openhands b870b5d41b fix(security): close SSRF guard bypasses in ssrfGuard.js (#3714) ...

Closes four SSRF guard bypasses reported in #3714:
- Block alternate IPv6 encodings (hex format, NAT64, IPv4-compatible, IPv4-mapped) by parsing to 16-bit groups
- Normalize trailing dots on hostnames to prevent FQDN bypasses
- Add assertPublicUrlResolved() with DNS resolution to block wildcard DNS domains resolving to private/metadata IPs
- Add fetchPublic() to safely handle and validate HTTP redirects

2026-09-03 09:22:22 +07:00

..

alibaba-token-plan-provider.test.js

feat(providers): add Alibaba Token Plan (token-plan.ap-southeast-1)

2026-08-14 16:32:54 +07:00

alicode-cache-control-2069.test.js

fix(alicode): preserve cache_control for DashScope providers (#2069)

2026-06-29 15:29:49 +07:00

alicode-intl-endpoint-2591.test.js

fix(alicode-intl): split into Coding Plan + Model Studio providers

2026-07-19 16:29:55 +07:00

antigravity-cache.test.js

…

antigravity-ide-version.test.js

fix(antigravity): preserve client identity on model catalog requests

2026-09-02 20:14:59 +07:00

antigravity-mitm.test.js

…

antigravity-nonstream-usage-3260.test.js

fix(usage): read Gemini usageMetadata out of the antigravity response envelope

2026-08-14 16:34:54 +07:00

antigravity-oauth-client.test.js

…

antigravity-quota-gemini-3.6.test.js

feat(antigravity): show Gemini 3.6 Flash usage bars in quota tracker

2026-08-05 13:21:38 +07:00

antigravity-quota-gemini-3.7.test.js

feat(antigravity): add Gemini 3.7 Flash models (#3286, #3281)

2026-08-14 16:27:10 +07:00

antigravity-quota-gemini-3.8.test.js

feat(antigravity,gemini): add Gemini 3.8 Flash support and bump IDE fingerprint to 2.11.0

2026-09-03 09:13:45 +07:00

antigravity-quota-routing.test.js

feat(antigravity): quota-aware routing with reset-aware fallback

2026-08-27 16:18:08 +07:00

antigravity-retry-hook.test.js

feat(antigravity,gemini): add Gemini 3.8 Flash support and bump IDE fingerprint to 2.11.0

2026-09-03 09:13:45 +07:00

antigravity-stream-options.test.js

fix(antigravity): strip stream_options from non-stream requests

2026-07-29 19:30:44 +07:00

antigravity-usage-headers.test.js

feat(antigravity,gemini): add Gemini 3.8 Flash support and bump IDE fingerprint to 2.11.0

2026-09-03 09:13:45 +07:00

auth-status.test.js

fix(auth): redirect active sessions from /login

2026-08-05 10:27:27 +07:00

background-token-refresh.test.js

feat: Ollama Cloud quota tracker + proactive background OAuth refresh

2026-08-02 09:34:27 +07:00

base-executor-retry.test.js

fix(antigravity): retry transient upstream failures

2026-06-26 17:19:46 +07:00

buildOutputFilter.test.js

…

buildOutputFilterAdversarial.test.js

feat(rtk): add JS-native git-log filter (#2423)

2026-07-07 12:02:56 +07:00

bulk-add-names.test.js

fix(providers): bulk-add API keys no longer overwrite existing keys

2026-07-16 17:20:10 +07:00

cached-token-e2e.test.js

feat(usage): track cached tokens + correct input/output/cache cost (#2209)

2026-07-03 15:18:27 +07:00

cached-token-usage.test.js

fix(usage): preserve nested cached_tokens in canonicalizeUsage

2026-08-28 16:46:05 +07:00

capabilities-opus-context.test.js

feat(kiro): add Claude Opus 5 models

2026-07-29 19:34:14 +07:00

capabilities-service-kind.test.js

fix: show custom vision models in LLM selector and model list

2026-06-18 09:13:27 +07:00

capabilities.test.js

fix(claude): support Fable 5.1

2026-09-02 20:42:53 +07:00

caveman-prompts.test.js

feat(caveman): add targeted upstream-aligned style rules (#2424)

