24 Commits

Include renames

Author	SHA1	Message	Date
JATMN	70d97fd137	feat(web-search): add Ollama backend (#2234) ... * feat(web-search): add Ollama backend * fix(web-search): harden Ollama routing * fix(web-search): preserve Ollama profile identity * fix(web-search): align Ollama diagnostics * fix(web-search): align Ollama endpoint diagnostics * fix(web-search): honor Ollama endpoint aliases * fix(web-search): reject Ollama key placeholders * fix(web-search): complete Ollama configuration guidance	2026-09-21 09:10:23 +08:00
JATMNandClaude	a32781537f	fix(query): bound per-turn latency growth in long REPL sessions (#1949) (#1952) ... * fix(query): bound per-turn latency growth in long REPL sessions (#1949) Addresses the progressive latency regression where consecutive prompts in a single session grow non-linearly (2nd prompt ~10s, 3rd 10+ min) due to unbounded message accumulation with no proactive compaction and no per-prompt turn cap on the main thread. - Cap the interactive REPL main thread at 50 turns per prompt (DEFAULT_REPL_MAX_TURNS). Headless/print mode and the SDK are unchanged (--max-turns flag / SDK callers still control it), preserving the SDK API contract. - Default maxMessagesCompactionThreshold to '200' so message-count compaction runs well before the context window fills, instead of 'off'. - Lower the auto-compact threshold buffer from 13k -> 30k so compaction fires earlier with less accumulated history. The effective-context floor buffer is kept at 13k and getAutoCompactThreshold() falls back to it for small-context models, so the threshold can never go negative (no #635 regression). Test updates: isolate the hard-cap override test from the new 200-message default, and correct an outdated constant reference in the autoCompact test. Co-Authored-By: Claude <noreply@anthropic.com> * fix(query): repair REPL latency guard * fix(query): cover resume and default guard paths * fix(query): enforce cap across interactive paths * docs(compaction): clarify disabled message limits * fix(query): retain explicit message thresholds * fix(query): enforce explicit threshold recovery * fix(query): honor legacy active-message limit * fix(doctor): report effective message compaction limit * fix(config): share message threshold validation * test(doctor): cover disabled message compaction * fix(compact): preserve latency guard coverage * test(repl): exercise turn cap defaults * fix(compact): honor disabled default message guard * fix(swarm): honor disabled auto compaction --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-07-15 23:06:53 +08:00
Bogdan	e204d5ad36	feat(doctor): add WebSearch backend diagnostics (#1884) ... * feat(doctor): add WebSearch backend diagnostics * fix(doctor): tighten Firecrawl cloud URL diagnostics * fix(firecrawl): align cloud URL detection * test(websearch): stabilize Brave timeout assertion * fix(firecrawl): handle bare cloud host casing * fix(doctor): align WebSearch auto diagnostics with fallback * fix(doctor): align custom preset diagnostics	2026-07-08 08:42:34 +08:00
5 people	aa936cda11	Centralize credential redaction in src/utils/redaction.ts + channel gate tests (#1711) ... * feat(utils): add centralized redaction utility Single source of truth for stripping API keys, tokens, and other secrets from strings and JSON. Provider env-var coverage is generated from getKnownProviderSecretEnvKeys() so adding a new provider cannot silently create an unredacted path. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor(Feedback): import redactSensitiveInfo from utils Remove the inline 40-line regex implementation in favor of the centralized redaction utility, eliminating drift between Feedback and the transcript share path. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor(submitTranscriptShare): import redactSensitiveInfo from utils Update import path to point at the centralized utility instead of the Feedback component. Removes the implicit re-export contract that required Feedback.tsx to keep redactSensitiveInfo exported. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(log,debug): redact secrets in default error and debug output Wire the centralized redaction utility into logError and logForDebugging so secrets cannot leak into in-memory error logs or the debug file even if a caller forgets to pass through redactSensitiveInfo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(api/logging): redact error message in logAPIError Apply the centralized redaction utility to the error string passed to logEvent so analytics events cannot capture unredacted credentials from upstream API failures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve merge conflict from upstream sync Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(channelNotification): allow null in getEffectiveChannelAllowlist signature ChannelsNotice.tsx passes getSubscriptionType() which returns SubscriptionType | null, but the signature only accepted string | undefined. Widen to string | null so the call site typechecks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(redaction): exclude specific token fields from redaction process * fix(redaction): lower AIza minimum length to {10,} Real GCP/Gemini keys are 39 chars total (4 prefix + 35 suffix), but the {35} suffix bound missed short tokens like 'AIzaSyDUMMY-secret-token' (21 chars after AIza). Lower to {10,} to match the diagnostics module and catch any AIza-shaped value. Same precision trade-off the diagnostics redaction makes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(redaction,log): address review feedback - Drop quotes from ANTHROPIC/OPENAI key negative lookarounds so JSON-shaped values like "sk-ant-..." redact. - Add private_key pattern to GENERIC_HEADER_FIELD_PATTERN and privatekey to SENSITIVE_FIELD_SUBSTRINGS. - logError now builds a sanitized Error (redacted message + stack) before passing to the sink and queue, not just the in-memory log. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor(redaction): consolidate into single module + add channel gate tests Address the three P2 review findings on the central-redaction PR: [1] Consolidate four redaction modules into src/utils/redaction.ts. Previously lived in: - src/utils/redaction.ts (logs/bug reports/transcript shares) - src/utils/urlRedaction.ts (URL display) - src/utils/statusRedaction.ts (/status output) - src/utils/diagnostics/redaction.ts (doctor reports) The four surfaces share the same regex set / credential lists but had drifted into separate per-domain files. Merged into one module; deleted the three shim files. Updated six direct consumers (openaiShim.ts, ProviderManager.tsx, status.tsx, requestSizeBreakdown.ts, diagnostics/issueReport.ts, scripts/system-check.ts) and three test files to import from redaction.js. [2] Add gateChannelServer() test coverage. src/services/mcp/channelNotification.test.ts: 13 cases for the six gate paths (capability, runtime, session, marketplace, plugin allowlist, server-entry dev) plus end-to-end register. Mocks channelAllowlist.js (GrowthBook-backed) so tests stay independent of feature-flag state. [3] Apply jsonRedactor in transcript share. src/components/FeedbackSurvey/submitTranscriptShare.ts now does redactSensitiveInfo(jsonStringify(data, jsonRedactor)) — the key-aware redaction applies during serialization, and the text pass stays as defense in depth for free-form fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test(channelNotification): cover findChannelEntry multi-candidate branch Regression test for the disambiguation path in `findChannelEntry` (channelNotification.ts:201-230): when two same-name plugin entries exist in the allowed-channels list with different marketplaces, `pluginSource` must select the matching entry before the marketplace and allowlist gates evaluate. Without this branch being exercised, the gate could lock onto whichever entry sorts first and either skip the user's real installation or wrongly authorize a typo-squatted one. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(redaction): align URL fallback regex + add path-prefix boundary check Two related redaction correctness fixes: [1] URL fallback regex covers the same parameter set as the primary path. The malformed-URL branch in `redactUrlForDisplay` previously had a hand-rolled alternation of credential parameter names that could drift behind `SENSITIVE_URL_QUERY_PARAM_TOKENS`. New `MALFORMED_URL_PARAM_PATTERN` derives from that same list, so the two paths can never diverge. Tests cover the full credential set (`api_key`, `access_token`, `refresh_token`, `signature`, `sig`, `secret`, `password`, `apikey`) plus a non-sensitive `model` that must survive. [2] `redactPathForStatus` now requires a path-separator boundary after the home prefix. The previous `startsWith` check matched `/home/alice2/project` against `/home/alice` and emitted `~2/project`. The fix requires the character at `normalizedCandidate.length` to be `/` or `\` so `alice` no longer matches `alice2` or `alice.bak`. Test pins the false-positive paths and the true-positive (`/home/alice/project` → `~/project`). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(channel,redaction): restore dev-channel warning + align URL fallback Two related security fixes: [1] Restore DevChannelsDialog when --dangerously-load-development-channels is passed and the channels feature is enabled. The previous logic skipped the dialog when OAuth was absent, which was safe only while gateChannelServer() blocked no-OAuth sessions. With the OAuth/org- policy gates removed in this PR, an API-key session could pass the flag, skip the warning, and still register the dev channel. The only remaining skip is the genuinely-disabled feature case (`!isChannelsEnabled()`), where the dialog is moot. [2] Malformed-URL fallback now uses the same substring predicate as the primary `URL` parser path. The previous regex matched only exact parameter names (`api_key=`, `access_token=`, …), so `my_api_key=SECRET` and `x_access_token=TOKEN` slipped through unchanged even though `shouldRedactUrlQueryParam` flags them as sensitive. New `redactMalformedQuery` walks the query pairs and runs the predicate on each key. Three new tests cover prefixed keys, non-sensitive keys, and fragment preservation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(redaction): widen key boundary class + tighten dev-channel comment Two small follow-ups from the latest CodeRabbit review: [1] Boundary class on key-prefix patterns widened from `[A-Za-z0-9]` to `[A-Za-z0-9_-]` so a raw key embedded in a JSON string value (`"sk-ant-..."`, `"AIza..."`, `"ghp_..."`, etc.) is still caught. Quotes act as delimiters, not blockers — the previous boundary class was correct for unquoted text but let quoted keys slip through. [2] Tighten the dev-channel dialog comment in interactiveHelpers.tsx so future readers don't misread the security boundary. Skip condition is `isChannelsEnabled()` (the channels feature flag gate), not KAIROS / KAIROS_CHANNELS as the previous wording implied. Comment now matches the code. Skipped with reason: - getEffectiveChannelAllowlist divergence from gateChannelServer allowlist — by design; the effective-list override is a UI hint consumed only by ChannelsNotice for the org-override indicator. Trust boundary is enforced by gateChannelServer() reading the hardcoded ledger. