zmf 8a527fec91 fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction ...

- resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search)
- fresh-install remote login with default password returns 403 without issuing a JWT
- /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads
- declare chalk and prop-types in package.json (used but previously undeclared)

2026-08-13 11:50:25 +07:00

..

alicode-cache-control-2069.test.js

fix(alicode): preserve cache_control for DashScope providers (#2069)

2026-06-29 15:29:49 +07:00

alicode-intl-endpoint-2591.test.js

fix(alicode-intl): split into Coding Plan + Model Studio providers

2026-07-19 16:29:55 +07:00

antigravity-cache.test.js

Add marked package, update Qwen executor for OAuth handling, and enhance changelog styles

2026-04-17 12:15:10 +07:00

antigravity-mitm.test.js

fix(antigravity): passthrough tab-autocomplete + mark default agent slot mandatory

2026-06-06 10:48:14 +07:00

antigravity-oauth-client.test.js

refactor(open-sse): registry consolidation + DRY media/oauth/adhoc cleanup

2026-06-14 13:15:48 +07:00

antigravity-quota-gemini-3.6.test.js

feat(antigravity): show Gemini 3.6 Flash usage bars in quota tracker

2026-08-05 13:21:38 +07:00

antigravity-retry-hook.test.js

feat(gemini): add Gemini 3.6 Flash tier routing and 3.5 Flash Lite

2026-07-23 16:34:24 +07:00

antigravity-stream-options.test.js

fix(antigravity): strip stream_options from non-stream requests

2026-07-29 19:30:44 +07:00

antigravity-usage-headers.test.js

fix(antigravity): align provider fingerprint with IDE Desktop 2.1.1 (#2389)

2026-07-08 10:17:47 +07:00

auth-status.test.js

fix(auth): redirect active sessions from /login

2026-08-05 10:27:27 +07:00

background-token-refresh.test.js

feat: Ollama Cloud quota tracker + proactive background OAuth refresh

2026-08-02 09:34:27 +07:00

base-executor-retry.test.js

fix(antigravity): retry transient upstream failures

2026-06-26 17:19:46 +07:00

buildOutputFilter.test.js

chore: add buildOutput RTK filter, drop legacy cloud sync, internal cleanup

2026-05-16 10:54:41 +07:00

buildOutputFilterAdversarial.test.js

feat(rtk): add JS-native git-log filter (#2423)

2026-07-07 12:02:56 +07:00

bulk-add-names.test.js

fix(providers): bulk-add API keys no longer overwrite existing keys

2026-07-16 17:20:10 +07:00

cached-token-e2e.test.js

feat(usage): track cached tokens + correct input/output/cache cost (#2209)

2026-07-03 15:18:27 +07:00

cached-token-usage.test.js

feat(usage): track cached tokens + correct input/output/cache cost (#2209)

2026-07-03 15:18:27 +07:00

capabilities-opus-context.test.js

feat(kiro): add Claude Opus 5 models

2026-07-29 19:34:14 +07:00

capabilities-service-kind.test.js

fix: show custom vision models in LLM selector and model list

2026-06-18 09:13:27 +07:00

capabilities.test.js

feat(kiro): add Claude Opus 5 models

2026-07-29 19:34:14 +07:00

caveman-prompts.test.js

feat(caveman): add targeted upstream-aligned style rules (#2424)

