Files
OmniRoute/tests
diegosouzapw ff16cd034b fix(security): stop error-path redaction from swallowing a shielded route hint (#6457)
#12506's unquoted-path ambiguity resolution failed closed across the
*entire remainder* of a message once it saw an unshielded route-looking
span (no HTTP-method context) followed by ambiguous prose and then a
second, legitimately route-shielded reference (e.g. "POST /v1/foo").
resolveEndpoint() only distinguished "ambiguous" from "resolved", so
hitting that second absolute-looking span always re-triggered the
fail-closed value.length branch via hasFilesystemEvidence, deleting
the shielded route and everything after it instead of just redacting
the first, unshielded span.

This broke POST /v1/chat/completions' image-only-model guard (#6457):
its 400 body's second sentence ("Use POST /v1/images/generations
instead.") was being erased by sanitizeErrorMessage(), so
tests/unit/chat-rejects-image-only-model.test.ts failed release-green
on release/v3.8.51.

resolveEndpoint() now takes an ignoreAmbiguity flag; when the next
absolute-looking span is itself route-context-shielded per the
existing hasRouteContextBefore() check, its mere presence no longer
forces a value.length swallow. Added a direct regression test in
tests/unit/error-message-sanitization.test.ts pinning the exact
pattern down at the sanitizeErrorMessage level.
2026-09-07 09:01:51 -03:00
..