Diego Rodrigues de Sa e Souza 1d0c5a36db fix(security): match cookie domains by suffix, not substring (#11429) ...

CodeQL js/incomplete-url-substring-sanitization, alerts #860 and #861:
volcengineConsoleAutoLogin accepted any cookie whose `domain` merely *contained*
"volcengine.com".

That check is an authorization decision, not a string test. The console
auto-login harvests `digest`, `AccountID`, `csrfToken` and `userInfo` out of the
Playwright context and persists them as the operator's Volcengine credentials,
so a cookie set by `volcengine.com.attacker.tld` — or `notvolcengine.com` — was
captured and stored as a provider connection.

Add `matchesCookieDomain()` (open-sse/utils/cookieDomain.ts): exact host or
dot-boundary suffix, leading dots and case normalized on both sides, failing
closed on an empty expected domain. Same shape as the existing
`isAdobeCookieDomain` in adobeFireflyBrowserLogin.ts, which already got this
right.

While sweeping the class, inAppLoginService's cookie capture had the identical
weakness — `c.domain.includes(domain.replace(/^\./, ""))` — with the identical
consequence: a look-alike host's cookie stored as the operator's credential.
CodeQL did not flag it because the expected domain comes from
TOKEN_EXTRACTION_CONFIGS rather than a literal. Both callsites now share the
helper.

tests/unit/volcengine-cookie-domain-suffix.test.ts — 5 tests, red before the
fix, covering the real domains, seven look-alikes, empty/missing input, and the
config-supplied path.

Co-authored-by: Xiangzhe <bakryun0718@proton.me>

2026-08-24 19:44:12 -03:00

..

__tests__

feat(providers): refresh curated model catalogs and retire Imagen 4 (#10537)

2026-08-18 12:27:46 -03:00

accountFallback

[v3.8.50] fix(antigravity): lock full quota per exact model (#8630)

2026-08-06 05:24:21 -03:00

admission

feat: combo-lane awareness + activation UX + MCP visibility (Wave 2 of #9654) (#10039)

2026-08-18 11:31:46 -03:00

autoCombo

fix(catalog): keep large builds event-loop responsive (#11367)

2026-08-24 09:24:59 -03:00

browserBackedChat

[v3.8.50] Fix Z.ai web browser transport and model capabilities (#8451)

2026-08-12 08:41:03 -03:00

codexAccount

[v3.8.50] refactor(codex): isolate virtual quota pools (#8367)

2026-08-20 09:46:13 -03:00

combo

fix(sse): preserve auto-selected first target (#11399)

2026-08-24 14:15:52 -03:00

compression

fix(sse): spare live user message across all aggressive compression sub-paths (#11386)

2026-08-24 12:13:36 -03:00

promptql

fix(sse): replace spoofable .includes() PromptQL issuer check with hostname comparison (#8029) (#8042)

2026-07-21 21:42:36 -03:00

rateLimitManager

fix(resilience): recover idle-capacity limiter wedges early (#9041)

2026-08-11 04:30:29 -03:00

routing

feat(routing): adaptive feedback loop v2 — operational/semantic quality, confidence, TTFT/ITL, end-to-end test (#10881)

2026-08-20 17:28:30 -03:00

sessionPool

refactor(providers): remove the Puter provider at its owner's request (#10210)

2026-08-12 16:54:50 -03:00

tokenRefresh

fix(github): verify access tokens during health checks (#11320)

2026-08-24 01:50:30 -03:00

usage

feat(volcengine): add Ark plan providers

2026-08-24 12:21:59 -03:00

accountFallback.ts

fix(resilience): honor shared-registry passthrough providers (#11071) (#11165)

2026-08-22 20:43:15 -03:00

accountSelector.ts

Potential fix for code scanning alert no. 54: Insecure randomness

2026-03-05 08:41:44 -03:00

accountSemaphore.ts

maint: final follow-up cherry-pick #9619 (#9901)

2026-08-09 14:15:53 -03:00

adobeFireflyBrowserLogin.ts

fix(sse): kill entire process tree on Linux for adobe firefly sign-in to prevent orphan browser instances (#11387)