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(redaction,channel): address P1/P2 review findings P1 - malformed URL fallback secrets: - Decode percent-encoded query param keys via decodeURIComponent() before applying shouldRedactUrlQueryParam (e.g. %74oken -> token) - Stop userinfo regex at ? and # delimiters to avoid consuming query params when matching @ signs in email addresses or fragment delimiters P2 - channel notice/gate allowlist sync: - Remove org override path from getEffectiveChannelAllowlist() so ChannelsNotice startup guidance uses the same ledger source as gateChannelServer's runtime enforcement - Simplify ChannelsNotice to drop unused sub/policy params and the source === 'org' conditional * fix(channel): apply marketplace matching to permission relays, remove stale OAuth/org-policy blockers, add dev-channel dialog coverage P1: Thread runtime pluginSource through filterPermissionRelayClients so findChannelEntry disambiguates same-name plugin entries from different marketplaces before sending permission request previews. P2: Remove stale noAuth and policyBlocked branches from ChannelsNotice that would render '--channels ignored' before reaching the listening message, confusing non-OAuth users. P2: Add test coverage that mocks isChannelsEnabled() both true and false, verifies DevChannelsDialog appears with onAccept marking entries dev:true in the enabled case, and verifies the disabled branch registers entries directly without dialog. * test(dev-channel): clarify count assertion comment + add afterEach with mock.restore() * fix(channel): mirror marketplace gate in permission relay + restore mock Two follow-ups from the latest review: [1] Permission relay predicate no longer relies on findChannelEntry alone. After resolving the entry, the predicate now requires a runtime pluginSource whose marketplace matches the session entry's marketplace for plugin-kind entries — mirroring the gateChannelServer check at channelNotification.ts:303-312. A `plugin:slack@evilcorp` client whose session allows `plugin:slack@anthropic` is now rejected instead of piggy-backing on the approved entry to receive permission-request previews. Server-kind entries still match on bare name. [2] bugfixes.test.ts now re-registers the real channelAllowlist module in afterEach via a cache-busted reference, so the neighbor channelNotification.test.ts continues to import getChannelAllowlist after this suite runs. mock.restore() does not clear module-level mock.module() overrides in bun (the registry is process-global). Pattern matches compact.test.ts:27-36. Also expanded the dev-map count comment in bugfixes.test.ts to document the security invariant (a dev entry must never be confused with a production entry in the allowlist check) per CodeRabbit's request. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor(redaction): consolidate into single module + add channel gate tests Address the three P2 review findings on the central-redaction PR: [1] Consolidate four redaction modules into src/utils/redaction.ts. Previously lived in: - src/utils/redaction.ts (logs/bug reports/transcript shares) - src/utils/urlRedaction.ts (URL display) - src/utils/statusRedaction.ts (/status output) - src/utils/diagnostics/redaction.ts (doctor reports) The four surfaces share the same regex set / credential lists but had drifted into separate per-domain files. Merged into one module; deleted the three shim files. Updated six direct consumers (openaiShim.ts, ProviderManager.tsx, status.tsx, requestSizeBreakdown.ts, diagnostics/issueReport.ts, scripts/system-check.ts) and three test files to import from redaction.js. [2] Add gateChannelServer() test coverage. src/services/mcp/channelNotification.test.ts: 13 cases for the six gate paths (capability, runtime, session, marketplace, plugin allowlist, server-entry dev) plus end-to-end register. Mocks channelAllowlist.js (GrowthBook-backed) so tests stay independent of feature-flag state. [3] Apply jsonRedactor in transcript share. src/components/FeedbackSurvey/submitTranscriptShare.ts now does redactSensitiveInfo(jsonStringify(data, jsonRedactor)) — the key-aware redaction applies during serialization, and the text pass stays as defense in depth for free-form fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(test): align malformed URL fragment expectation with preservation behavior * fix: address review findings P1 and P2 [P1] Enforce dev flag for server-kind entries in permission relay predicate, matching gateChannelServer() behavior. Add coverage for both dev and non-dev server relay paths. [P2] Drop fragments in malformed URL fallback (redactMalformedQuery) to match the valid-URL path, preventing credential leaks via fragment-carried tokens. Update existing tests and add regression for fragment-only malformed URLs. * test(relay): add plugin-kind marketplace regression tests * fix: address review findings P1 and P2 [P1] Add PEM private key redaction pattern to redactSensitiveInfo so multi-line PEM values are fully consumed instead of leaking after the first whitespace. Add [ to generic header pattern's value exclusion set to prevent re-consuming [REDACTED] tokens. [P2] Use truthy check (Boolean()) for claude/channel capability in filterPermissionRelayClients to match gateChannelServer's behavior, rejecting explicit false capabilities. * fix(debug): redact before JSON-stringify multiline messages Reorder logForDebugging so redactSensitiveInfo runs before jsonStringify, ensuring PEM/private-key patterns match the raw (unescaped) message text rather than the JSON-encoded form where colons and quotes are escaped. * test(debug): add end-to-end regression for multiline PEM redaction in logForDebugging Uses mock.module on process.js to capture stderr output and exercises the full logForDebugging path with multiline PEM private_key input, verifying the redact-before-JSON-stringify ordering produces redacted output. * fix(test): preserve original process.env.DEBUG and process.argv in logForDebugging test hooks * fix: address PR review findings P1-P3/P5-P7 - P1: clear isDebugMode/isDebugToStdErr memoize caches in test beforeEach + cache-busting query param for fresh debug.ts imports - P2: restore mock.module afterAll instead of leaking mock + mutate err in-place in logError to preserve name/cause - P3: post-processing regex absorbs trailing bracket content after [REDACTED] - P5: (was P3) expand jsonRedactor EXCLUDED_KEYS for maxTokens etc. - P7: capture HOME/USERPROFILE per-test instead of at module scope * fix: address CodeRabbit review findings - interactiveHelpers.tsx: update dev-channel comment — OAuth/org-policy gates removed from gateChannelServer(), org policy is not enforced - channelNotification.test.ts: add afterAll mock.restore() to clean up process-global channelAllowlist.js mock - channelNotification.ts: fix comments — isChannelsEnabled() still reads tengu_harbor, not always true - log.ts: sanitize err.message and err.stack separately so message doesn't get replaced with full stack trace - redaction.ts: add 'i' flag to redactHomePath regex for Windows case-insensitive path matching * fix: address second review round - interactiveHandler.ts: [P2] redact input_preview via redactSensitiveInfo before sending to channel servers - log.ts: [P3] copy error via Object.assign(Object.create(err), err) before sanitizing instead of mutating in-place * fix: address CodeRabbit second round - channelPermissions.ts: redact before truncate in truncateForPreview so partial credentials don't leak at the 200-char boundary - interactiveHandler.ts: remove outer redactSensitiveInfo — now handled inside truncateForPreview - log.ts: derive errorInfo.error from already-sanitized sanitizedErr; fix Object.assign comment to accurately describe what is copies * fix: improve permission relay client filtering and enhance redaction functions * fix: address third review round (P1, P2, P3) - P1: update test expectations for [REDACTED_*] output format - P2: add total_tokens, prompt_tokens, completion_tokens to jsonRedactor EXCLUDED_KEYS - P3: remove ) and } from GENERIC_HEADER_FIELD_PATTERN value capture to prevent content leak after embedded parens - Fix buildKnownEnvVarPattern capture group to preserve env-var separator ([REDACTED]) - Add & to GENERIC_CREDENTIAL_ENV_PATTERN value exclusion to prevent URL query over-consumption * fix: address latest reviewer P2/P3 findings (errorLogSink redaction, X_API_KEY/AUTHORIZATION patterns, regression tests) * fix: address reviewer P1/P2 — bracketed values and multi-word header values - P1: Remove and from value captures in X_API_KEY_PATTERN, AUTHORIZATION_PATTERN, GENERIC_HEADER_FIELD_PATTERN, GENERIC_CREDENTIAL_ENV_PATTERN so bracketed secrets like are fully redacted instead of passing through unchanged. - P2: Widen header-style value captures to include spaces by removing from exclusions, using as delimiter (stops at newlines and URL query separators). Fixes multi-word leaks: , , , . - GENERIC_CREDENTIAL_ENV_PATTERN: add to negative lookbehind to prevent matching inside when the latter is already redacted. - GENERIC_HEADER_FIELD_PATTERN replacer: skip values starting with to preserve specific labels from earlier passes. - Add 7 regression tests covering both finding categories. * fix: address reviewer findings P1-P4 P1: Custom enumerable error properties now redacted in log.ts logError iterates all own enumerable properties on the original error and applies redactSensitiveInfo to string values and jsonRedactor to object values, preventing credential-bearing custom fields from leaking through the sanitized error. Regression tests added in log.test.ts. P2: Soften single-source-of-truth claim; migrate easy call sites Header comment in redaction.ts updated to acknowledge that specialized scanners (secretScanner.ts, xaa.ts) are intentional exceptions. src/services/mcp/client.ts and src/services/mcp/auth.ts now use jsonRedactor for header redaction instead of ad-hoc key checks. P3: Fix mock.restore cleanup in channelNotification.test.ts Cache-bust the real channelAllowlist module at describe-entry and re-register it in afterAll, following the pattern from bugfixes.test.ts. mock.restore alone does not clear mock.module overrides in Bun. P4: Remove unused ChannelGateResult kinds Removed 'auth' and 'policy' from the skip kind union and removed corresponding dead branches in useManageMCPConnections.ts. * fix: extract sanitizeError() to fix CI test fragility The logError tests were failing in CI due to parallel test execution racing on the module-level errorLogSink singleton. Extract the inline sanitization logic into an exported sanitizeError() helper and test that directly — it's pure, has no env-var or sink dependencies, and doesn't interact with shared mutable state. * fix: use Object.getPrototypeOf(err) instead of err as prototype in sanitizeError Object.create(err) sets the original error instance as the prototype of the sanitized copy, leaking non-enumerable own properties through the prototype chain. Use Object.getPrototypeOf(err) instead so the prototype is the error constructor's prototype (e.g. TypeError.prototype), preserving instanceof checks without exposing the original error's non-enumerable fields. Add a regression test verifying non-enumerable properties do not leak and update the prototype-chain test to assert Object.getPrototypeOf result. * fix: apply key-aware redaction and fail closed on non-serializable error props - String properties: use jsonRedactor(key, value) instead of redactSensitiveInfo(value) so keys like apiKey with innocuous values (e.g. 