2026-07-07 11:55:45 +07:00

claude-cloaking.test.js

fix(claude): support Fable 5.1

2026-09-02 20:42:53 +07:00

claude-foreign-server-tool-use.test.js

fix(claude): drop server_tool_use blocks carrying a foreign id

2026-09-02 20:07:16 +07:00

claude-header-forwarding.test.js

fix(claude): support Fable 5.1

2026-09-02 20:42:53 +07:00

cli-build-artifacts.test.js

fix(cli): include complete API artifacts in CLI package

2026-08-05 11:54:16 +07:00

cli-xai-video.test.js

feat(xai): add Grok Imagine video generation (/v1/videos) + CLI

2026-07-16 15:29:52 +07:00

codebuddy-cn-bonus-recurring.test.js

fix(codebuddy-cn): show bonus packs as one-time, not monthly-replenishing

2026-06-29 15:22:47 +07:00

codebuddy-reasoning-optin.test.js

fix(codebuddy): only send reasoning params when client requests reasoning

2026-06-26 10:51:16 +07:00

codex-fast-capacity.test.js

feat(codex): support GPT-5.6 Max and Ultra overrides

2026-08-05 11:39:59 +07:00

codex-image-fetch.test.js

Refactor

2026-06-15 18:18:04 +07:00

codex-native-passthrough-thinking.test.js

feat(codex): support GPT-5.6 Max and Ultra overrides

2026-08-05 11:39:59 +07:00

codex-refresh-token.test.js

fix(providers): remove Qwen provider support

2026-08-05 16:17:26 +07:00

codex-reset-credits.test.js

feat(codex): show reset credit expiry details (#2290)

2026-07-03 15:07:45 +07:00

codex-spark-quota-tracking.test.js

feat(usage): track GPT-5.3-Codex-Spark quota windows

2026-08-27 17:56:26 +07:00

codex-tool-normalization.test.js

fix(codex): preserve Responses text format

2026-06-26 10:37:29 +07:00

combo-autoswitch.test.js

Refactor

2026-06-15 18:18:04 +07:00

combo-fusion.test.js

fix(combo/fusion): flatten Anthropic-style tool messages in panel calls

2026-06-20 15:19:31 +07:00

combo-routing.test.js

…

commandcode-executor.test.js

fix(executor): handle CommandCode in-stream errors for combo and account fallback

2026-08-28 16:15:19 +07:00

commandcode-to-openai.test.js

…

compatible-provider-connections.test.js

feat(usage): track cached tokens + correct input/output/cache cost (#2209)

2026-07-03 15:18:27 +07:00

continuity-strip.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

count-tokens.test.js

fix(count_tokens): count structured Anthropic blocks (#2419)

2026-07-07 12:06:09 +07:00

cursor-agent-exec-request.test.js

fix(cursor): stop leaking agent tool errors as text

2026-07-29 19:29:27 +07:00

cursor-agent-proto.test.js

fix(cursor): HTTP/2 AgentService support + version bump to 3.12.17

2026-07-20 15:39:55 +07:00

cursor-composer-thinking.test.js

…

cursor-models.test.js

fix(cursor): HTTP/2 AgentService support + version bump to 3.12.17

2026-07-20 15:39:55 +07:00

custom-server-h2c.test.cjs

fix(server): support IntelliJ IDEA OpenAI clients over HTTP

2026-08-05 10:32:32 +07:00

custom-server-peer-headers.test.js

fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6)

2026-08-14 16:33:58 +07:00

dashboard-guard.test.js

fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6)

2026-08-14 16:33:58 +07:00

db-benchmark.test.js

…

db-concurrent.test.js

…

db-driver-chain.test.js

…

db-migration-chain.test.js

…

db-sqlite-vs-lowdb.test.js

fix(github): label Copilot profiles by account identity (#2498)

