mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-01 21:02:12 +03:00
24cee53c2f
The DuckDuckGo AI Chat executor fetched status/chat and set Origin/Referer against https://duck.ai while sending Sec-Fetch-Site: same-origin, making the same-origin triplet (host + Origin + Referer) inconsistent so the backend rejected the request with HTTP 400. Repoint the executor's status URL, chat URL, Origin, Referer, and warm fetch to https://duckduckgo.com (matching the provider registry baseUrl and current DDG reverse-engineering references); the same-origin header is now coherent. Also relax FE_VERSION_PATTERN from a 40-hex tail to a bounded {20,40} tail so it matches the real served x-fe-version token (20-hex, e.g. serp_20250401_100419_ET-19d438eb199b2bf7c300) instead of silently falling back to the hardcoded default. The bound keeps the pattern ReDoS-safe. This is the DuckDuckGo half of the report; the separate Chipotle upstream breakage is tracked independently. TDD: tests/unit/duckduckgo-domain-4037.test.ts (8 assertions, RED before the fix, GREEN after). Baseline bump 917->925 for the added comments. Refs #4037