'my-key') are still caught via SENSITIVE_FIELD_SUBSTRINGS. - Object path: catch now replaces non-serializable/circular references with '[REDACTED]' instead of leaving the original object reference. - Add 2 regression tests for key-aware redaction and fail-closed behavior. * Update src/utils/log.ts Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: redact bare auth header keys in JSON/header objects - Add 'auth' to SENSITIVE_FIELD_SUBSTRINGS in src/utils/redaction.ts:109 to match URL/diagnostic redactors treatment of auth - Add regression test for bare auth header keys in src/utils/diagnostics/redaction.test.ts:88 Co-authored-by: openhands <openhands@all-hands.dev> * fix: narrow auth matching, redact nested transcript JSONL, fix channel skip message * fix: address CodeRabbit nits — comment, hint, JSONL fallback redaction * fix: key-aware malformed JSONL fallback and auth/x-auth in free-form text * fix: strengthen redactJsonLines trailing rest redaction and auth test assertions * fix: preserve non-JSON prefix in redactJsonLines fallback and redact it * fix: tighten redactJsonLines prefix test to exact output assertion * fix: redact MCP log sink payloads and errorStr before writing to disk * fix: address P1 findings — URL #-in-password, ;-delimited query params, split channel trust-boundary - Allow in URL userinfo password on malformed-URL fallback path (new URL() fails when password contains fragment delimiter). - Redact -delimited sensitive query params by splitting on both & and ; in redactMalformedQuery, plus redactSemicolonQueryParams post-processor for valid-URL output. - Restore channelNotification.ts to upstream/main to fully split OAuth/org-policy trust-boundary changes from credential redaction PR. * fix: update callers to match upstream/main function signatures channelNotification.ts was restored to upstream/main to split trust-boundary changes from the redaction PR. This commit updates the three caller sites that previously passed extra arguments: - ChannelsNotice.tsx: pass getSubscriptionType() + undefined to getEffectiveChannelAllowlist (needs 2 args upstream) - interactiveHandler.ts, channelNotification.test.ts: drop 3rd pluginSource arg from findChannelEntry (takes 2 args upstream) * fix: address reviewer findings — OAuth mock, notice states, marketplace disambiguation P1: Mock getClaudeAIOAuthTokens and getSubscriptionType in channel notification tests so they pass on CI where no real OAuth exists. P2: Restore blocked-auth/org-policy notice states in ChannelsNotice.tsx so the UI shows the correct blocker when gateChannelServer rejects unauthenticated users or orgs without channelsEnabled. P2: Add pluginSource disambiguation to findChannelEntry so same-name plugin entries from different marketplaces are matched by runtime source rather than first-match order. Add regression test with non-matching marketplace first to cover the bug. * fix: address reviewer findings — relay gate parity and allowlist regression test - Replace filterPermissionRelayClients in interactiveHandler with inline gateChannelServer call so the relay predicate checks ALL gates including disabled-channel, auth, org policy, and approved-plugin allowlist, not just session entry + marketplace. - Clean up unused imports (getAllowedChannels, parsePluginIdentifier, findChannelEntry, filterPermissionRelayClients). - Add regression test: gateChannelServer rejects marketplace-matched plugin not on approved allowlist (full-gate path). * fix: redact mixed semicolon secrets in valid-URL path and route OpenAI shim through centralized redactor P1: Pre-redact semicolon-delimited sensitive query params from the raw query string in redactUrlForDisplay BEFORE URLSearchParams encodes ; as %3B. Previously model=ok;token=SECRET leaked because parsed.toString() reserialized to model=ok%3Btoken%3DSECRET, making it invisible to the post-process pass. P1: Route openaiShim's redactUrlForDiagnostics through the centralized redactUrlForDisplay so the semicolon fix, malformed-URL fallback, and all future redaction improvements apply to OpenAI-compatible diagnostic logs too. Keep redactSecretValueForDisplay as an additional safety net after the centralized pass. Add 3 regression tests for mixed-separator queries. * Update src/utils/redaction.ts Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: add fragment-query credential regression test and correct dev-channel gate comments P2: Add regression test for redactUrlForDisplay with query-like credential in fragment (e.g. #debug?token=SECRET). Fix raw-query pre-processing to only extract query before the first #, preventing fragment content from being treated as query parameters. P3: Update comments in interactiveHelpers.tsx to match the actual gate order — OAuth and org-policy gates still exist in gateChannelServer() after restoring to upstream/main; the --dangerously-load-development- channels flag only bypasses the allowlist gate. * fix: add port+fragment+@ fallback test and restructure dev-channels dialog tests * fix: registerDevChannels seam, bare-host #-in-password heuristic, and coverage restructure * fix: add OAuth and org-policy gate test coverage - Refactor auth module mock to use mutable variables per test - Auth gate test: empty OAuth tokens -> kind:auth - Policy gate test: team subscription without channelsEnabled -> kind:policy * fix: prefer exact server channel entries before plugin disambiguation - Return exact server-kind candidate first when candidates include both server and plugin entries with same name - Added regression test covering mixed server/plugin --channels entries to ensure exact server opt-in is not overridden by plugin candidate - This prevents a plugin marketplace mismatch from incorrectly rejecting a server the user explicitly selected via server:plugin:slack * fix: only trust exact [REDACTED] placeholder in generic header field pattern - Changed GENERIC_HEADER_FIELD_PATTERN to only bypass exact '[REDACTED]' canonical placeholder - Prevents non-canonical placeholders like '[REDACTED_API_KEY]' or '[REDACTED_actual_secret]' from leaking through - Updated tests to expect canonical '[REDACTED]' output for generic pattern * fix: handle bare hosts in malformed URL userinfo fallback - Added regex to recognize bare hostnames (with optional port) in the fragment heuristic - Added tests for //alice:sec#ret@host and //alice:sec#ret@host:443 * fix: add relay dispatch path test for non-allowlisted plugin - Added test using full gateChannelServer predicate in filterPermissionRelayClients - Mirrors the exact relay dispatch path used in interactiveHandler - Ensures marketplace-matched plugin not on allowlist is excluded from permission preview * fix: enhance URL redaction logic to handle valid hosts before fragment * fix: refine URL redaction logic to ensure valid host checks before fragment * fix: enhance redaction logic to handle embedded URLs in free-form text * fix: update redaction logic to remove user info from OpenAI base URL in diagnostic report * fix: ensure findChannelEntry returns undefined when no exact matches are found * fix: improve URL redaction logic to remove user info and ensure proper formatting * fix: enhance redactDiagnosticUrl to preserve query-param values and trailing slashes * fix: refine redaction logic to preserve meaningful path segments and handle trailing slashes correctly * fix: enhance redactDiagnosticUrl to preserve literal path segments and handle trailing slashes correctly * fix: preserve semicolon-delimited query params during redaction * fix: update redaction logic to support semicolon-delimited query parameters * fix: enhance redactUrlForDisplay to handle bare hosts and improve fragment redaction * fix: enhance redactUrlForDisplay to correctly handle username-only userinfo with fragments * fix: address privacy findings — URL redaction in jsonRedactor, base URL redaction, diagnostic object collapsing, structural channel previews, pluginSource telemetry * fix: preserve falsey env-presence values in diagnostic redaction - false, "", and 0 under isEnvPresenceKey keys are now preserved as-is instead of misrepresented as "[set]" - Added regression test for absent/falsey env-presence inputs * fix: address CodeRabbit findings — sync describe, heartbeat emitter, responsesBody filtering, dev entry precedence * chore: remove stray Windows path artifact * fix: update redaction import path in taskReport module * fix: address CodeRabbit P1-P3 findings and rebase regressions - F1: rebase onto upstream/main, fix taskReport.ts import path - F2: Ollama native chat code recovered via rebase (6 functions) - F3: &-truncation in credential regexes fixed via post-processing pass - F4: 'tokens' added to jsonRedactor EXCLUDED_KEYS - F5: redactHomePath case-sensitivity aligned with redactPathForStatus - F6: credential metadata object preserved in issue report (sensitive-key check moved inside type branches) - F7: heartbeat tests updated for pre-drain write behavior - F8: reportTask test expects [REDACTED] (matches centralized output) - rm: stray C:\repo\ Windows path artifact * fix: address reviewer findings — generic regex &-handling and diagnostic secret-key masking - Remove & from excluded char classes in 4 generic patterns so they consume full secret values (URL-query &-splitting belongs in redactUrlForDisplay). - Remove now-obsolete &-tail post-processor pass. - Remove credential from DIAGNOSTIC_SECRET_KEY_PATTERN so issue report credential metadata objects are traversed, not collapsed. - Restore broad isDiagnosticSecretKey check before type dispatch in redactDiagnosticObjectInternal so objects/arrays under secret-marked keys (auth, password, token, etc.) are masked. - Update issue report test baseUrl expectation (no trailing &mode=test after generic redactor consumes past &). * fix: address reviewer findings — URL delimiter safety, jsonRedactor #-drop, embedded URL query redaction - Restore &#; delimiters in generic pattern value classes (F1) so safe query tails (&mode=test) survive. Re-add &-tail post-processor for non-URL abc&def case. - Gate redactUrlForDisplay in jsonRedactor to https?:// strings only (F2) to prevent #-drop on ordinary text like 'fails after #setup'. - Add URL query redaction step to redactSensitiveInfo (F3) that extracts https?:// URLs from free-form text and routes them through redactUrlForDisplay, catching signature/sig params that generic patterns miss. Skip already-redacted URLs to avoid double-redaction. * fix: add Cookie/Set-Cookie semicolon-safe redaction pass, tighten &-tail regex * fix: COOKIE_PATTERN consume comma-joined multi-cookie values * fix: address P2 findings — URL redact skip, pre-drain write promise, permission truthy check * fix: update log.test.ts expectation, add protocol-relative URL support * fix: enhance redaction for provider env-vars in URLs, preserve safe query params * fix: enhance redaction for uppercase provider keys and cookie query params * fix: enhance redaction for bare Bearer and JWT tokens in sensitive info * fix: update report task test expectations for new redaction format * fix: limit token exemption to numeric values, protect semicolon cookie query tails * test: add tests for truncateForPreview to ensure sensitive data redaction --------- Co-authored-by: Gravirei <gravirei@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: openhands <openhands@all-hands.dev>	2026-07-07 22:01:40 +08:00
JATMN	cd13a61537	fix(memory): recover from autocompact overflow failures (#1858) ... * fix(memory): recover from autocompact overflow failures * fix(memory): address autocompact review findings * fix(memory): close autocompact recovery gaps * fix(memory): reduce OpenAI conversion pressure * test(memory): add long-session guard smoke * fix(memory): add runtime memory guard diagnostics * fix(memory): surface autocompact failure diagnostics * fix(memory): reuse hard-cap resolver in diagnostics * fix(memory): avoid hard-cap diagnostic drift * fix(memory): clarify hard-cap diagnostics	2026-07-06 08:16:01 +08:00