2026-07-07 11:55:45 +07:00

claude-cloaking.test.js

fix(claude): forced tool_choice 400 on cc/ OAuth route

2026-06-06 12:54:01 +07:00

claude-header-forwarding.test.js

fix(claude): remove global header cache, gate anthropic-beta by model

2026-08-05 11:32:14 +07:00

cli-build-artifacts.test.js

fix(cli): include complete API artifacts in CLI package

2026-08-05 11:54:16 +07:00

cli-xai-video.test.js

feat(xai): add Grok Imagine video generation (/v1/videos) + CLI

2026-07-16 15:29:52 +07:00

codebuddy-cn-bonus-recurring.test.js

fix(codebuddy-cn): show bonus packs as one-time, not monthly-replenishing

2026-06-29 15:22:47 +07:00

codebuddy-reasoning-optin.test.js

fix(codebuddy): only send reasoning params when client requests reasoning

2026-06-26 10:51:16 +07:00

codex-fast-capacity.test.js

feat(codex): support GPT-5.6 Max and Ultra overrides

2026-08-05 11:39:59 +07:00

codex-image-fetch.test.js

Refactor

2026-06-15 18:18:04 +07:00

codex-native-passthrough-thinking.test.js

feat(codex): support GPT-5.6 Max and Ultra overrides

2026-08-05 11:39:59 +07:00

codex-refresh-token.test.js

fix(providers): remove Qwen provider support

2026-08-05 16:17:26 +07:00

codex-reset-credits.test.js

feat(codex): show reset credit expiry details (#2290)

2026-07-03 15:07:45 +07:00

codex-tool-normalization.test.js

fix(codex): preserve Responses text format

2026-06-26 10:37:29 +07:00

combo-autoswitch.test.js

Refactor

2026-06-15 18:18:04 +07:00

combo-fusion.test.js

fix(combo/fusion): flatten Anthropic-style tool messages in panel calls

2026-06-20 15:19:31 +07:00

combo-routing.test.js

Add sticky round-robin for combos (#831)

2026-05-01 16:36:36 +07:00

commandcode-to-openai.test.js

refactor(open-sse): translator DRY + schema enums, bug fixes, dead code cleanup

2026-06-14 18:49:38 +07:00

compatible-provider-connections.test.js

feat(usage): track cached tokens + correct input/output/cache cost (#2209)

2026-07-03 15:18:27 +07:00

continuity-strip.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

count-tokens.test.js

fix(count_tokens): count structured Anthropic blocks (#2419)

2026-07-07 12:06:09 +07:00

cursor-agent-exec-request.test.js

fix(cursor): stop leaking agent tool errors as text

2026-07-29 19:29:27 +07:00

cursor-agent-proto.test.js

fix(cursor): HTTP/2 AgentService support + version bump to 3.12.17

2026-07-20 15:39:55 +07:00

cursor-composer-thinking.test.js

fix: decode Composer cursor thinking output (#1310)

2026-05-21 09:52:30 +07:00

cursor-models.test.js

fix(cursor): HTTP/2 AgentService support + version bump to 3.12.17

2026-07-20 15:39:55 +07:00

custom-server-h2c.test.cjs

fix(server): support IntelliJ IDEA OpenAI clients over HTTP

2026-08-05 10:32:32 +07:00

dashboard-guard.test.js

fix(gemini): support native TTS generateContent endpoint

2026-06-26 10:50:13 +07:00

db-benchmark.test.js

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00

db-concurrent.test.js

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00

db-driver-chain.test.js

chore: release v0.4.27

2026-05-09 22:48:07 +07:00

db-migration-chain.test.js

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00

db-sqlite-vs-lowdb.test.js

fix(github): label Copilot profiles by account identity (#2498)

2026-07-10 11:29:12 +07:00

deepseek-usage.test.js

feat(usage): add Kimi and DeepSeek usage handlers

2026-07-29 18:09:35 +07:00

devin-cli-executor.test.js

feat(devin-cli): bridge client tools via MCP and use full agent

2026-07-29 18:10:03 +07:00

embedding-usage-persistence.test.js

fix(usage): record exact embedding tokens

2026-07-23 16:07:57 +07:00

embeddings.cloud.test.js

…

embeddingsCore.test.js

feat(vercel-ai-gateway): support embeddings, images and credit usage

2026-06-13 10:54:51 +07:00

executor-const-guard.test.js

fix(translator): ESM-safe registry + tool-id pairing + responses max_tokens; add real-creds tests

