elky
cf8ea19856
fix: harden OAuth identity and cookies and correct quota and JSON display
2026-09-08 10:51:25 +08:00
elky
7113d04f8a
fix(usage): preserve original captured HTTP headers
2026-09-08 08:49:35 +08:00
elky
099b810a2f
feat: optimize usage body viewing and provider card layout
2026-09-08 02:49:06 +08:00
elky
7aa0c89244
fix(gateway): restore HTTP and WS upstream support
2026-09-07 22:15:05 +08:00
elky
7847ae98c6
fix(gateway): reset stream first-byte timeout per candidate
2026-09-07 21:56:16 +08:00
elky
a90d564931
fix: restore security hardening compatibility and validation
...
Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.
2026-09-07 21:14:27 +08:00
elky
ec95f2ca1f
fix(tunnel): prevent stream stalls and harden session cleanup
...
Reliably deliver flow-control credits and terminal states, isolate slow streams and heartbeats, negotiate stream windows, and clean up cancelled streams and session tasks.
Add regression coverage for queue pressure, early cancellation, small-window streaming, drain, and reconnect. Validate 185 agent tests, 88 gateway tunnel tests, and 21 protocol tests.
2026-09-07 15:39:40 +08:00
elky
a26680f460
fix(modules): restore legacy SMTP password migration
2026-09-07 12:07:53 +08:00
elky
522b979052
refactor(transport): remove provider DNS filtering and allowlist settings
2026-09-07 12:07:50 +08:00
elky
741107bf71
fix(transport): make provider DNS address filtering opt-in
2026-09-07 11:18:31 +08:00
elky
062e111c03
fix(observability): preserve admin upstream error diagnostics
2026-09-07 10:39:48 +08:00
elky
14f96c9fa0
fix(providers): preserve health in redacted key summaries
2026-09-07 08:53:41 +08:00
elky
6948852992
fix(release): support atomic installation on musl Linux
2026-09-07 01:07:34 +08:00
elky
2281f2b754
refactor(data): remove MySQL and SQLite support
...
Use PostgreSQL as the only database backend across runtime, schema tooling, installation, Compose, and CI. Update regression tests and reject removed drivers explicitly.
2026-09-07 00:09:42 +08:00
elky
b5ed802277
chore(codex): bump default client version to 0.153.4
2026-09-06 19:58:35 +08:00
elky
d1b5eb08ee
fix(providers): correct endpoint health aggregation and display
2026-09-06 18:24:27 +08:00
elky
dba5e6e9e9
feat: expose remote control as admin module
2026-09-06 00:13:57 +08:00
elky
9d7a0665c0
Merge remote-tracking branch 'origin/main' into codex/provider-policy-hardening
2026-09-05 16:21:10 +08:00
elky
e29442a06a
merge(main): resolve subscription usage policy conflicts
2026-09-05 14:21:16 +08:00
elky
e15ea0d5d3
fix(security): configure trusted Fake-IP DNS hosts
2026-09-05 14:05:07 +08:00
ZheFox
2f374d6af2
Merge pull request #802 from zhefox/fix/codex-catalog-ci
...
fix(ci): route Codex fingerprint through ai_serving facade
2026-09-05 13:43:28 +08:00
ZheFox
4a356f4ea5
fix(ci): access Codex version through the gateway serving facade
2026-09-05 13:33:20 +08:00
ZheFox
c7676d567d
Merge pull request #801 from zhefox/fix/codex-admin-model-catalog
...