2026-08-24 12:13:40 -03:00

adobeFireflyClient.ts

fix: clear release unit and quality regressions

2026-08-09 17:54:23 -03:00

adobeFireflyModels.ts

fix(adobe-firefly): retain Topaz catalog models

2026-08-09 00:21:52 -03:00

adobeFireflyModelSnapshot.ts

fix(adobe-firefly): sync models and media capabilities

2026-08-03 17:22:08 +03:00

adobeFireflyReferences.ts

fix: clear release unit and quality regressions

2026-08-09 17:54:23 -03:00

adobeFireflySecurity.ts

fix(release): clear remaining Adobe and typecheck gates

2026-08-09 17:02:47 -03:00

adobeFireflySession.ts

maint: follow-up cherry-pick fix-in-place #9549 (conflict-resolved fallback) (#9881)

2026-08-09 10:07:17 -03:00

adobeFireflyUpscale.ts

fix(release): clear remaining Adobe and typecheck gates

2026-08-09 17:02:47 -03:00

agentrouterQuotaFetcher.ts

feat(sse): quota tracking for AgentRouter, v0 (Vercel), FreeModel (#6850, #6845, #7075) (#7653)

2026-07-18 03:17:09 -03:00

AGENTS.md

Fix routed target request parameters (#7323)

2026-07-18 21:18:34 -03:00

aihordeImageCatalog.ts

fix(config): keep the SQLite driver out of the client bundle (#10692) (#10695)

2026-08-18 19:23:46 -03:00

alibabaFreeTier.ts

feat(alibaba): free-tier routing with live quota sync (#8893)

2026-08-11 04:25:23 -03:00

alibabaFreeTierAllowlist.ts

feat(alibaba): free-tier routing with live quota sync (#8893)

2026-08-11 04:25:23 -03:00

alibabaFreeTierDiscovery.ts

feat(alibaba): free-tier routing with live quota sync (#8893)

2026-08-11 04:25:23 -03:00

alibabaFreeTierQuotaClassify.ts

feat(alibaba): free-tier routing with live quota sync (#8893)

2026-08-11 04:25:23 -03:00

alibabaFreeTierQuotaFetcher.ts

feat(alibaba): free-tier routing with live quota sync (#8893)

2026-08-11 04:25:23 -03:00

alibabaFreeTierQuotaTypes.ts

feat(alibaba): free-tier routing with live quota sync (#8893)

2026-08-11 04:25:23 -03:00

antigravity429Engine.ts

fix: treat zero-reset Antigravity 429s as transient (#8626)

2026-08-06 06:05:58 -03:00

antigravityClientProfile.ts

refactor(antigravity): align official clients and callable catalog (#8013)

2026-07-22 20:41:19 -03:00

antigravityCredits.ts

refactor(antigravity): align official clients and callable catalog (#8013)

2026-07-22 20:41:19 -03:00

antigravityHeaders.ts

refactor(antigravity): align official clients and callable catalog (#8013)

2026-07-22 20:41:19 -03:00

antigravityHeaderScrub.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

antigravityIdentity.ts

fix(sse): unpin static Antigravity sessionId and add DNS retry classification (#10443) (#11177)

2026-08-23 01:05:08 -03:00

antigravityProjectBootstrap.ts

fix(antigravity): heal empty-projectId accounts via retryable auto-onboarding (#10424)

2026-08-17 08:23:41 -03:00

antigravityProjectPersist.ts

fix(providers): mark Antigravity connects with no Cloud Code projectId as degraded (#11284) (#11358)

2026-08-24 12:12:33 -03:00

antigravityProjectPersistence.ts

fix(providers): mark Antigravity connects with no Cloud Code projectId as degraded (#11284) (#11358)

2026-08-24 12:12:33 -03:00

antigravityQuotaFamily.ts

fix(quota): fix antigravity/agy multi-model quota skipping in combos (#7695)

2026-07-19 14:46:33 -03:00

antigravityVersion.ts

refactor(antigravity): align official clients and callable catalog (#8013)