2026-06-15 11:38:43 +07:00

fetch-success-clears-account.test.js

fix(jina-reader): recover after transient errors and use JSON POST API

2026-07-23 16:28:37 +07:00

file-block-routing.test.js

Refactor

2026-06-15 18:18:04 +07:00

finish-reason-concern.test.js

fix(translator): ESM-safe registry + tool-id pairing + responses max_tokens; add real-creds tests

2026-06-15 11:38:43 +07:00

force-stream-config.test.js

fix: preserve forced streaming for json clients

2026-06-26 10:37:23 +07:00

gemini-36-integration.test.js

feat(gemini): add Gemini 3.6 Flash tier routing and 3.5 Flash Lite

2026-07-23 16:34:24 +07:00

gemini-native-endpoint.test.js

fix(gemini): support native TTS generateContent endpoint

2026-06-26 10:50:13 +07:00

gemini-tts.test.js

fix(tts): resolve Gemini TTS models from catalog

2026-06-26 10:32:34 +07:00

gemini-usage-projectid.test.js

Reuse Gemini CLI project ID for usage (#1428)

2026-05-26 11:23:47 +07:00

github-monthly-usage-lock.test.js

fix(github): hold monthly-exhausted accounts until reset

2026-08-05 11:00:40 +07:00

github-responses-routing.test.js

fix: never route GitHub Copilot Gemini/Claude models to /responses (#1062) (#1536)

2026-05-29 15:40:42 +07:00

grok-build-config.test.js

feat(cli-tools): configure Grok Build subagent models

2026-07-19 13:35:38 +07:00

grok-cli-executor.test.js

fix(grok-cli): align Grok Build with current subscription protocol (#2590)

2026-07-16 15:33:19 +07:00

grok-cli-expiresat-2546.test.js

fix(grok-cli): surface expiresAt so proactive token refresh fires (#2546)

2026-07-16 12:00:14 +07:00

grok-cli-models.test.js

fix(grok-cli): align Grok Build with current subscription protocol (#2590)

2026-07-16 15:33:19 +07:00

grok-cli-oauth-probe.test.js

feat(grok-cli): add Grok CLI / Grok Build provider with OAuth device-code flow (#2502)

2026-07-10 11:47:08 +07:00

grok-cli-quota-frame.test.js

feat(usage): fetch SuperGrok weekly pool via gRPC-web

2026-07-29 18:09:43 +07:00

grok-cli-usage.test.js

fix(grok-cli): display public subscription tier

2026-08-05 11:43:40 +07:00

headroom-chat-core.test.js

feat(rtk): add X-9Router-Token-Saver header to bypass token savers per request

2026-07-16 11:27:42 +07:00

headroom-detect.test.js

feat(headroom): activate/uninstall extras + fix interpreter detection

2026-07-10 17:32:45 +07:00

headroom-responses-format.test.js

fix(headroom): skip unsafe responses tool history (#2132)

2026-06-29 15:59:21 +07:00

headroom.test.js

feat(headroom): report effective payload savings

2026-08-05 11:32:38 +07:00

hf-model-routing.test.js

Fix model test routing for image providers

2026-06-02 21:14:36 +08:00

image-fetch-hardening.test.js

Refactor

2026-06-15 18:18:04 +07:00

image-generation.test.js

feat(vercel-ai-gateway): support embeddings, images and credit usage

2026-06-13 10:54:51 +07:00

jina-reader-fetch.test.js

fix(jina-reader): recover after transient errors and use JSON POST API

2026-07-23 16:28:37 +07:00

kimchi-strip-reasoning.test.js

fix(kimchi): strip reasoning_content echo to bound multi-turn input tokens

2026-07-03 10:58:31 +07:00

kimchi.test.js

fix: prevent non-SSE stream pipe crash and cross-IdP account overwrites (#2244)