fix(codex): refresh fingerprints and unify management model catalogs
2026-09-05 13:18:47 +08:00
ZheFox
5ca4f87951
fix(codex): unify management model catalogs and refresh fingerprints
2026-09-05 13:14:24 +08:00
elky
92749b4d6e
fix(models): classify external catalog fetch failures
2026-09-05 04:56:29 +08:00
elky
e420bc6324
fix(ci): make postgres bootstrap tests apply pending migrations
2026-09-05 04:45:07 +08:00
elky
d723fb92d3
fix(image): validate signatures and preserve output mime
2026-09-05 04:08:20 +08:00
elky
5b1de5f921
fix(tunnel): allow exact private relay hosts
2026-09-05 03:57:02 +08:00
elky
af712ebdbf
test(gateway): keep capture limit fixtures test-only
2026-09-05 03:35:56 +08:00
elky
33d5cd5993
fix(ci): align lint-safe security paths
2026-09-05 03:19:53 +08:00
elky
f5e1420ee6
fix(runtime): tolerate Linux socket device identity
2026-09-05 02:43:42 +08:00
elky
9ff4d73d5c
fix(merge): align security contracts with latest main
2026-09-05 01:31:21 +08:00
elky
0e3bd7eff4
merge(main): sync latest main into security branch
2026-09-05 00:30:16 +08:00
elky
cdbbda40a6
fix(tunnel): guard private owner relay targets
2026-09-04 23:44:46 +08:00
stabey and Claude Opus 5
a6dc43d5f6
fix(antigravity): wrap cross-format requests in the v1internal envelope
...
The gemini:generate_content URL hook rewrites any Antigravity endpoint to
/v1internal:generateContent, but only the same-format passthrough and the two
OpenAI decision paths ever built the matching envelope. A Claude Messages or
Gemini client therefore reached the standard family planner, picked up the
rewritten URL, and posted a bare Gemini body that upstream rejects with
"Invalid JSON payload received. Unknown name \"contents\"" -- four retries
across every account, then a 503 that names none of this.
Route the standard family through the shared v1internal builder the same way
gemini_cli already is, so the URL and the body come from one decision. The
OpenAI-image-to-Gemini path cannot carry an envelope at all, so it now skips
Antigravity candidates instead of sending a request upstream can only reject.
Also stop treating a configured proxy as locally unsupported. The execution
plan carries the proxy itself, and the generic and Vertex gates moved to
transport_proxy_is_locally_supported long ago; Antigravity kept rejecting on
proxy.is_some(), which no longer matches how the local runtime executes. A
proxy that resolves to no route still disqualifies the request, and transport
profiles stay unsupported because the v1internal payload never carries one.
Co-Authored-By: Claude Opus 5 <[email protected]
2026-09-04 22:53:09 +08:00
elky
c6718754d3
fix(metrics): redact upstream admission target labels
2026-09-04 22:25:36 +08:00
elky
d5f54ffe8b
fix(image): scope synthetic DNS to ChatGPT storage
2026-09-04 21:41:14 +08:00
elky
f5ec76c5c8
fix(models): isolate legacy catalog rows during fetch
2026-09-04 21:31:57 +08:00
elky
507cb33089
fix(workers): isolate malformed catalog proxy rows
2026-09-04 21:12:01 +08:00
elky
b08fa3bdb6
fix(network): preserve remote DNS semantics for SOCKS proxies
2026-09-04 21:10:55 +08:00
ZheFox and stabey
57cdef4b8d
fix(gateway): harden cross-format sync finalization
...
Co-authored-by: stabey <[email protected]
2026-09-04 19:53:26 +08:00
elky
36e9d21e3f
fix(logging): sanitize transport error display
2026-09-04 19:49:01 +08:00
elky
b72b6ab137
fix(workers): isolate legacy catalog credentials
2026-09-04 19:42:10 +08:00
elky
7c5cce4b3c
fix(logging): redact oauth retry transport errors
2026-09-04 19:10:03 +08:00
elky
9362c34fcd
fix(network): cover regional Kiro service origins
2026-09-04 19:09:46 +08:00
elky
e89c3aa674
fix(models): resolve external catalog through configured proxy
2026-09-04 18:56:34 +08:00
elky
d6894b5532
fix(oauth): tolerate synthetic DNS for trusted identity origins
2026-09-04 18:08:32 +08:00
elky
635c6765d9
fix(network): scope synthetic DNS exceptions for oauth and payments
2026-09-04 18:08:22 +08:00
ZheFox
86f7cc0d58
test(gateway): satisfy Rust 1.95 integer lint
2026-09-04 18:01:19 +08:00
ZheFox
206995645b
fix(gateway): share stream first-byte deadline across retries
2026-09-04 18:01:19 +08:00
elky