2026-07-10 11:29:12 +07:00

deepseek-usage.test.js

feat(usage): add Kimi and DeepSeek usage handlers

2026-07-29 18:09:35 +07:00

devin-cli-executor.test.js

feat(devin-cli): bridge client tools via MCP and use full agent

2026-07-29 18:10:03 +07:00

embedding-usage-persistence.test.js

fix(usage): record exact embedding tokens

2026-07-23 16:07:57 +07:00

embeddings.cloud.test.js

…

embeddingsCore.test.js

…

executor-const-guard.test.js

fix(opencode): route Muse Spark through the Responses API

2026-08-28 11:33:14 +07:00

fetch-success-clears-account.test.js

fix(security): close SSRF guard bypasses in ssrfGuard.js (#3714)

2026-09-03 09:22:22 +07:00

file-block-routing.test.js

Refactor

2026-06-15 18:18:04 +07:00

finish-reason-concern.test.js

…

fish-audio-tts.test.js

feat(tts): add Fish Audio as a text-to-speech provider

2026-08-14 16:21:11 +07:00

force-stream-config.test.js

fix: preserve forced streaming for json clients

2026-06-26 10:37:23 +07:00

fusion-strip-stream-options-3024.test.js

fix: Fusion strip stream_options + reasoning model test probe

2026-08-13 11:56:43 +07:00

gemini-3.7-antigravity.test.js

feat(antigravity): add Gemini 3.7 Flash models (#3286, #3281)

2026-08-14 16:27:10 +07:00

gemini-3.8-antigravity.test.js

feat(antigravity,gemini): add Gemini 3.8 Flash support and bump IDE fingerprint to 2.11.0

2026-09-03 09:13:45 +07:00

gemini-36-integration.test.js

feat(gemini): add Gemini 3.6 Flash tier routing and 3.5 Flash Lite

2026-07-23 16:34:24 +07:00

gemini-37-integration.test.js

feat(antigravity): add Gemini 3.7 Flash tiers to MITM defaultModels

2026-08-28 16:44:07 +07:00

gemini-38-integration.test.js

feat(antigravity,gemini): add Gemini 3.8 Flash support and bump IDE fingerprint to 2.11.0

2026-09-03 09:13:45 +07:00

gemini-native-endpoint.test.js

fix(gemini): support native TTS generateContent endpoint

2026-06-26 10:50:13 +07:00

gemini-tts.test.js

fix(tts): resolve Gemini TTS models from catalog

2026-06-26 10:32:34 +07:00

gemini-usage-projectid.test.js

…

github-monthly-usage-lock.test.js

fix(github): hold monthly-exhausted accounts until reset

2026-08-05 11:00:40 +07:00

github-responses-routing.test.js

…

glm-usage.test.js

fix(usage): support CREDIT_LIMIT and multi-interval GLM quotas

2026-08-28 15:35:23 +07:00

grok-build-config.test.js

feat(cli-tools): configure Grok Build subagent models

2026-07-19 13:35:38 +07:00

grok-cli-executor.test.js

fix(grok-cli): align Grok Build with current subscription protocol (#2590)

2026-07-16 15:33:19 +07:00

grok-cli-expiresat-2546.test.js

fix(grok-cli): surface expiresAt so proactive token refresh fires (#2546)

2026-07-16 12:00:14 +07:00

grok-cli-models.test.js

fix(grok-cli): align Grok Build with current subscription protocol (#2590)

2026-07-16 15:33:19 +07:00

grok-cli-oauth-probe.test.js

feat(grok-cli): add Grok CLI / Grok Build provider with OAuth device-code flow (#2502)