2026-07-03 11:11:07 +07:00

kimi-usage.test.js

chore: drop source-attribution comments from provider code

2026-07-29 21:05:23 +07:00

kiro-api-key-endpoint-routing.test.js

fix(kiro): canonicalize tool history and route API keys correctly

2026-07-29 19:27:41 +07:00

kiro-conversation-canonicalization.test.js

fix(kiro): canonicalize tool history and route API keys correctly

2026-07-29 19:27:41 +07:00

kiro-external-idp.test.js

feat(kiro): add external_idp CLIProxyAPI import for Microsoft SSO

2026-06-26 11:42:05 +07:00

kiro-model-slots.test.js

feat(kiro): add GPT-5.6 model family (#2596)

2026-07-16 14:38:08 +07:00

kiro-nonstream-error.test.js

fix(kiro): validate terminal streams before emitting output

2026-07-20 10:55:33 +07:00

kiro-profile-arn.test.js

fix(kiro): canonicalize tool history and route API keys correctly

2026-07-29 19:27:41 +07:00

kiro-terminal-integrity.test.js

fix(kiro): validate terminal streams before emitting output

2026-07-20 10:55:33 +07:00

kiro-thinking-strip.test.js

fix(kiro): validate terminal streams before emitting output

2026-07-20 10:55:33 +07:00

kiro-usage-and-tool-integrity.test.js

fix(kiro): report real output tokens and stop discarding usable turns

2026-08-13 11:33:41 +07:00

mimo-free.live.test.js

fix(mimo-free): add Chrome User-Agent rotation to bypass anti-abuse gate

2026-06-21 16:51:47 +07:00

mimo-free.test.js

fix(provider-topology): update label assignment to include nodeName

2026-06-13 11:43:18 +07:00

minimax-tts.test.js

feat: add minimax tts support (#1043)

2026-05-13 15:34:10 +07:00

minimax-usage.test.js

fix(minimax): Bổ sung MiniMax-M3 + cập nhật Quota Tracker coding/CN

2026-06-06 10:01:05 +07:00

minimax-voices.test.js

feat: add minimax tts support (#1043)

2026-05-13 15:34:10 +07:00

mitm-root-ca.test.js

fix(mitm): generate root ca on server startup (#2228)

2026-07-01 09:30:52 +07:00

modality-strip.test.js

Refactor

2026-06-15 18:18:04 +07:00

model-name-regex.test.js

fix(kiro): deliver system prompt natively, add Opus 4.5/4.7/4.8, tolerate dash version ids (#2366)

2026-07-05 17:34:04 +07:00

model-routing.test.js

fix(image): prevent compatible nodes from shadowing provider aliases

2026-06-18 09:10:52 +07:00

model-test-routing.test.js

Harden STT ping input and expand model-test coverage

2026-06-03 01:53:34 +08:00

multimodal-drop-lock.test.js

refactor(open-sse): translator DRY + schema enums, bug fixes, dead code cleanup

2026-06-14 18:49:38 +07:00

oauth-cursor-auto-import.test.js

fix: improve cursor auto-import reliability on macOS (#161)

2026-02-20 15:07:43 +07:00

ollama-usage.test.js

feat: Ollama Cloud quota tracker + proactive background OAuth refresh

2026-08-02 09:34:27 +07:00

open-package-external.test.js

fix(oauth): keep open external so xAI/Grok token refresh works on Windows

2026-08-05 10:38:25 +07:00

openai-compatible-apitype-resolution.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

openai-responses-custom-tools.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

openai-responses-empty-toolcalls.test.js

fix(responses): don't close message on empty tool_calls array

2026-08-13 11:40:45 +07:00

openai-responses-multiturn.test.js

fix(grok-cli): align Grok Build with current subscription protocol (#2590)

2026-07-16 15:33:19 +07:00

openai-responses-nonstream.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

openai-responses-terminal-event.test.js

fix(responses): handle response.done terminal events (#2142)