JATMN	dd4c4abc81	feat(api): add OpenAI-compatible credential pool failover (#1706) ... * feat(api): rotate OpenAI credential pools * fix(api): align pooled credential discovery * fix(cache-probe): preserve GitHub credential precedence * fix(provider): honor pooled OpenAI fallbacks * fix(provider): validate pooled profile credential labels * fix(api): harden OpenAI credential pool handling Reject placeholder values in pooled OpenAI credentials before requests, discovery, diagnostics, and profile generation can use them. Normalize pooled credentials to a single usable key for model discovery, runtime cache partitions, cache probing, and NVIDIA NIM cache lookups. Preserve documented profile precedence by letting live shell credentials override saved pools, carrying OpenCode fallback pools through launch, and redacting individual pool members in profile display. Add regression coverage for pooled credential validation, profile launch/rebuild behavior, discovery/cache callers, diagnostics, provider autodetect, and shim failover semantics. * fix(provider): cover pooled key recommendation path Import the pooled OpenAI credential validator in provider-recommend and split invalid credentials from unset credentials in user guidance. Add a script-level regression that runs the OpenAI recommendation path with OPENAI_API_KEYS so the ts-nocheck script cannot regress with runtime ReferenceErrors. Scrub pooled OpenAI keys before xAI OAuth profile env construction and loosen the invalid-pool discovery test to assert auth header absence instead of exact header shape. * fix(tests): stabilize rebased provider checks * fix(provider): address pooled credential review findings * test(api): cover opencode go credential failover * fix(provider): share OpenAI credential usability checks * fix(provider): respect pooled credential precedence * fix(model): preserve pooled discovery credential precedence * fix(model): fall back from unusable pooled discovery keys	2026-06-23 12:34:55 +08:00
Bogdan	29aea4969d	fix(provider): centralize provider secret redaction (#1665) ... * fix(provider): centralize provider secret redaction * fix(system-check): prefer base URL route credentials * fix(provider): avoid false credential matches * fix(provider): redact jwt-shaped tokens * fix(provider): redact embedded diagnostic secrets * test(system-check): isolate provider env keys	2026-06-17 11:23:15 +08:00
Bogdan	bd3ad89dd7	fix(security): bundle real sandbox runtime in open CLI (#1641) ... * fix(security): bundle real sandbox runtime in open CLI * test(sandbox): cover fail-closed runtime diagnostics * fix(sandbox): report doctor inspection failures	2026-06-16 08:42:48 +08:00
Bogdan	d8dbf274b4	chore(runtime): align Node.js minimum version (#1644) ... * chore(runtime): align Node.js runtime requirements * test(runtime): cover prefixed Node versions * fix(runtime): check node executable in doctor	2026-06-16 06:55:17 +08:00
JATMNandTechBrewBoss	b471745fb1	Registry-Based Integration Architecture for Providers, Gateways, and Models (#910) ... * setting up * updated plan with missing notes for discovery cache * build out inital checklist and planning adjustments * Phase 1A-1D * Fix descriptor-backed provider profile routing - preserve GitHub, Bedrock, and Vertex runtime flags during profile activation\n- serialize descriptor-backed startup profiles into legacy-compatible persisted kinds\n- add regression coverage for activation, restart round-trip, and saved-profile switching\n- guard integration registration so repeated imports stay idempotent in tests * feat: finish phase 1 provider descriptor routing Complete the Phase 1E CLI/usage migration work and the Phase 1F verification pass for descriptor-backed providers. Details: - derive valid --provider values from descriptor registry and compatibility mappings instead of a fixed list - preserve special CLI semantics for ollama and minimax while allowing descriptor-backed OpenAI-compatible routes such as deepseek and openrouter to pick up descriptor base URLs - add getUsageDescriptor() so /usage resolves vendor/gateway metadata and follows usage delegation - switch Settings Usage rendering to descriptor-backed usage resolution for Anthropic, MiniMax, and neutral unsupported fallbacks - make integration loading idempotent via ensureIntegrationsLoaded() so registry-backed helpers survive tests that clear the registry - fix compatibility mapping for mistral so the preset routes through vendorId=openai with gatewayId=mistral rather than a nonexistent direct vendor route - harden provider profile and startup tests so descriptor-backed providers, legacy OpenAI startup files, and unknown stored providers round-trip correctly - remove a stale ollama model mock that was leaking across the full model test suite - update plan/progress.md with the current 1E complete / 1F in-progress verification state and the note that repo-wide typecheck failures are pre-existing outside this migration slice Verification: - bun test src/commands/usage/index.test.ts src/integrations/compatibility.test.ts src/utils/providerFlag.test.ts src/utils/providerProfiles.test.ts src/utils/providerProfile.test.ts src/utils/model/modelCache.test.ts src/integrations/index.test.ts src/integrations/registry.test.ts - filtered bun run typecheck output for the files changed in this branch is clean * Phase 2 planning * feat: complete phase 2A validation and discovery cache * fix: address review findings for phase 2 cache and validation Fixes the follow-up review issues from the Phase 2A / 2A.5 work. Completed work: - made discovery cache stale entries reachable through getCachedModels(..., { includeStale: true }) while keeping fresh-by-default behavior unchanged - kept recordDiscoveryError stale-data preservation useful to later /model consumers by exposing stale and error-only entries through the public helper API - extended descriptor-backed validation routing metadata with host alias matching support - updated MiniMax validation routing to recognize both api.minimax.io and api.minimax.chat endpoints - added regression coverage for stale cache reads, error-only cache entries, and MiniMax chat-host validation - updated progress.md notes so the recorded 2A.5 helper behavior matches the implementation * feat: complete phase 2B discovery and readiness migration Implement descriptor-backed discovery and readiness routing for Phase 2B. Highlights: - add src/integrations/discoveryService.ts to execute declarative catalog.discovery configs with shared discovery-cache integration - add hybrid merge behavior so curated descriptor catalog entries stay ahead of discovered duplicates - add typed startup readiness metadata via ReadinessProbeKind and wire gateway descriptors for ollama, atomic-chat, lmstudio, and openrouter - export probeOllamaModelCatalog() so discovery can distinguish unreachable Ollama from reachable-but-empty catalogs - migrate ProviderManager and /provider flows to probeRouteReadiness() while preserving existing Ollama messaging - route bootstrap local model discovery through descriptor-backed discovery for recognized local routes, while keeping legacy fallback for generic custom endpoints - add resolveDiscoveryRouteIdFromBaseUrl() so bootstrap can share descriptor-backed discovery and local provider labels - preserve explicit provider env precedence during applySavedProfileToCurrentSession() after focused verification exposed the regression - update plan/progress.md to mark Phase 2B complete and record the verification notes Verification: - bun test src/integrations/discoveryService.test.ts - bun test src/components/ProviderManager.test.tsx - bun test src/commands/provider/provider.test.tsx - bun test src/utils/providerDiscovery.test.ts src/integrations/registry.test.ts src/integrations/index.test.ts - filtered bun run typecheck for the touched 2B files returned FILTER_CLEAN * feat: complete phase 2c provider metadata migration Finish the Phase 2C runtime metadata adoption work on cheeky-cooking-moon. Provider UI metadata: - add shared route metadata and provider preset UI metadata helpers - move preset labels/defaults, route type labels, and custom-header capability checks onto descriptor-backed lookups - update ProviderManager and /provider summaries/setup copy to read shared descriptor metadata instead of bespoke switches - extend local gateway descriptors with default model metadata used by the shared UI helpers Model discovery UX: - add route catalog option builders for descriptor-backed /model rendering - update /model to resolve the active route, read cached route catalogs before rendering, and trigger background refresh when cached discovery is stale - add /model refresh plus in-picker refresh via modelPicker:refresh and the r keybinding - clear discovery cache on manual refresh and surface non-blocking loading/success/stale-error states in ModelPicker - keep descriptor-backed dynamic and hybrid routes on the shared discovery cache service Verification and hardening: - fix combined test pollution by isolating /model test module imports and using real OpenRouter descriptor metadata during shared runs - update progress.md to mark Phase 2C complete with verification notes - verified with bun test for provider profiles, ProviderManager, /provider, /model, discovery cache, and provider validation suites * feat: complete phase 2d runtime provider alignment Align descriptor-backed runtime provider behavior with the legacy APIProvider surface so active routes, OpenAI shim behavior, and resume handling all resolve through the same metadata path. Add runtimeMetadata.ts to centralize active route detection, OpenAI shim overrides, and native-format inference. Update provider resolution to map descriptor-backed routes onto legacy provider categories while preserving existing compatibility fallbacks for Foundry, NVIDIA NIM, MiniMax, GitHub, Bedrock, and Vertex. Move request-shaping rules onto descriptor metadata for DeepSeek, Moonshot, Kimi Code, Gemini, Mistral, GitHub, and local gateways, including reasoning_content preservation, deepseek-compatible thinking payloads, max_tokens field selection, and store field stripping. Treat GitHub Claude native transport as Anthropic-native during conversation recovery so thinking blocks survive resume flows. Extend focused tests for provider resolution, OpenAI shim request shaping, and conversation recovery, and update phase tracking notes in progress.md to mark 2D complete with verification details. * feat: complete phase 2e drift audit Complete the Phase 2E verification and drift-audit packet for the descriptor migration branch. Add representative provider-summary coverage for descriptor-backed OpenRouter routing plus Gemini and Mistral current-provider summaries in src/commands/provider/provider.test.tsx. Extend ProviderManager coverage with first-run Atomic Chat discovery-backed setup and a regression test proving the set-active picker now uses descriptor-backed provider-type labels. Replace stale saved-profile picker wording in ProviderManager so saved profiles no longer collapse to a coarse anthropic/openai-compatible split and instead render the route's descriptor-backed provider type label. Add plan/phase-2e-drift-audit.md documenting the remaining intentional switch sites and non-switch provider branches across provider summaries, active-route detection, OpenAI shim env remapping, auth/header exceptions, and conversation recovery. Update plan/progress.md to mark Phase 2 and 2E complete on-branch, record focused verification, and note the follow-up hardening completed during audit review. Verification completed during this packet: bun test src/components/ProviderManager.test.tsx src/commands/provider/provider.test.tsx src/utils/providerValidation.test.ts src/integrations/discoveryService.test.ts src/commands/model/model.test.tsx and bun test src/utils/providerDiscovery.test.ts src/utils/model/providers.test.ts src/services/api/openaiShim.test.ts src/utils/conversationRecovery.test.ts. Filtered typecheck output still shows pre-existing baseline noise in src/services/api/openaiShim.ts and src/utils/conversationRecovery.ts only. * fix: close phase 2 