2026-07-10 11:47:08 +07:00

grok-cli-quota-frame.test.js

feat(usage): fetch SuperGrok weekly pool via gRPC-web

2026-07-29 18:09:43 +07:00

grok-cli-usage.test.js

fix(grok-cli): display public subscription tier

2026-08-05 11:43:40 +07:00

groq-usage.test.js

feat(quota): add usage tracking for Groq

2026-09-02 20:04:35 +07:00

headroom-chat-core.test.js

feat(rtk): add X-9Router-Token-Saver header to bypass token savers per request

2026-07-16 11:27:42 +07:00

headroom-detect.test.js

feat(headroom): activate/uninstall extras + fix interpreter detection

2026-07-10 17:32:45 +07:00

headroom-responses-format.test.js

fix(headroom): skip unsafe responses tool history (#2132)

2026-06-29 15:59:21 +07:00

headroom.test.js

feat(headroom): make the compression request timeout configurable

2026-08-28 16:34:33 +07:00

hermes-vision-detection.test.js

fix(combo): detect images from Hermes and attachment payloads for Vision Adapter

2026-08-13 18:30:44 +07:00

hf-model-routing.test.js

…

image-fetch-hardening.test.js

Refactor

2026-06-15 18:18:04 +07:00

image-generation.test.js

…

jina-reader-fetch.test.js

fix(jina-reader): recover after transient errors and use JSON POST API

2026-07-23 16:28:37 +07:00

kimchi-strip-reasoning.test.js

fix(kimchi): strip reasoning_content echo to bound multi-turn input tokens

2026-07-03 10:58:31 +07:00

kimchi.test.js

fix: prevent non-SSE stream pipe crash and cross-IdP account overwrites (#2244)

2026-07-03 11:11:07 +07:00

kimi-usage.test.js

chore: drop source-attribution comments from provider code

2026-07-29 21:05:23 +07:00

kiro-api-key-endpoint-routing.test.js

fix(kiro): canonicalize tool history and route API keys correctly

2026-07-29 19:27:41 +07:00

kiro-conversation-canonicalization.test.js

fix(kiro): canonicalize tool history and route API keys correctly

2026-07-29 19:27:41 +07:00

kiro-external-idp.test.js

feat(kiro): add external_idp CLIProxyAPI import for Microsoft SSO

2026-06-26 11:42:05 +07:00

kiro-image-forwarding.test.js

fix(kiro): preserve inline images in OpenAI MITM

2026-09-03 09:21:37 +07:00

kiro-model-slots.test.js

fix(kiro): intercept chat via x-amz-target and prepend initial-response frame

2026-08-13 11:56:31 +07:00

kiro-nonstream-error.test.js

fix(kiro): validate terminal streams before emitting output

2026-07-20 10:55:33 +07:00

kiro-profile-arn.test.js

fix(kiro): canonicalize tool history and route API keys correctly

2026-07-29 19:27:41 +07:00

kiro-terminal-integrity.test.js

fix(kiro): validate terminal streams before emitting output

2026-07-20 10:55:33 +07:00

kiro-thinking-strip.test.js

fix(kiro): validate terminal streams before emitting output

2026-07-20 10:55:33 +07:00

kiro-usage-and-tool-integrity.test.js

fix(kiro): report real output tokens and stop discarding usable turns

2026-08-13 11:33:41 +07:00

local-request-peer-trust-3294.test.js

fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6)

2026-08-14 16:33:58 +07:00

mimo-free.live.test.js

fix(mimo-free): add Chrome User-Agent rotation to bypass anti-abuse gate

2026-06-21 16:51:47 +07:00

mimo-free.test.js

…

minimax-transport-target-format.test.js

fix(minimax): preserve images on matched OpenAI transport

2026-08-28 16:34:05 +07:00

minimax-tts.test.js

…

minimax-usage.test.js

…

minimax-voices.test.js

…

mitm-root-ca.test.js

fix(mitm): generate root ca on server startup (#2228)

2026-07-01 09:30:52 +07:00

modality-strip.test.js

Refactor

2026-06-15 18:18:04 +07:00

model-context-marker.test.js

fix: strip the [1m] context marker Claude Code appends to the model name

2026-09-02 20:20:32 +07:00

model-name-regex.test.js

fix(kiro): deliver system prompt natively, add Opus 4.5/4.7/4.8, tolerate dash version ids (#2366)