2026-06-29 16:05:29 +07:00

openai-to-claude-response-tools.test.js

fix: sanitize Read tool args to prevent retry loops from non-Anthropic models (#1144)

2026-05-26 11:33:38 +07:00

openai-to-claude-tools-no-type.test.js

fix(openai-to-claude): unwrap bare {function:{…}} tools without parent type (#2473)

2026-07-10 11:11:37 +07:00

openai-to-claude.test.js

fix(claude): forced tool_choice 400 on cc/ OAuth route

2026-06-06 12:54:01 +07:00

openai-to-commandcode.test.js

refactor(open-sse): translator DRY + schema enums, bug fixes, dead code cleanup

2026-06-14 18:49:38 +07:00

openai-to-kiro.test.js

fix(kiro): normalize dashboard thinking intensity models

2026-07-23 16:27:06 +07:00

openai-to-ollama-malformed.test.js

fix(translator): ESM-safe registry + tool-id pairing + responses max_tokens; add real-creds tests

2026-06-15 11:38:43 +07:00

opencode-go-models.test.js

feat(opencode-go): align Go models with official endpoints

2026-06-20 15:09:11 +07:00

param-support.test.js

fix(volcengine-ark): clamp GLM-5 max_tokens to model output ceiling (#2428)

2026-07-07 11:57:04 +07:00

perplexity-web.test.js

feat: add support for Grok Web and Perplexity Web providers

2026-04-22 11:58:53 +07:00

prefetch-images.test.js

Refactor

2026-06-15 18:18:04 +07:00

provider-custom-models.test.js

fix(models): store provider custom models by provider scope

2026-06-20 15:19:22 +07:00

provider-display-split.test.js

fix(cloudflare-ai): declare API key authentication

2026-08-05 13:13:54 +07:00

provider-models-minimax-m3.test.js

fix(minimax): Bổ sung MiniMax-M3 + cập nhật Quota Tracker coding/CN

2026-06-06 10:01:05 +07:00

provider-pricing-minimax-m3.test.js

fix(translator): ESM-safe registry + tool-id pairing + responses max_tokens; add real-creds tests

2026-06-15 11:38:43 +07:00

provider-quota-visibility.test.js

feat: add provider quota visibility settings

2026-07-04 23:26:49 +07:00

provider-test-models-routing.test.js

Fix model test routing for image providers

2026-06-02 21:14:36 +08:00

provider-thinking-config.test.js

fix(reasoning): preserve effort through Codex translations

2026-06-26 12:06:35 +07:00

provider-validation.test.js

Add optional modelID input for custom API Key Providers testing (#315)

2026-03-16 09:21:05 +07:00

pxpipe.test.js

feat(pxpipe): PXPIPE token saver — multimodal prompt compression (#2465)

2026-07-10 16:10:42 +07:00

qoder-billing.test.js

fix(qoder): detect billing blocks at stream start, return 403 for failover

2026-08-13 11:43:11 +07:00

qoder.test.js

fix(qoder): detect billing blocks at stream start, return 403 for failover

2026-08-13 11:43:11 +07:00

quota-auto-ping.test.js

perf(startup): skip inactive background services

2026-07-16 12:09:48 +07:00

reasoningContentInjector.test.js

fix(minimax): echo reasoning_content on follow-up turns to avoid 400

2026-06-06 12:25:12 +07:00

request-details-redaction.test.js

fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction

2026-08-13 11:50:25 +07:00

request-details-tab.test.js

fix: DB backup on schema change, MCP child cleanup, codex models, usage providers OOM

2026-07-10 13:08:58 +07:00

responses-abort-terminal.test.js

fix(codex): harden streaming timeouts + Responses terminal events

2026-06-06 16:07:43 +07:00

responses-prompt-cache-key-3216.test.js

fix(translator): preserve prompt_cache_key when converting chat to responses

2026-08-13 11:46:49 +07:00

rtk.e2e.test.js

Feature : RTK compress

2026-04-22 15:36:51 +07:00

rtk.multi-provider.e2e.test.js

Feature : RTK compress

2026-04-22 15:36:51 +07:00

rtk.test.js

feat(rtk): add JS-native git-log filter (#2423)