provider parity follow-through Complete the skipped provider-surface follow-up discovered during the post-Phase-2 review. - add focused status coverage for NVIDIA NIM and MiniMax sessions - add Mistral entries to legacy teammate/model compatibility configs - fill deprecation placeholders for the widened APIProvider surface - add focused regression tests for status and teammate fallbacks - update the Phase 2 drift audit and progress tracker with the compatibility-bridge notes and Phase 3 staging context * phase 3 planning * refactor: start phase 3a dead-switch cleanup Begin the Phase 3 cleanup pass with the metadata-only dead-switch removals that are safe to land independently on cheeky-cooking-moon. Completed work: - updated plan/progress.md to move Phase 3 and Phase 3A into IN_PROGRESS, added slice-level checklists, and recorded what remains intentionally deferred to later packets - removed duplicated OpenAI-compatible status-display branches in src/utils/status.tsx by routing openai/codex/nvidia-nim/minimax through shared metadata helpers - replaced the pure transport-kind label switch in src/integrations/routeMetadata.ts with shared label metadata - replaced the pure provider-label switch in src/components/CostThresholdDialog.tsx with a shared provider-label map - added focused regression coverage in src/utils/status.test.ts, src/integrations/routeMetadata.test.ts, and src/components/CostThresholdDialog.test.ts Verification: - bun test src/utils/status.test.ts src/utils/swarm/teammateModel.test.ts src/utils/model/providers.test.ts - bun test src/integrations/routeMetadata.test.ts src/utils/status.test.ts src/components/CostThresholdDialog.test.ts src/utils/model/providers.test.ts - filtered bun run typecheck for the touched status/routeMetadata/CostThresholdDialog files returned FILTER_CLEAN * refactor: complete phase 3b and 3c cleanup Complete the uncommitted Phase 3B compatibility rename work and the Phase 3C env-shaping consolidation on cheeky-cooking-moon. Phase 3B: - introduce LegacyAPIProvider while keeping APIProvider as the public compatibility alias - introduce LegacyProviderModelConfig and LEGACY_PROVIDER_MODEL_CONFIGS while keeping ModelConfig and ALL_MODEL_CONFIGS as compatibility exports - switch modelStrings, deprecation helpers, and provider profile compatibility naming onto the legacy/compatibility terminology Phase 3C: - add shared managed-env clear/apply helpers in providerProfile.ts and route buildLaunchEnv through the shared compatibility env shaper - route applyProviderProfileToProcessEnv through the same compatibility env shaper so config-backed profiles and startup/session env construction stay aligned - preserve explicit exception behavior for github, mistral, bedrock, vertex, bankr aliasing, MiniMax fallback detection, and NVIDIA NIM mode markers - reduce createOpenAIShimClient to the remaining credential alias hydration that resolveProviderRequest does not already cover - fix applySavedProfileToCurrentSession so saved-profile switching can move away from stale GitHub env selections - add regression coverage for NVIDIA NIM env stamping and stale Codex-managed env clearing - update progress.md to mark Phase 3B and 3C complete on branch and record the verification notes Verification: - bun test src/utils/model/providers.test.ts src/utils/providerProfiles.test.ts src/utils/swarm/teammateModel.test.ts src/utils/status.test.ts - bun test src/utils/providerProfile.test.ts src/utils/providerProfiles.test.ts src/services/api/openaiShim.test.ts - filtered bun run typecheck confirmed no new hits in providerProfile.ts or providerProfiles.ts; remaining openaiShim.ts hits are existing repo baseline debt * docs: complete phase 3d audit and architecture note Complete the Phase 3D final audit/documentation packet on cheeky-cooking-moon. Work completed: - add plan/phase-3d-final-audit.md with the final post-Phase-3 inventory of remaining provider-specific runtime branches - classify the remaining exceptions as intentional long-term runtime differences or temporary env/config compatibility bridges - confirm the audit did not uncover new missed runtime migration work that requires additional Phase 3 code changes - add docs/architecture/integrations.md to document the descriptor-first architecture, current constraints, known exceptions, and follow-on guidance for future cleanup - update plan/progress.md to mark Phase 3D complete on branch, mark 3C merged on branch, and point the tracker at Phase 4A next Key exception categories documented: - github dual-mode transport behavior - mistral dedicated route/runtime shaping - bedrock/vertex/foundry native Anthropic-family paths - Azure and Bankr request-auth/header differences - Gemini, DeepSeek, and Moonshot/Kimi OpenAI-shim quirks - MiniMax dedicated usage handling - native web-search gating - env-only MiniMax and NVIDIA NIM compatibility fallbacks - env/config compatibility bridges such as route detection, --provider shaping, and startup/provider summaries Notes: - this packet is branch-local audit/documentation work only; no runtime code paths were changed - no new tests were required for the audit/doc pass * docs: stage phase 4 tracker and codex profile guard Add the Phase 4 documentation/reference-samples plan to progress.md in the same packet/checkpoint structure as earlier phases, and reconcile the Phase 3 tracker summary with the completed cleanup state. Also fix applySavedProfileToCurrentSession so Codex saved-profile activation does not overwrite an already explicit live provider selection, while still clearing stale profile-managed markers when needed. * docs: complete phase 4a and 4b guides Expand the integrations architecture note with descriptor authoring, routing-contract, transport-boundary, and compatibility-layer guidance. Add overview and glossary docs under docs/integrations/, plus new how-to guides for adding vendors and gateways with one-file and two-file patterns, discovery cache guidance, token-field guidance, and compatibility follow-through. Update progress.md to mark Phase 4 in progress, Phase 4A complete, and Phase 4B complete with notes about the new docs structure and guide outputs. * docs: complete phase 4 integration docs Add the remaining descriptor contributor guides for models, anthropic proxies, and /usage support. Add a reference sample pack and a common-pitfalls checklist, update the integrations overview, and reconcile plan/progress.md so Phase 4 is marked complete on cheeky-cooking-moon with the current implementation boundaries called out explicitly. * docs: reconcile tracker waivers and checkpoints Update plan/progress.md to formally waive the remaining repo-wide typecheck item for Phase 1F as pre-existing debt outside the descriptor migration scope, and mark the Phase 4 branch-local checkpoints as landed on cheeky-cooking-moon with the corresponding commit references. * Align Z.AI merge fallout with descriptors Reviewed the upstream main merge against plan/cheeky-cooking-moon.md and removed drift from the old switch/helper-based Z.AI provider path. Moved Z.AI reasoning, context-window, and max-output metadata into the descriptor route catalog so thinking support can read catalog capabilities instead of URL/model helper checks. Removed the standalone src/utils/zaiProvider.ts helper and updated startup/provider-discovery labeling to resolve known direct routes through descriptor route metadata. Simplified --provider handling for Z.AI by letting descriptor defaults provide the base URL and default model through the generic OpenAI-compatible provider branch. Updated startup and provider-discovery tests for descriptor-backed labels, added Z.AI descriptor-label coverage, and documented the post-main-merge reconciliation in plan/progress.md. Verification before commit: bun test src/utils/providerFlag.test.ts src/utils/providerProfiles.test.ts src/utils/thinking.test.ts src/components/StartupScreen.test.ts src/utils/providerDiscovery.test.ts; bun test src/integrations/compatibility.test.ts src/integrations/index.test.ts src/integrations/registry.test.ts src/services/api/openaiShim.test.ts; git diff --check. * fix: restore descriptor migration behavior and isolate provider tests Restore the descriptor-era Anthropic/OpenAI boundary during conversation recovery by threading the legacy provider category into usesAnthropicNativeMessageFormat instead of relying on ambient env-only route detection. Harden branch-added provider-facing tests so they do not inherit leaked bun mock.module state from neighboring suites. Status, thinking, teammate fallback, and GitHub model options tests now restore mocks and/or import fresh modules under explicit provider context. Update bugfix assertions to validate the descriptor-backed openaiShim contract for removeBodyFields/store stripping instead of the pre-refactor inline conditionals. Validation: - focused status/thinking/conversationRecovery/bugfix suites pass - full bun test --max-concurrency=1 is down to the existing conversationArc perf benchmark failure only - bun run smoke - bun run build - npm pack * fix: close descriptor review drift and provider regressions Address the follow-up review against plan/cheeky-cooking-moon.md by fixing the remaining runtime drift and locking the behavior with focused coverage. Completed work: - make NVIDIA NIM descriptor-backed auth consistent across validation, --provider env shaping, and openaiShim request auth so NVIDIA_API_KEY works without requiring OPENAI_API_KEY - resolve /usage from the active descriptor route instead of collapsing most OpenAI-compatible providers into the legacy openai bucket - honor discoveryRefreshMode in /model so manual, on-open, background-if-stale, and startup catalogs no longer behave identically - clarify docs/progress notes so the branch no longer overstates one-file additive onboarding while loader and preset/UI compatibility surfaces are still manual Verification: - bun test src/services/api/openaiShim.test.ts src/utils/providerValidation.test.ts src/utils/providerFlag.test.ts src/utils/model/providers.test.ts src/commands/usage/index.test.ts src/commands/model/model.test.tsx * docs(plan): require descriptor-native gateway onboarding closure Investigated the current descriptor onboarding flow and documented the remaining manual choke points in the loader, preset compatibility mapping, provider UI metadata, and handwritten preset typing. Tighten cheeky-cooking-moon so additive onboarding is a hard requirement, add Phase 3E for descriptor-native onboarding closure, and update the progress tracker to reflect that follow-up work instead of treating the branch as fully complete. * feat(integrations): close descriptor-native onboarding Implement the Phase 3E generated-artifact workflow for integration onboarding. - add integration artifact generation and check scripts - generate loader inventory, preset manifest, and preset type from descriptors - move preset participation onto descriptor preset metadata for preset-facing vendors and gateways - derive compatibility and provider UI metadata from the generated manifest - remove descriptor-level preset ordering and sort presets by description with standard alphanumeric ordering - pin the custom preset to the bottom automatically in generated ordering - add validation for duplicate preset ids and incomplete preset metadata - add generator tests for representative gateway and direct-vendor onboarding - refresh ProviderManager tests for generated preset ordering - update architecture/how-to/reference docs and progress tracking for the new regeneration workflow * Fix provider profile and discovery drift Honor route-specific auth env vars across descriptor-backed OpenAI-compatible routes by centralizing credential resolution and using it in