2026-07-05 17:34:04 +07:00

model-routing.test.js

fix(image): prevent compatible nodes from shadowing provider aliases

2026-06-18 09:10:52 +07:00

model-test-routing.test.js

…

multimodal-drop-lock.test.js

…

oauth-cursor-auto-import.test.js

…

ollama-stream-tail.test.js

fix(stream): parse the trailing NDJSON line an Ollama stream leaves behind

2026-08-27 20:53:02 +07:00

ollama-usage.test.js

feat: Ollama Cloud quota tracker + proactive background OAuth refresh

2026-08-02 09:34:27 +07:00

open-package-external.test.js

fix(oauth): keep open external so xAI/Grok token refresh works on Windows

2026-08-05 10:38:25 +07:00

openai-compatible-apitype-resolution.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

openai-responses-custom-tools.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

openai-responses-empty-toolcalls.test.js

fix(responses): don't close message on empty tool_calls array

2026-08-13 11:40:45 +07:00

openai-responses-multiturn.test.js

fix(grok-cli): align Grok Build with current subscription protocol (#2590)

2026-07-16 15:33:19 +07:00

openai-responses-nonstream.test.js

fix(translator): preserve Responses Lite tools across Chat providers

2026-08-05 13:27:25 +07:00

openai-responses-terminal-event.test.js

fix(responses): handle response.done terminal events (#2142)

2026-06-29 16:05:29 +07:00

openai-to-claude-response-tools.test.js

…

openai-to-claude-tools-no-type.test.js

fix(openai-to-claude): unwrap bare {function:{…}} tools without parent type (#2473)

2026-07-10 11:11:37 +07:00

openai-to-claude.test.js

…

openai-to-commandcode.test.js

…

openai-to-kiro.test.js

fix(kiro): normalize dashboard thinking intensity models

2026-07-23 16:27:06 +07:00

openai-to-ollama-malformed.test.js

…

opencode-go-models.test.js

feat(models): add GLM-5.3-Flash, DeepSeek V4 Vision, Grok 4.5/4.6

2026-08-27 17:52:01 +07:00

opencode-muse-spark-thinking.test.js

fix(opencode): route Muse Spark through the Responses API

2026-08-28 11:33:14 +07:00

param-support.test.js

fix(volcengine-ark): clamp GLM-5 max_tokens to model output ceiling (#2428)

2026-07-07 11:57:04 +07:00

perplexity-web.test.js

…

ping-reasoning-models-3010.test.js

fix: Fusion strip stream_options + reasoning model test probe

2026-08-13 11:56:43 +07:00

prefetch-images.test.js

Refactor

2026-06-15 18:18:04 +07:00

provider-custom-models.test.js

fix(models): store provider custom models by provider scope

2026-06-20 15:19:22 +07:00

provider-display-split.test.js

fix(cloudflare-ai): declare API key authentication

2026-08-05 13:13:54 +07:00

provider-models-minimax-m3.test.js

…

provider-pricing-minimax-m3.test.js

…

provider-quota-visibility.test.js

feat: add provider quota visibility settings

2026-07-04 23:26:49 +07:00

provider-test-models-routing.test.js

…

provider-thinking-config.test.js

fix(reasoning): preserve effort through Codex translations

2026-06-26 12:06:35 +07:00

provider-validation.test.js

…

pxpipe.test.js

feat(pxpipe): PXPIPE token saver — multimodal prompt compression (#2465)

2026-07-10 16:10:42 +07:00

qoder-billing.test.js

fix(qoder): detect billing blocks at stream start, return 403 for failover

2026-08-13 11:43:11 +07:00

qoder.test.js

fix(qoder): detect billing blocks at stream start, return 403 for failover

2026-08-13 11:43:11 +07:00

quota-auto-ping.test.js

perf(startup): skip inactive background services

2026-07-16 12:09:48 +07:00

reasoningContentInjector.test.js

…

request-details-redaction.test.js

fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction

2026-08-13 11:50:25 +07:00

request-details-tab.test.js

fix: DB backup on schema change, MCP child cleanup, codex models, usage providers OOM