2026-07-07 12:02:56 +07:00

rtkFindWindows.test.js

fix(rtk/find): detect and group Windows backslash-style find output (#2448)

2026-07-09 15:12:52 +07:00

rtkKiro.test.js

feat(rtk): add Kiro format support for tool result compression (#1194)

2026-05-17 15:13:37 +07:00

search-ssrf-guard.test.js

fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction

2026-08-13 11:50:25 +07:00

searxng-provider-config.test.js

feat(searxng): configure endpoint via SEARXNG_URL env (#2499)

2026-07-10 11:29:06 +07:00

security-audit.test.js

fix(security): patch 5 vulnerabilities from security audit

2026-06-26 11:04:51 +07:00

session-manager.test.js

fix(kiro): improve direct session cache reuse

2026-07-16 15:15:05 +07:00

standalone-assets.test.js

fix(build): include assets in standalone output

2026-08-05 10:32:55 +07:00

thinking-effort-openai-max-clamp.test.js

fix(translator): clamp thinking effort max->xhigh for OpenAI format (#2466)

2026-07-09 15:13:24 +07:00

thinking-levels-gpt56-sol.test.js

feat(codex): support GPT-5.6 Max and Ultra overrides

2026-08-05 11:39:59 +07:00

thinking-levels-kiro.test.js

fix(kiro): normalize dashboard thinking intensity models

2026-07-23 16:27:06 +07:00

token-refresh-dispatch.test.js

refactor(open-sse): #8 unify token refresh dispatch — 2 switch → 1 registry

2026-06-13 21:32:52 +07:00

token-refresh-generic.test.js

fix(providers): remove Qwen provider support

2026-08-05 16:17:26 +07:00

translator-custom-prefix.test.js

fix(translator): resolve custom provider prefix in debug endpoint

2026-06-26 17:22:02 +07:00

translator-helpers-edge.test.js

refactor(open-sse): translator DRY + schema enums, bug fixes, dead code cleanup

2026-06-14 18:49:38 +07:00

translator-request-normalization.test.js

refactor(open-sse): translator DRY + schema enums, bug fixes, dead code cleanup

2026-06-14 18:49:38 +07:00

tunnel-pid-ownership.test.js

fix(tunnel): preserve successor cloudflared PID

2026-07-23 16:22:47 +07:00

usage-concern.test.js

fix(translator): ESM-safe registry + tool-id pairing + responses max_tokens; add real-creds tests

2026-06-15 11:38:43 +07:00

usage-dispatch.test.js

fix(providers): remove Qwen provider support

2026-08-05 16:17:26 +07:00

venice-provider.test.js

feat(providers): add Venice AI provider

2026-06-26 11:37:44 +07:00

web-cookie-validation.test.js

feat: add support for Grok Web and Perplexity Web providers

2026-04-22 11:58:53 +07:00

windsurf-executor.test.js

feat(oauth): zed/trae/windsurf providers + harden callback proxies

2026-07-25 17:25:19 +07:00

xai-oauth-service.test.js

feat(xai): add xAI Grok provider with OAuth + API key auth + image

2026-05-21 11:33:18 +07:00

xai-tokenRefresh.test.js

feat(xai): add xAI Grok provider with OAuth + API key auth + image

2026-05-21 11:33:18 +07:00

xai-video-core.test.js

feat(xai): add Grok Imagine video generation (/v1/videos) + CLI

2026-07-16 15:29:52 +07:00

xai-video-handler.test.js

feat(xai): add Grok Imagine video generation (/v1/videos) + CLI

2026-07-16 15:29:52 +07:00

xiaomi-mimo-tts.test.js

feat(tts): add Xiaomi MiMo text-to-speech support

2026-08-05 11:46:23 +07:00