2026-07-22 20:41:19 -03:00

apiKeyRotator.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

autoRefreshDaemon.ts

fix(combo): guarantee combo loops terminate with an actionable error instead of hanging silently (#10463)

2026-08-20 23:07:25 -03:00

backgroundTaskDetector.ts

fix(background): detect Anthropic top-level system prompts for background task detection (#9142)

2026-08-08 11:45:54 -03:00

bailianQuotaFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

batchProcessor.ts

fix(combo): guarantee combo loops terminate with an actionable error instead of hanging silently (#10463)

2026-08-20 23:07:25 -03:00

bedrock.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

bottleneckPatch.ts

fix(ci): clear base-reds on release/v3.8.50 (round 3) (#10213)

2026-08-13 00:02:25 -03:00

browserBackedChat.ts

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

browserPool.ts

[v3.8.50] Fix Z.ai web browser transport and model capabilities (#8451)

2026-08-12 08:41:03 -03:00

ccBridgeTransforms.ts

feat(cursor): proactively renews Cursor sessions and fixes manual refresh (#9173)

2026-08-11 04:31:24 -03:00

ccOpenAiMediaBlocks.ts

fix(sse): CC bridge loses OpenAI-format image input (OpenCode/Kilo/Cline → AgentRouter) (#7888)

2026-07-20 15:56:40 -03:00

ccWireImageBuiltins.ts

Release v3.8.45 (#6202)

2026-07-06 02:25:17 -03:00

chatgptImageCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

chatgptTlsClient.ts

[v3.8.50] refactor(tls): consolidate 6 TLS client providers into shared factory + wrappers (reopen) (#10910)

2026-08-21 04:26:30 -03:00

chatgptWebCodexAdmin.ts

Add native ChatGPT Web provider for Codex clients (#8949)

2026-08-11 09:53:39 -03:00

claudeAdaptiveThinking.ts

fix(types): preserve Claude thinking body contracts (#9852)

2026-08-09 09:51:56 -03:00

claudeCodeCCH.ts

fix(open-sse): serialize xxhash startup in cch hashing

2026-04-13 14:43:32 -03:00

claudeCodeCompatible.ts

fix: downgrade adaptive thinking and gate context-1m beta on model eligibility (#10119) (#10481)

2026-08-18 10:50:49 -03:00

claudeCodeCompatibleBeta.ts

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

claudeCodeCompatibleThinkingDisplay.ts

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

claudeCodeConstraints.ts

fix(sse): advance Claude cache breakpoints on growing tails (#10684)

2026-08-20 13:05:46 -03:00

claudeCodeExtraRemap.ts

Release v3.6.9 (#1404)

2026-04-19 19:50:30 -03:00

claudeCodeFingerprint.ts

feat(claude-code): PR #1188 — Native parity with CCH signing, tool remapping, and API constraints

2026-04-12 22:41:12 -03:00

claudeCodeObfuscation.ts

fix(claude): preserve signed thinking turns during obfuscation (#8629)

2026-08-06 05:24:13 -03:00

claudeCodeToolRemapper.ts

fix(claude): restore canonical tool names so Claude Code accepts tool calls (#11085)

2026-08-22 19:00:39 -03:00

claudeHaikuConstraints.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

claudeTlsClient.ts

[v3.8.50] refactor(tls): consolidate 6 TLS client providers into shared factory + wrappers (reopen) (#10910)

2026-08-21 04:26:30 -03:00

claudeTurnstileSolver.ts

fix(claude-web): unify Turnstile/executor/fast-path User-Agents behind one fingerprint (#7548) (#7711)

2026-07-19 02:31:26 -03:00

claudeUsageCooldown.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

claudeWebAutoRefresh.ts

feat(claude-web): implement session-based executor with auto-refresh (#2283)

2026-05-15 12:51:07 -03:00

clinepassModels.ts

feat(cline): align ClinePass catalog and request protocol (#7914)

2026-07-21 12:19:01 -03:00

cloudCodeHeaders.ts

fix(cli): add Gemini CLI fingerprint (#1866)