validation, bootstrap, discovery, and the OpenAI shim. Persist Anthropic startup fallbacks as native anthropic profiles and restore them correctly at startup so the legacy startup file stays aligned with the active provider. Wire discoveryRefreshMode='startup' into startup and provider activation flows, with LM Studio as a live startup-refresh example, and add regression coverage for validation, startup env shaping, discovery refresh, and shim auth handling. * Pin Anthropic provider preset to the top Keep the existing custom gateway preset pinned to the bottom while moving the Anthropic preset ahead of the description-sorted remainder. Regenerate the integration preset manifest/order and extend the artifact generator coverage to lock in both ordering rules. Validation: bun test src/integrations/artifactGenerator.test.ts src/components/ConsoleOAuthFlow.test.tsx; bun run build * docs: refresh integration and setup guides Update the new descriptor-era integration docs so they read as current contributor guidance instead of rollout notes, and align the authoring examples with the actual runtime metadata flow. Highlights: - add a CONTRIBUTING.md pointer to the integration overview and focused how-to guides - remove branch/phase-specific wording from the integration docs - fix OpenAI-compatible header guidance to use transportConfig.openaiShim headers and custom-header flags - clarify anthropic proxy onboarding around generated loader support - refresh advanced setup with current Codex, Gemini, Mistral, and profile-launch details - fix LiteLLM /provider instructions and clarify local no-auth behavior - tighten quick-start and non-technical cross-links so users can find the advanced provider docs * fix: close descriptor integration drift Apply descriptor-backed static headers to OpenAI-compatible request execution and model discovery, preserving request-specific header precedence. Allow Gemini profile launch with API key, access-token, or ADC credentials, and align Gemini fallback defaults with the descriptor/docs default model. Add regression coverage for descriptor header propagation, Gemini defaults, and discovery auth/header behavior. * post-phase follow-up task added * Fix xAI merge follow-ups Route env-only XAI_API_KEY sessions through the OpenAI-compatible shim using descriptor-backed xAI defaults, and map the xAI key into OPENAI_API_KEY for shim auth. Hydrate legacy profile: xai startup env with xAI descriptor defaults, preserving XAI_API_KEY and OpenAI-compatible launch behavior. Update progress tracking for post-merge xAI descriptor inventory and clarify that profile-owned custom headers remain open despite adjacent auth/static-header plumbing. Add regression coverage for env-only xAI client routing, legacy xAI launch env, shell key precedence, and the Gemini/OpenAI client test isolation issue. * Complete profile custom headers follow-up Add persisted provider-profile customHeaders support with shared parsing and sanitization for compact Name: value input. Reject malformed and reserved auth/internal headers before saving or applying profile-owned headers. Expose a descriptor-gated /provider custom headers step, preserve headers during profile edit/update, and apply supported profile headers through ANTHROPIC_CUSTOM_HEADERS for active env and startup fallback profiles. Propagate profile headers into descriptor discovery refresh and bootstrap model discovery while preserving descriptor/profile/auth merge order. Add focused regression coverage and mark the progress tracker packet complete. * Allow api-key custom provider headers Permit api-key in /provider custom header input and preserve it when OpenAI-compatible shim requests are built. This is intentional for gateway providers that require an api-key header in addition to, or instead of, standard bearer auth. Keep managed credential headers protected by continuing to reject/strip authorization and x-api-key, plus Anthropic/Claude-owned headers. Add parser, profile env, and outgoing request coverage for the intended behavior. * fix: restore API mode picker for OpenAI-compatible profiles Use descriptor transport metadata instead of the legacy provider id when deciding whether provider profiles support OpenAI-compatible options. This restores the Chat Completions vs Responses picker for the Custom OpenAI-compatible preset after it moved to the descriptor-backed custom route. Preserve apiFormat and custom auth header profile fields for all routes whose transportConfig.kind is openai-compatible, so selecting Responses is saved and applied as OPENAI_API_FORMAT=responses. Tests: bun test src/components/ProviderManager.test.tsx; bun test src/utils/providerProfiles.test.ts; bun run build; bun run smoke * fix: respect explicit provider routing with xAI env Ensure env-only XAI_API_KEY fallback does not take over when Bedrock, Vertex, or Foundry has been explicitly selected. This preserves native transport routing while still allowing bare xAI env setup to use the OpenAI-compatible shim. Restore api-key to the managed custom-header blocklist now that /provider exposes the API mode/auth-header controls for OpenAI-compatible profiles. The shim and provider override paths strip api-key again, while OPENAI_AUTH_HEADER=api-key remains available for explicit auth configuration. Tests: bun test src/services/api/client.test.ts src/utils/providerCustomHeaders.test.ts src/utils/providerProfiles.test.ts src/services/api/openaiShim.test.ts; bun run build; bun run integrations:check; bun run smoke * docs: fix integration drift Align integration and setup docs with the current implementation. - show model descriptor examples as array default exports, matching the generated MODEL_DESCRIPTOR_GROUPS loader contract - document provider-scoped model env vars instead of implying OPENAI_MODEL globally overrides ANTHROPIC_MODEL - clarify generated provider preset ordering: anthropic first, custom last, description-sorted middle entries - update LiteLLM examples and /provider guidance to use the /v1 OpenAI-compatible base URL Verification: bun run integrations:check * Fix provider discovery cache isolation * Stabilize provider env tests * Stabilize provider test isolation Completed work: - Isolated GitHub model option tests from cached availableModels settings. - Isolated startup discovery tests from live process.env provider flag races. - Mocked teammate provider fallback tests at the provider helper boundary. - Moved cost threshold provider labels into a pure helper for deterministic tests while preserving runtime active-provider behavior. Validation: - bun test src/components/CostThresholdDialog.test.ts src/integrations/discoveryService.test.ts src/utils/model src/utils/swarm - bun run build - bun run smoke * test: isolate startup screen model settings Clear the session settings cache and persisted global model around StartupScreen provider-detection tests. This prevents earlier provider/model suites from leaking saved non-Anthropic models into the default Anthropic startup assertions. Verified with: bun test src/components/StartupScreen.test.ts src/integrations/discoveryService.test.ts src/utils/model/modelOptions.github.test.ts Full bun test now only fails the unrelated Conversation Arc sub-millisecond performance benchmark. * test: isolate route discovery and github model options Restore Bun module mocks around discoveryService tests before loading fresh route-discovery modules. Pin the GitHub model-options test to a complete providers.js mock so cached provider mocks from other suites cannot hide Copilot options. Verified with: bun test src/integrations/discoveryService.test.ts src/utils/model/modelOptions.github.test.ts Also ran full bun test; only the unrelated Conversation Arc sub-millisecond performance benchmark fails locally. * test: avoid startup discovery cache collision Use the 127.0.0.1 LM Studio alias in refreshStartupDiscoveryForActiveRoute so it still resolves the active route from env but does not share the cache partition with the preceding startup refresh test. This keeps the assertion on network refresh stable under Bun 1.3.11 serialized runs. Verified with: bun test --max-concurrency=1 src/integrations/discoveryService.test.ts src/utils/model/modelOptions.github.test.ts Also ran full bun test --max-concurrency=1; only the unrelated Conversation Arc perf benchmark fails locally. * fix: isolate OpenAI-compatible route credentials Restrict OpenAI-compatible shim auth to provider overrides, resolved route credentials, or explicit OPENAI_API_KEY instead of ambient provider-specific secrets. Remove NVIDIA and Bankr compatibility fallbacks that could promote provider-specific API keys into unrelated OpenAI-compatible routes. Preserve Bankr base URL/model compatibility before route credential resolution so Bankr still resolves through descriptor credentials. Clear stale NVIDIA_NIM and copied OPENAI_API_KEY values when switching away from NVIDIA NIM, Bankr, or xAI provider flags to avoid carrying provider secrets across route boundaries. Add regressions for stale NVIDIA, MiniMax, and Bankr keys not leaking into OpenRouter-style routes, plus provider-flag cleanup for copied NVIDIA/Bankr/xAI keys. Validation: bun test src/services/api/openaiShim.test.ts; bun test src/utils/providerFlag.test.ts; bun run build; bun run smoke. * fix: guard model discovery privacy paths Suppress descriptor and legacy model discovery while essential-only traffic mode is active. Use the partitioned discovery cache key for /model cache reads, stale checks, and manual refresh clears, including route-specific credentials and custom headers. Partition legacy local OpenAI additional model caches by credentials and routing headers to avoid catalog reuse across profiles. Add coverage for OpenRouter route credentials, descriptor privacy suppression, legacy discovery privacy suppression, and local cache scope partitioning. * Fix artifact checks and knowledge graph persistence Normalize generated integration artifact comparisons so Windows line endings do not make checked-in artifacts appear stale. Skip knowledge graph entity persistence when re-adding an existing entity with identical attributes, avoiding repeated disk writes during automatic fact extraction and restoring the conversation arc performance benchmark. Verified with bun test src/integrations/artifactGenerator.test.ts --max-concurrency=1, bun test src/utils/conversationArc.perf.test.ts --max-concurrency=1, and bun test --max-concurrency=1. * test: isolate privacy discovery cache path The descriptor discovery privacy test could observe stale OpenRouter cache data populated by an earlier test and receive source=stale-cache instead of static. Use a test-specific API key so the privacy assertion gets its own discovery cache partition while still verifying that nonessential traffic disables network discovery. Verified with bun test src/integrations/discoveryService.test.ts --max-concurrency=1 and bun test --max-concurrency=1. * test: accept cached privacy discovery result * test: set privacy gate before discovery import * test: prevent discovery privacy mock bleed Guard descriptor model discovery directly on CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC so nonessential traffic stays disabled even if the privacyLevel module is mocked in-process. Reduce broad fastMode test mocks for shared modules and use real state/config test hooks, preventing Bun module mock namespaces from leaking into discovery and /model tests. Verified with bun test src/utils/fastMode.test.ts src/utils/model/openaiModelDiscovery.test.ts src/integrations/discoveryService.test.ts src/commands/model/model.test.tsx --max-concurrency=1 and bun test --max-concurrency=1. * test: prevent discovery privacy mock bleed Add an env-level fallback guard to descriptor model discovery so disabled nonessential traffic cannot be bypassed by stale mocked privacy helpers. Tighten the fastMode regression tests by setting real bootstrap/config state only after the tested module is imported, avoiding broad module mocks that can leak into unrelated discovery tests or behave differently under Bun in CI. Verified with focused discovery/fastMode/model suites and the full serial bun test suite. * fix: harden fast mode test isolation Ignore non-string GrowthBook values when resolving the fast mode unavailable reason so boolean flag payloads cannot surface as false. Make the affected regression tests install explicit provider mocks for their own scenarios and reset env state, preventing stale provider mocks from changing fastMode and conversation recovery behavior across the serial Bun test run. * test: harden fast mode module mocks Expand the fastMode GrowthBook and provider test mocks so later imports in the same Bun test process can resolve the named exports they expect. This prevents order-sensitive failures when model command tests run after fast mode tests.