without this scoping, local-mode requests with placeholder x-api-key from non-Anthropic clients were rejected as Invalid API key even with REQUIRE_API_KEY=false. P2 — src/app/api/providers/[id]/test/route.ts Move Qoder OAuth+PAT disambiguation BEFORE the CLI-runtime early-return that was making the new message branch unreachable for the target scenario from #2247. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>