2026-05-02 00:48:54 -03:00

cloudCodeThinking.ts

perf(proxy): implement non-blocking async proxy log batching and performance optimizations (A, B, C, D) (#11182)

2026-08-23 01:07:32 -03:00

codeAssistSubscription.ts

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

codexQuotaFetcher.ts

feat(codex): sync v178 identity mechanisms — turn-state relay, persisted seeds, identity faces (#10716)

2026-08-20 06:28:45 -03:00

codexUsageQuotas.ts

fix(codex): preserve quota window duration (#9222)

2026-08-05 22:40:33 -03:00

codexVerbosity.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

combo.ts

fix(combo): reconcile #11360 retry-loop persisted-cooldown recheck return shape

2026-08-24 12:32:09 -03:00

comboAgentMiddleware.ts

feat(sse): server-side template expansion for combo system prompts (#5501) (#9414)

2026-08-11 04:35:20 -03:00

comboConfig.ts

feat(combo): make the global attempt budget operator-configurable (#11134) (#11239)

2026-08-23 14:24:45 -03:00

comboMetrics.ts

Release v3.8.34 (#4614)

2026-06-23 03:08:29 -03:00

conolAuth.ts

feat(providers): add Conol (conol.ai) web session provider (#8974)

2026-08-11 09:08:23 -03:00

conolBrowserLogin.ts

feat(providers): add Conol (conol.ai) web session provider (#8974)

2026-08-11 09:08:23 -03:00

conolModels.ts

fix(providers): eliminate Gemini 3.5 Flash

2026-08-23 18:13:11 -03:00

conolSessionModel.ts

feat(providers): add Conol (conol.ai) web session provider (#8974)

2026-08-11 09:08:23 -03:00

conolUsage.ts

feat(providers): add Conol (conol.ai) web session provider (#8974)

2026-08-11 09:08:23 -03:00

contextHandoff.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

contextManager.ts

fix(sse): merge purify_history compression notice into the leading system message (#11113)

2026-08-22 21:53:08 -03:00

conversationTracker.ts

fix(conversations): bound reconnect walk + memoize turn hashes (#7847) (#10800)

2026-08-20 15:34:32 -03:00

conversationTurnContent.ts

feat(dashboard): agentic conversation tracking — v4, decoupled + storage-architecture concern resolved (#10263)

2026-08-18 11:32:33 -03:00

credentialGate.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

crofUsageFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

cursorApiKeyAuth.ts

fix(security): clear new CodeQL code-scanning alerts (round 2) (#10888)

2026-08-21 08:02:16 -03:00

cursorSessionManager.ts

fix(cursor): preserve tool context across multi-turn conversations when client lacks conversation_id (#9029)

2026-08-07 11:23:27 -03:00

dashscopeTextModels.ts

feat(alibaba): free-tier routing with live quota sync (#8893)

2026-08-11 04:25:23 -03:00

deepseekQuotaFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

defaultReasoningEffort.ts

fix(models): enforce a synced model's real context window and default effort immediately (#10957)

2026-08-21 08:25:14 -03:00

deviceTracker.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

emergencyFallback.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

errorClassifier.ts

feat(vision-bridge): consolidate vision bridge fixes (catalog verdict, creds, cache key, CC vision) (#10859)

2026-08-21 02:13:07 -03:00

evalRouting.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

firecrawlQuotaFetcher.ts

Merge remote-tracking branch 'origin/release/v3.8.50' into fix/release-v3.8.50-post-sweep-base-red

2026-08-09 15:21:37 -03:00

freeModelQuotaFetcher.ts

feat(sse): quota tracking for AgentRouter, v0 (Vercel), FreeModel (#6850, #6845, #7075) (#7653)

2026-07-18 03:17:09 -03:00

freeWebSearch.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

fusion.ts

feat: combo-lane awareness + activation UX + MCP visibility (Wave 2 of #9654) (#10039)

2026-08-18 11:31:46 -03:00

geminiRateLimitTracker.ts

fix(sse): Gemini TPM/RPD quota classification + combo cooldown-wait resilience (#8213)