\n\nVerified with: bun test --max-concurrency=1 * feat: consolidate integration runtime metadata Move OpenAI-compatible model runtime limits into descriptor-backed brand and model metadata, adding Gemini, GLM, MiniMax, Mistral, Nemotron, xAI, and OpenAI-compatible alias descriptor groups. Update generated integration artifacts, route catalog option handling, thinking capability lookup, and docs to use modelDescriptorId-backed runtime metadata. Split OpenAI shim capability flags into supportsApiFormatSelection and supportsAuthHeaders, and update provider profile sanitization, ProviderManager forms, descriptor validation, and integration authoring docs so fixed routes do not preserve unsupported API format or auth-header settings. Harden env-only MiniMax and xAI routing. Resolve shared route intent before client setup, reject conflicting OpenAI base URLs, preserve provider-specific base overrides, sanitize stale OpenAI shim knobs, copy provider credentials intentionally, and keep legacy provider labels, context windows, max output limits, model lists, and provider switching aligned. Refresh MiniMax defaults and catalog entries, add descriptor-backed runtime limits for migrated models, preserve external OpenAI limit overrides, and add regression coverage for env-only MiniMax/xAI, provider-profile capability stripping, route catalog options, copied credential cleanup, and context/runtime limit detection. Verification performed: bun test src/utils/providerFlag.test.ts; bun test src/services/api/client.test.ts src/utils/model/providers.test.ts src/integrations/routeMetadata.test.ts; bun test src/utils/context.test.ts src/utils/thinking.test.ts src/services/compact/autoCompact.test.ts; bun test src/integrations/routeMetadata.test.ts src/services/api/client.test.ts src/utils/model/providers.test.ts src/utils/providerValidation.test.ts src/integrations/index.test.ts src/utils/status.test.ts; bun run build; bun run smoke. * test: isolate provider env in conversation recovery Snapshot and restore all provider-selection environment variables used by the GitHub native Claude resume test instead of only restoring the GitHub flag and OPENAI_MODEL. The full single-concurrency suite exposed that earlier tests can leave higher-priority provider flags in process.env, causing deserializeMessages to resolve a non-GitHub provider and strip thinking blocks even though the test intended to exercise GitHub native Claude transport. The test now clears provider routing env before setting CLAUDE_CODE_USE_GITHUB=1 and OPENAI_MODEL=claude-sonnet-4-6, then restores the original env values in afterEach. Verification: bun test src/utils/conversationRecovery.test.ts; bun test --max-concurrency=1. * test: isolate conversation recovery provider state * test: pin conversation recovery provider mock * test: isolate knowledge graph persistence * fix: make knowledge graph reset synchronous * test: restore integration registry after unit tests * remove plans dir * delete plans * Fix provider routing test failures Restore the missing first-party Anthropic auth routing imports used by getAnthropicClient so OpenAI-compatible provider client creation no longer throws at runtime. Keep GitHub provider resolution from inheriting OPENAI_API_FORMAT=responses so GitHub GPT-4 and gpt-5-mini models continue to use chat completions while Codex-flavored models still route to responses. Reset OPENAI_API_FORMAT in the affected API provider tests to prevent environment leakage across serial Bun test runs. Verified with: bun test --max-concurrency=1 * fix: restore provider-specific model routing Resolve generic OpenAI-compatible profiles by their known descriptor base URLs so saved MiniMax, xAI, NVIDIA NIM, OpenRouter, and DeepSeek profiles use the correct route catalogs instead of the generic OpenAI model list. Fix MiniMax defaults and display handling so provider-specific model IDs are not rendered as Claude Opus defaults, add current MiniMax M2.7 options, and cover the regressions with focused route/model tests. Also clean up descriptor follow-ups from review: remove the dead OpenAI shim store-strip fallback list, preserve gateway vendor IDs for Bedrock/Vertex/GitHub profile resolution, and keep the ModelPicker compiled-form changes in this PR. * test: cover provider precedence review fixes Remove import-time ANTHROPIC_BASE_URL and ANTHROPIC_MODEL reads from the Anthropic descriptor so descriptor defaults stay static and live env handling remains in preset metadata. Add getAPIProvider precedence coverage documenting that explicit Gemini/OpenAI flags beat env-only MiniMax API key inference. Add a regression check to keep the removed openaiShim hardcoded descriptor route fallback list from returning. --------- Co-authored-by: TechBrewBoss <dash@hicap.ai>	2026-05-02 08:29:26 +08:00
nehanandCopilot	4cb963e660	feat(api): improve local provider reliability with readiness and self-healing (#738) ... * feat(api): classify openai-compatible provider failures * Update src/services/api/providerConfig.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/services/api/errors.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * feat(api): harden openai-compatible diagnostics and env fallback * Update src/services/api/openaiShim.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/services/api/openaiShim.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/services/api/errors.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/services/api/errors.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix openaiShim duplicate requests and diagnostics * remove unused url from http failure classifier * dedupe env diagnostic warnings * Remove hardcoded URLs from OpenAI error tests Removed hardcoded URLs from network failure classification tests. * Update providerConfig.envDiagnostics.test.ts * fix(openai-shim): return successful responses and restore localhost classifier tests * Update src/services/api/openaiShim.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/services/api/openaiShim.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/services/api/openaiShim.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * feat(provider): add truthful local generation readiness checks Implement Phase 2 provider readiness behavior by adding structured Ollama generation probes, wiring setup flows to readiness states, extending system-check with generation readiness output, and updating focused tests. * feat(api): add local self-healing fallback retries Implement Phase 3 self-healing behavior for local OpenAI-compatible providers: retry base URL fallbacks for localhost resolution and endpoint mismatches, plus capability-gated toolless retry for tool-incompatible local models; include diagnostics and focused tests. * fix(api): address review blockers for local provider reliability * Update src/utils/providerDiscovery.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/services/api/openaiShim.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: harden readiness probes and cross-platform test stability * fix: refresh toolless retry payload and stabilize osc clipboard test * fix: harden Ollama readiness parsing and redact provider URLs --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-04-20 16:24:02 +08:00
lunamonke	4c50977f3c	Decouple and fix mistral (#595) ... * decouple and fix mistral * fix wrong variable for currentBaseUrl and buildAPIProviderProperties	2026-04-12 15:26:14 +08:00
3 people	ad724dc3a4	Improve GitHub Copilot provider: official OAuth onboarding, Copilot API routing, and test hardening and auto refresh token logic (#288) ... * update gitHub copilot API with offical client id and update model configurations * test: add unit tests for exchangeForCopilotToken and enhance GitHub model normalization * remove PAT token feature * test(api): harden provider tests against env leakage * Added back trimmed github auth token * added auto refresh logic for auto token along with test * fix: remove forked provider validation in cli.tsx and clear stale provider env vars in /onboard-github * refactor: streamline environment variable handling in mergeUserSettingsEnv * fix: clear stale provider env vars to ensure correct GH routing * Remove internal-only tooling from the external build (#352) * Remove internal-only tooling without changing external runtime contracts This trims the lowest-risk internal-only surfaces first: deleted internal modules are replaced by build-time no-op stubs, the bundled stuck skill is removed, and the insights S3 upload path now stays local-only. The privacy verifier is expanded and the remaining bundled internal Slack/Artifactory strings are neutralized without broad repo-wide renames. Constraint: Keep the first PR deletion-heavy and avoid mass rewrites of USER_TYPE, tengu, or claude_code identifiers Rejected: One-shot DMCA cleanup branch | too much semantic risk for a first PR Confidence: medium Scope-risk: moderate Reversibility: clean Directive: Treat full-repo typecheck as a baseline issue on this upstream snapshot; do not claim this commit introduced the existing non-Phase-A errors without isolating them first Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Not-tested: Full repo typecheck (currently fails on widespread pre-existing upstream errors outside this change set) * Keep minimal source shims so CI can import Phase A cleanup paths The first PR removed internal-only source files entirely, but CI provider and context tests import those modules directly from source rather than through the build-time no-telemetry stubs. This restores tiny no-op source shims so tests and local source imports resolve while preserving the same external runtime behavior. Constraint: GitHub Actions runs source-level tests in addition to bundled build/privacy checks Rejected: Revert the entire deletion pass | unnecessary once the import contract is satisfied by small shims Confidence: high Scope-risk: narrow Reversibility: clean Directive: For later cleanup phases, treat build-time stubs and source-test imports as separate compatibility surfaces Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (still noisy on this upstream snapshot) --------- Co-authored-by: anandh8x <test@example.com> * Reduce internal-only labeling noise in source comments (#355) This pass rewrites comment-only ANT-ONLY markers to neutral internal-only language across the source tree without changing runtime strings, flags, commands, or protocol identifiers. The goal is to lower obvious internal prose leakage while keeping the diff mechanically safe and easy to review. Constraint: Phase B is limited to comments/prose only; runtime strings and user-facing