2026-07-10 13:08:58 +07:00

responses-abort-terminal.test.js

…

responses-prompt-cache-key-3216.test.js

fix(translator): preserve prompt_cache_key when converting chat to responses

2026-08-13 11:46:49 +07:00

rtk.e2e.test.js

…

rtk.multi-provider.e2e.test.js

…

rtk.test.js

feat(rtk): add JS-native git-log filter (#2423)

2026-07-07 12:02:56 +07:00

rtkFindWindows.test.js

fix(rtk/find): detect and group Windows backslash-style find output (#2448)

2026-07-09 15:12:52 +07:00

rtkKiro.test.js

…

saml.test.js

feat(auth): add native SAML 2.0 SSO integration

2026-08-13 17:56:34 +07:00

search-ssrf-guard.test.js

fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction

2026-08-13 11:50:25 +07:00

searxng-provider-config.test.js

feat(searxng): configure endpoint via SEARXNG_URL env (#2499)

2026-07-10 11:29:06 +07:00

security-audit.test.js

fix(security): patch 5 vulnerabilities from security audit

2026-06-26 11:04:51 +07:00

session-manager.test.js

fix(kiro): improve direct session cache reuse

2026-07-16 15:15:05 +07:00

ssrf-guard-hardening.test.js

fix(security): close SSRF guard bypasses in ssrfGuard.js (#3714)

2026-09-03 09:22:22 +07:00

standalone-assets.test.js

fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6)

2026-08-14 16:33:58 +07:00

system-inject.test.js

fix(rtk): make system prompt injection format-safe and idempotent

2026-08-28 11:47:56 +07:00

thinking-effort-openai-max-clamp.test.js

fix(translator): clamp thinking effort max->xhigh for OpenAI format (#2466)

2026-07-09 15:13:24 +07:00

thinking-levels-gpt56-sol.test.js

feat(codex): support GPT-5.6 Max and Ultra overrides

2026-08-05 11:39:59 +07:00

thinking-levels-kiro.test.js

fix(kiro): normalize dashboard thinking intensity models

2026-07-23 16:27:06 +07:00

token-refresh-dispatch.test.js

…

token-refresh-generic.test.js

fix(oauth): refresh Cline tokens with extension JSON contract

2026-08-28 16:58:27 +07:00

translator-custom-prefix.test.js

fix(translator): resolve custom provider prefix in debug endpoint

2026-06-26 17:22:02 +07:00

translator-helpers-edge.test.js

…

translator-request-normalization.test.js

…

tunnel-pid-ownership.test.js

fix(tunnel): preserve successor cloudflared PID

2026-07-23 16:22:47 +07:00

usage-concern.test.js

…

usage-dispatch.test.js

feat(usage): show Zed plan quota on the dashboard

2026-08-28 16:16:01 +07:00

venice-provider.test.js

feat(providers): add Venice AI provider

2026-06-26 11:37:44 +07:00

web-cookie-validation.test.js

…

windsurf-executor.test.js

feat(oauth): zed/trae/windsurf providers + harden callback proxies

2026-07-25 17:25:19 +07:00

xai-oauth-service.test.js

…

xai-tokenRefresh.test.js

…

xai-video-core.test.js

feat(xai): add Grok Imagine video generation (/v1/videos) + CLI

2026-07-16 15:29:52 +07:00

xai-video-handler.test.js

feat(xai): add Grok Imagine video generation (/v1/videos) + CLI

2026-07-16 15:29:52 +07:00

xiaomi-mimo-tts.test.js

feat(tts): add Xiaomi MiMo text-to-speech support

2026-08-05 11:46:23 +07:00

xquik-search-provider.test.js

feat(search): add Xquik as an X search provider

2026-08-27 16:10:00 +07:00

zed-usage.test.js

feat(usage): show Zed plan quota on the dashboard

2026-08-28 16:16:01 +07:00