2026-07-23 05:17:35 -03:00

geminiThoughtSignatureStore.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

genericQuotaFetcher.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

gigachatAuth.ts

feat: global email privacy toggle with eye icon button

2026-04-11 09:38:17 -03:00

githubCopilotModels.ts

Integration: security tier + self-hosted operator blockers (rebased onto v3.8.51) (#10952)

2026-08-23 16:51:25 -03:00

gpt5SamplingGuard.ts

fix(openai): strip reasoning_effort when GPT-5.x models carry function tools (#7101)

2026-07-17 10:43:37 -03:00

grokClearance.ts

feat: classify grok-web Cloudflare anti-bot blocks + gated browser-backed cf_clearance path (#8019) (#8241)

2026-07-23 01:33:32 -03:00

grokCliQuotaFetcher.ts

feat: add live gRPC-web quota fetcher for grok-cli (#6844) (#7714)

2026-07-20 15:57:29 -03:00

grokCliQuotaFrame.ts

feat: add live gRPC-web quota fetcher for grok-cli (#6844) (#7714)

2026-07-20 15:57:29 -03:00

grokQuotaFetcher.ts

feat(providers): weekly quota for xAI OAuth (Grok) (#8471)

2026-07-26 12:11:02 -03:00

grokTlsClient.ts

[v3.8.50] refactor(tls): consolidate 6 TLS client providers into shared factory + wrappers (reopen) (#10910)

2026-08-21 04:26:30 -03:00

hfModelSuggestions.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

httpBackedChatFingerprint.ts

fix(claude-web): unify Turnstile/executor/fast-path User-Agents behind one fingerprint (#7548) (#7711)

2026-07-19 02:31:26 -03:00

hyperagentModels.ts

fix(hyperagent): default 1M context for fable/opus/sonnet (#8496)

2026-07-26 03:53:06 -03:00

imageCombo.ts

fix(quality): green release/v3.8.50 base-reds round 2 (#9985) (#10131)

2026-08-12 16:09:34 -03:00

inAppLoginService.ts

fix(security): match cookie domains by suffix, not substring (#11429)

2026-08-24 19:44:12 -03:00

intentClassifier.ts

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

ipFilter.ts

fix(auth): IP blacklist now blocks on direct connections via trusted peer stamp and re-reads config without restart (#9033) (#9385)

2026-08-05 16:07:21 -03:00

keyGroupAuth.ts

Release v3.8.3 (#2617)

2026-05-24 18:05:58 -03:00

kiroExternalIdp.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

kiroModels.ts

fix(kiro): read usage from the frames Kiro actually sends (#9035)

2026-08-05 21:42:52 -03:00

kiroRegion.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

learnedReasoningEffortCaps.ts

fix(providers): unify learned and declared reasoning-effort clamps on nearest-tier semantics (#11295) (#11305)

2026-08-23 22:17:12 -03:00

learnedThinkingCaps.ts

Train 1D: merge via --admin on .113 validation

2026-07-27 11:30:33 -03:00

lmarenaTlsClient.ts

[v3.8.50] refactor(tls): consolidate 6 TLS client providers into shared factory + wrappers (reopen) (#10910)

2026-08-21 04:26:30 -03:00

manifestAdapter.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

mimoThinking.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

model.ts

fix(model): return model_not_found for unrecognized prefix models when provider is inactive (#10856) (#10894)

2026-08-21 03:49:01 -03:00

modelCapabilities.ts

feat: v3.6.4 — Combo Builder v2, Composite Tiers, P2C Credentials, Observability Layer

2026-04-12 10:34:10 -03:00

modelDeprecation.ts

fix(sse): route bare qwen3.8-max to the canonical -preview id (#10632)

2026-08-18 05:47:27 -03:00

modelEndpointPolicy.ts

fix: enforce OpenAI model lifecycle without silent reroutes (#8627)

2026-08-12 09:04:41 -03:00

modelFamilyFallback.ts

fix: enforce OpenAI model lifecycle without silent reroutes (#8627)