labels remain deferred Rejected: Broad search-and-replace across strings and command descriptions | too risky for a prose-only pass Confidence: high Scope-risk: narrow Reversibility: clean Directive: Remaining ANT-ONLY hits are mostly runtime/user-facing strings and should be handled separately from comment cleanup Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (upstream baseline remains noisy) Co-authored-by: anandh8x <test@example.com> * Neutralize internal Anthropic prose in explanatory comments (#357) This is a small prose-only follow-up that rewrites clearly internal or explanatory Anthropic comment language to neutral wording in a handful of high-confidence files. It avoids runtime strings, flags, command labels, protocol identifiers, and provider-facing references. Constraint: Keep this pass narrowly scoped to comments/documentation only Rejected: Broader Anthropic comment sweep across functional API/protocol references | too ambiguous for a safe prose-only PR Confidence: high Scope-risk: narrow Reversibility: clean Directive: Leave functional Anthropic references (API behavior, SDKs, URLs, provider labels, protocol docs) for separate reviewed passes Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (upstream baseline remains noisy) Co-authored-by: anandh8x <test@example.com> * Neutralize remaining internal-only diagnostic labels (#359) This pass rewrites a small set of ant-only diagnostic and UI labels to neutral internal wording while leaving command definitions, flags, and runtime logic untouched. It focuses on internal debug output, dead UI branches, and noninteractive headings rather than broader product text. Constraint: Label cleanup only; do not change command semantics or ant-only logic gates Rejected: Renaming ant-only command descriptions in main.tsx | broader UX surface better handled in a separate reviewed pass Confidence: high Scope-risk: narrow Reversibility: clean Directive: Remaining ANT-ONLY hits are mostly command descriptions and intentionally deferred user-facing strings Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (upstream baseline remains noisy) Co-authored-by: anandh8x <test@example.com> * Finish eliminating remaining ANT-ONLY source labels (#360) This extends the label-only cleanup to the remaining internal-only command, debug, and heading strings so the source tree no longer contains ANT-ONLY markers. The pass still avoids logic changes and only renames labels shown in internal or gated surfaces. Constraint: Update the existing label-cleanup PR without widening scope into behavior changes Rejected: Leave the last ANT-ONLY strings for a later pass | low-cost cleanup while the branch is already focused on labels Confidence: high Scope-risk: narrow Reversibility: clean Directive: The next phase should move off label cleanup and onto a separately scoped logic or rebrand slice Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (upstream baseline remains noisy) Co-authored-by: anandh8x <test@example.com> * Stub internal-only recording and model capability helpers (#377) This follow-up Phase C-lite slice replaces purely internal helper modules with stable external no-op surfaces and collapses internal elevated error logging to a no-op. The change removes additional USER_TYPE-gated helper behavior without touching product-facing runtime flows. Constraint: Keep this PR limited to isolated helper modules that are already external no-ops in practice Rejected: Pulling in broader speculation or logging sink changes | less isolated and easier to debate during review Confidence: high Scope-risk: narrow Reversibility: clean Directive: Continue Phase C with similarly isolated helpers before moving into mixed behavior files Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (upstream baseline remains noisy) Co-authored-by: anandh8x <test@example.com> * Remove internal-only bundled skills and mock helpers (#376) * Remove internal-only bundled skills and mock rate-limit behavior This takes the next planned Phase C-lite slice by deleting bundled skills that only ever registered for internal users and replacing the internal mock rate-limit helper with a stable no-op external stub. The external build keeps the same behavior while removing a concentrated block of USER_TYPE-gated dead code. Constraint: Limit this PR to isolated internal-only helpers and avoid bridge, oauth, or rebrand behavior Rejected: Broad USER_TYPE cleanup across mixed runtime surfaces | too risky for the next medium-sized PR Confidence: high Scope-risk: moderate Reversibility: clean Directive: The next cleanup pass should continue with similarly isolated USER_TYPE helpers before touching main.tsx or protocol-heavy code Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (upstream baseline remains noisy) * Align internal-only helper removal with remaining user guidance This follow-up fixes the mock billing stub to be a true no-op and removes stale user-facing references to /verify and /skillify from the same PR. It also leaves a clearer paper trail for review: the deleted verify skill was explicitly ant-gated before removal, and the remaining mock helper callers still resolve to safe no-op returns in the external build. Constraint: Keep the PR focused on consistency fixes and reviewer-requested evidence, not new cleanup scope Rejected: Leave stale guidance for a later PR | would make this branch internally inconsistent after skill removal Confidence: high Scope-risk: narrow Reversibility: clean Directive: When deleting gated features, always sweep user guidance and coordinator prompts in the same pass Tested: bun run build Tested: bun run smoke Tested: bun run verify:privacy Tested: bun run test:provider Tested: bun run test:provider-recommendation Not-tested: Full repo typecheck (upstream baseline remains noisy; changed-file scan still shows only pre-existing tipRegistry errors outside edited lines) * Clarify generic workflow wording after skill removal This removes the last generic verification-skill wording that could still be read as pointing at a deleted bundled command. The guidance now talks about project workflows rather than a specific bundled verify skill. Constraint: Keep the follow-up limited to reviewer-facing wording cleanup on the same PR Rejected: Leave generic wording as-is | still too easy to misread after the explicit /verify references were removed Confidence: high Scope-risk: narrow Reversibility: clean Directive: When removing bundled commands, scrub both explicit and generic references in the same branch Tested: bun run build Tested: bun run smoke Not-tested: Additional checks unchanged by wording-only follow-up --------- Co-authored-by: anandh8x <test@example.com> * test(api): add GEMINI_AUTH_MODE to environment setup in tests * test: isolate GitHub/Gemini credential tests with fresh module imports and explicit non-bare env setup to prevent cross-test mock/cache leaks * fix: update GitHub Copilot base URL and model defaults for improved compatibility * fix: enhance error handling in OpenAI API response processing * fix: improve error handling for GitHub Copilot API responses and streamline error body consumption * fix: enhance response handling in OpenAI API shim for better error reporting and support for streaming responses * feat: enhance GitHub device flow with fresh module import and token validation improvements * fix: separate Copilot API routing from GitHub Models, clear stale env vars, honor providerOverride.apiKey * fix: route GitHub GPT-5/Codex to Copilot API, show all Copilot models in picker, clear stale env vars * fix GitHub Models API regression * feat: update GitHub authentication to require OAuth tokens, normalize model handling for Copilot and GitHub Models * fix: update GitHub token validation to support OAuth tokens and improve endpoint type handling --------- Co-authored-by: Anandan <anandan.8x@gmail.com> Co-authored-by: anandh8x <test@example.com>	2026-04-08 16:03:31 +08:00
Christian Schimetschka	2031c67d46	refactor: improve error response for non-available models (#298)	2026-04-04 10:15:27 +08:00
Vasanth T	7c0ea68b65	fix: address code scanning alerts (#240)	2026-04-03 14:52:35 +05:30
Kevin Codex	903a30916a	Merge pull request #107 from rithulkamesh/main ... feat: GitHub Models provider + interactive onboard (keychain-backed)	2026-04-02 20:14:51 +08:00
Kevin Codex	6b7c0e5339	Merge pull request #74 from Vect0rM/feature/atomic-chat-integration ... feat: add support for Atomic Chat provider	2026-04-02 20:13:37 +08:00
Rithul Kamesh	0a42839475	fix(github): address PR feedback for onboarding flow ... - Set competing provider flags to undefined in updateSettingsForSource to ensure clean GitHub boot - Fix resolveProviderRequest to default to github:copilot when OPENAI_MODEL is unset - Hydrate secure tokens and managed settings in system-check.ts to prevent false negatives - Add models:read scope to GitHub device flow	2026-04-02 15:38:54 +05:30
Misha Skvortsov	3b7b9740f2	fix: update OPENAI_API_KEY message and add Atomic Chat URL check ... - Updated the message for the OPENAI_API_KEY check to include Atomic Chat as an allowed local provider. - Introduced a new function to check if the base URL corresponds to Atomic Chat, enhancing the system's ability to identify local providers. - Adjusted the Ollama processor mode check to skip processing when an Atomic Chat local provider is detected.	2026-04-02 10:37:54 +03:00
Rithul Kamesh	25c5987276	feat: add support for GitHub Models provider ... - Introduced environment variable CLAUDE_CODE_USE_GITHUB to enable GitHub Models. - Added checks for GITHUB_TOKEN or GH_TOKEN for authentication. - Updated base URL handling to include GitHub Models default. - Enhanced provider detection and error handling for GitHub Models. - Updated relevant functions and components to accommodate the new provider.	2026-04-02 11:25:28 +05:30
Raj Rasane	9590066b5b	fix: gracefully handle Docker/remote Ollama in system-check ... When Ollama runs inside Docker or a remote container, the native 'ollama ps' command is unavailable on the host. Instead of hard-failing and blocking CLI startup, downgrade to a pass() with a warning when the HTTP ping has already confirmed the server is reachable.	2026-04-02 11:04:35 +05:30
gnanam1990andClaude Sonnet 4.6	a3d8ab0fec	feat: add native Gemini provider for Google AI models ... Adds Google Gemini as a first-class provider using Gemini's OpenAI-compatible endpoint, supporting gemini-2.0-flash, gemini-2.5-pro, and gemini-2.0-flash-lite across all three model tiers (opus/sonnet/haiku). - Add 'gemini' to APIProvider type with CLAUDE_CODE_USE_GEMINI env detection - Map all 11 model configs to appropriate Gemini models per tier - Route Gemini through existing OpenAI shim (generativelanguage.googleapis.com) - Support GEMINI_API_KEY and GOOGLE_API_KEY for authentication - Fix model display name to show actual Gemini model instead of Claude fallback - Add Gemini support to provider-launch, provider-bootstrap, system-check scripts - Add dev:gemini npm script for local development Bootstrap: bun run profile:init -- --provider gemini --api-key <key> Launch: bun run dev:gemini Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-01 17:38:30 +05:30
vp	cbeed0f76f	Add Codex plan/spark provider support	2026-04-01 10:44:35 +03:00
Reservieren	009c29d318	refactor: update import paths for react/compiler-runtime to react-compiler-runtime ... feat: add OpenClaude local agent playbook for setup and usage instructions chore: implement provider bootstrap script for profile initialization chore: create provider launch script to manage provider execution chore: add system check script for runtime diagnostics and validation feat: implement useEffectEventCompat hook for React 18 compatibility	2026-03-31 22:09:56 -03:00