2026-08-12 09:04:41 -03:00

modelLifecycle.ts

fix: enforce OpenAI model lifecycle without silent reroutes (#8627)

2026-08-12 09:04:41 -03:00

modelscopePolicy.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00

modelStrip.ts

feat(release): implement Hermes CLI config and message content stripping (#1475, #1387)

2026-04-22 01:39:49 -03:00

newApiAggregatorQuotaFetcher.ts

feat(sse): New-API/One-API/Sub2API aggregator balance detection (#9415) (#9539)

2026-08-06 10:40:20 -03:00

notionStreamParser.ts

fix(notion-web): use Chrome TLS impersonation for runInferenceTranscript (#8159)

2026-07-23 12:17:58 -03:00

notionThreadSessions.ts

Stabilize Notion web sessions and JSON output (#8751)

2026-07-27 17:25:43 -03:00

notionTlsClient.ts

[v3.8.50] refactor(tls): consolidate 6 TLS client providers into shared factory + wrappers (reopen) (#10910)

2026-08-21 04:26:30 -03:00

notionTranscriptBuilder.ts

fix(notion-web): reuse threadId across OpenAI multi-turn (no new chat each request) (#7900)

2026-07-22 06:59:24 -03:00

notionWebFallbackModels.ts

feat(providers): refresh curated model catalogs and retire Imagen 4 (#10537)

2026-08-18 12:27:46 -03:00

notionWebModels.ts

fix(notion-web): add browser fingerprint headers to reduce Cloudflare challenges (#7864)

2026-07-20 15:57:15 -03:00

oauthSessionOccupancy.ts

fix(routing): account for active OAuth sessions (#8940)

2026-08-11 09:51:35 -03:00

opencodeOllamaUsage.ts

fix(resilience): honor dashboard quota snapshots in opencode-go preflight (#11234) (#11267)

2026-08-23 14:28:19 -03:00

opencodeQuotaFetcher.ts

fix(resilience): honor dashboard quota snapshots in opencode-go preflight (#11234) (#11267)

2026-08-23 14:28:19 -03:00

opencodeReasoningSanitizer.ts

fix(combo): strip boolean reasoning field for opencode-go providers (#7891)

2026-07-20 22:26:13 -03:00

openrouterFreeWindow.ts

feat: OpenRouter quota tracking (key/credits + free-window counter) (#6842) (#7651)

2026-07-18 03:11:01 -03:00

openrouterQuotaFetcher.ts

feat: OpenRouter quota tracking (key/credits + free-window counter) (#6842) (#7651)

2026-07-18 03:11:01 -03:00

payloadRules.ts

fix(types): preserve request rule contracts (#9135)

2026-08-05 22:31:10 -03:00

perplexityTlsClient.ts

[v3.8.50] refactor(tls): consolidate 6 TLS client providers into shared factory + wrappers (reopen) (#10910)

2026-08-21 04:26:30 -03:00

pipeline.ts

fix(combo): exclude hidden leaves from catalog and dispatch (#8878)

2026-08-06 00:08:52 -03:00

promptqlModels.ts

fix(providers): eliminate Gemini 3.5 Flash

2026-08-23 18:13:11 -03:00

provider.ts

fix(translator): harden Claude format detection for model validation (#9253)

2026-08-04 10:06:31 -03:00

providerCooldownTracker.ts

fix(combo): recover provider circuit breaker from HALF_OPEN on success (#9207)

2026-08-11 04:34:23 -03:00

providerCostData.ts

feat: add Claude Opus 5 support (#8464)

2026-07-25 02:52:55 -03:00

providerDefaultRateLimit.ts

fix(resilience): enforce RPM with rolling leases (#9604)

2026-08-06 10:41:04 -03:00

providerRequestDefaults.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

proxyAutoSelector.ts

Release v3.8.14 (#3340)

2026-06-07 07:20:02 -03:00

qoderCli.ts

fix(windows): request shell when spawning bare qoder binary name on Windows (fixes #8590) (#8633)

2026-07-27 19:08:12 -03:00

qoderCliResolve.ts

fix(windows): request shell when spawning bare qoder binary name on Windows (fixes #8590) (#8633)

2026-07-27 19:08:12 -03:00

quotaFetchThrottle.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

quotaMonitor.ts

feat(sse): New-API/One-API/Sub2API aggregator balance detection (#9415) (#9539)

2026-08-06 10:40:20 -03:00

quotaPreflight.ts

feat(sse): New-API/One-API/Sub2API aggregator balance detection (#9415) (#9539)

2026-08-06 10:40:20 -03:00

quotaResetParsing.ts

fix(quota): parse absolute ISO datetime reset timestamps in weekly quota fallback (#11353)

2026-08-24 12:12:26 -03:00

quotaTextCooldowns.ts

fix(quota): parse absolute ISO datetime reset timestamps in weekly quota fallback (#11353)

2026-08-24 12:12:26 -03:00

quotaTrackersBatch.ts

feat(providers): live monthly credit quota for Firecrawl (#8759)

2026-07-27 17:25:47 -03:00

qwenThinking.ts

feat(core): add db health checks and provider interoperability

2026-04-13 13:11:30 -03:00

qwenTokenPlanQuotaFetcher.ts

fix(sse): surface Qwen/Alibaba personal Token Plan quota in dashboard and preflight (#10290)

2026-08-14 15:40:33 -03:00

rateLimitManager.ts

feat(providers): allow per-connection maxWaitMs rate-limit override (#11251)

2026-08-23 14:21:55 -03:00

rateLimitSemaphore.ts

Release v3.8.32 (#4418)

2026-06-21 08:56:51 -03:00

raycast.ts

fix(ci): clear the NEW base-reds from the 08-06 merge batch (migration collision #2 + broken import) (#9688)

2026-08-07 11:13:20 -03:00

reasoningCache.ts

chore(startup): remove server-init.ts, a module nothing imports (#10780)

2026-08-20 10:27:26 -03:00

reasoningInputPolicy.ts

fix(sse): default single-target incompatible reasoning to drop for agentic replay (#10959) (#11178)

2026-08-23 10:00:17 -03:00

reasoningTokenBuffer.ts

fix(sse): answer tiny-budget reasoning probes with a truncated 200 (#10281) (#10284)

2026-08-16 00:14:35 -03:00

refreshSerializer.ts

fix(types): narrow refresh token rotation inputs (#10257)

2026-08-14 00:57:58 -03:00

requestDedup.ts

fix(open-sse): stop concurrent requests colliding on dedup hash for non-OpenAI formats (#10438)

2026-08-18 10:50:15 -03:00

responseModelEcho.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

responsesInputSanitizer.ts

fix(sse): default summary + strip malformed id on kept Responses input items (#11110)

2026-08-22 14:39:47 -03:00

responsesItemId.ts

fix(sse): default summary + strip malformed id on kept Responses input items (#11110)

2026-08-22 14:39:47 -03:00

retryAfterJson.ts

fix: parse Gemini 429 RetryInfo.retryDelay for model lockout (#7940) (#7961)

2026-07-21 09:15:27 -03:00

roleNormalizer.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

rollingRpmGate.ts

fix(resilience): enforce RPM with rolling leases (#9604)

2026-08-06 10:41:04 -03:00

rotationConfig.ts

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

searchCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

sessionManager.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

signatureCache.ts

perf(ram): reduce server memory footprint (#2903)

2026-05-29 13:21:36 -03:00

slidingWindowLimiter.ts

fix(resilience): enforce RPM with rolling leases (#9604)

2026-08-06 10:41:04 -03:00

specificityDetector.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

specificityRules.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

specificityTypes.ts

fix(types): preserve request rule contracts (#9135)

2026-08-05 22:31:10 -03:00

speechCombo.ts

fix(providers): resolve combo names on /v1/audio/speech and /v1/videos/generations (#10471)

2026-08-18 10:50:31 -03:00

streamRecovery.ts

fix(sse): reject a low-overlap stream-recovery continuation instead of concatenating it raw (#11152)

2026-08-22 21:56:26 -03:00

systemPrompt.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

systemTransforms.ts

fix(sse): do not ZWJ-obfuscate the substring hermes in user text (#10488)

2026-08-17 07:04:48 -03:00

targetRequestSanitizer.ts

Fix routed target request parameters (#7323)

2026-07-18 21:18:34 -03:00

taskAwareRouter.ts

feat(routing): make task-detection patterns operator-configurable (#10783)

2026-08-20 06:30:31 -03:00

taskAwareRouting.ts

fix(sse): preserve auto scoring order (#11400)

2026-08-24 14:16:04 -03:00

thinkingBudget.ts

docs(settings): Thinking Budget modes + fix Auto i18n collision (#10169)

2026-08-13 07:53:12 -03:00

throughputWatchdog.ts

feat(resilience): abort persistently slow upstream streams (#9709) (#10012)

2026-08-10 18:16:13 -03:00

tierConfig.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

tierDefaults.json

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

tierResolver.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tierTypes.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

tlsClientBase.ts

[v3.8.50] refactor(tls): consolidate 6 TLS client providers into shared factory + wrappers (reopen) (#10910)

2026-08-21 04:26:30 -03:00

tlsClientDownloadDir.ts

refactor(tls): update TLSClient instantiation to use buildNativeTlsClientOptions across multiple services (#8583)

2026-07-27 19:06:59 -03:00

tlsClientProxy.ts

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

tokenExtractionConfig.ts

feat(volcengine): add Ark plan providers

2026-08-24 12:21:59 -03:00

tokenLimitCounter.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

tokenRefresh.ts

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

toolLatencyTracker.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

toolLimitDetector.ts

Release v3.8.45 (#6202)

2026-07-06 02:25:17 -03:00

toolSchemaSanitizer.ts

fix(kimi): normalize MFJS tool schemas (#10079)

2026-08-13 07:52:41 -03:00

usage.ts

feat(volcengine): add Ark plan providers

2026-08-24 12:21:59 -03:00

v0QuotaFetcher.ts

feat(sse): quota tracking for AgentRouter, v0 (Vercel), FreeModel (#6850, #6845, #7075) (#7653)

2026-07-18 03:17:09 -03:00

videoCombo.ts

fix(providers): resolve combo names on /v1/audio/speech and /v1/videos/generations (#10471)

2026-08-18 10:50:31 -03:00

volcengineConsoleAutoLogin.ts

fix(security): match cookie domains by suffix, not substring (#11429)

2026-08-24 19:44:12 -03:00

volumeDetector.ts

feat(ui): integrate FSM, adaptive routing, and provider diversity

2026-03-30 12:58:45 -03:00

wafRateLimit.ts

fix(agentrouter): retry on 400 content-blocked + burst guard (#9323)

2026-08-03 18:22:14 -03:00

webFetchInterception.ts

fix(types): align web fallback contracts (#8819)

2026-07-27 23:57:23 -03:00

webSearchFallback.ts

fix(providers): use prefix regex for web search fallback detector to catch versioned tool types (#9279)

2026-08-07 18:08:44 -03:00

webSearchRouting.ts

Release v3.8.33 (#4515)

2026-06-22 03:17:02 -03:00

webSessionPoolHealth.ts

feat: add web-session pool observability (MCP tool + health-matrix) (#3395)

2026-06-08 00:48:01 -03:00

wildcardRouter.ts

fix(build): unblock release build and settings state updates

2026-04-17 23:21:02 -03:00

workflowFSM.ts

chore(release): v3.4.8 — security compliance and fix algorithms

2026-04-03 00:15:35 -03:00

xaiMessageCap.ts

fix(xai): cap chat history at xAI 800-message limit (#10601)

2026-08-18 10:52:52 -03:00

xaiOauthQuotaFetcher.ts

feat(providers): weekly quota for xAI OAuth (Grok) (#8471)

2026-07-26 12:11:02 -03:00

zaiWebCredentials.ts

fix(build): repair broken production build, red lint gate and SWR crash (#10198)

2026-08-12 15:58:40 -03:00