Repository navigation
fix(docs): synchronize CLI and resilience contracts across locale mirrors - #16504
Merged
Merged
Conversation
This was referenced Oct 13, 2026
Collaborator
Author
|
Latest-base reconciliation, 2026-10-13 17:42 UTC: this PR's earlier exact-candidate evidence remains valid for its stated source revision, but a newly landed source edit requires another bounded locale delta before the latest release can be called synchronized. Release advanced from Owned current diagnostic board
This is a new source delta, not the older three-source repair already contained here. It must receive actual translated mirror updates and matching evidence, not a hash-only state adoption. No change to this PR head/body, CI workflow or baseline was made by this diagnostic. Current required remote checks and other product/fixture dependencies remain outstanding; no full-release acceptance is claimed. |
Contributor
CI Coverage Report
Coverage artifact was not available for this run. |
Collaborator
Author
|
Published the scoped CodeBuddy environment-mirror update at
This is scoped PASS / overall PARTIAL, not merge admission. The strict source-drift scan still fails on three newer English source deltas: Thanks to @ntdatt812 and @Azzt17 for the source behavior documented by this update. |
Base-red repair for release/v3.8.52 (#15306): undici 8 guarded dispatcher bridge, executeTargetAttempt type extraction (file-size), c8 incremental coverage merge, hosted webpack build fallback, and realignment of the unit/e2e fixtures the release contracts had outgrown. Locally validated on the merged head: 13 of the 14 unit assertions red on the pure tip pass, check:mutation-test-coverage and check:file-size (executeTargetAttempt) pass; the remaining reds on this head are release-tip base-reds (API typecheck #16624, four other file-size overages, count_tokens and model-test route fixtures). Refs #15306
…of import-json (#16491) The tip's #16479 put requireLogin, the manage-scope bypass keys and oidcEnabled / oidcDisablePasswordLogin / oidcClientSecret behind password re-auth and out of the legacy JSON import. Two gaps remained: 1. The rest of the OIDC identity config was still writable without the management password. A stolen dashboard session or manage-scope key could repoint dashboard login at an attacker-controlled IdP (oidcIssuer + oidcClientId), allowlist its own subject (oidcAllowedSubjects), or send the authorization code to another host (oidcRedirectPath "@attacker.example/cb"), and keep access after the password rotates. 2. import-json still wrote currentPassword, sessionsValidAfter and revokedDashboardSessions, so importing an older backup revived dashboard sessions that a password change or a sign-out had already ended. - Add oidcIssuer, oidcClientId, oidcAllowedSubjects, oidcRedirectPath and oidcScopes to SECURITY_IMPACTING_SETTINGS_KEYS (PATCH -> 400 PASSWORD_REQUIRED / 401 PASSWORD_MISMATCH without the right password). - Export DASHBOARD_SESSION_STATE_SETTINGS_KEYS and IMPORT_STRIPPED_SETTINGS_KEYS next to it; import-json strips the latter (password, currentPassword, every re-auth key, the session state). - Tests: every oidc* schema key is guarded; per-key 400/401/200; import-json drops the OIDC keys and the session state; a signed-out session stays dead after importing a pre-sign-out backup; the session-state names are pinned to the dashboardSessionToken constants. - Align oidc-settings-allowlist-guard: its accepted writes now send the management password (assertions unchanged). Co-authored-by: 123abab123789 <123abab123789@users.noreply.github.com>
…em /api/cli-tools/keys (#16654) * test(cli): RED - cli-tools keys must not return plaintext keys to machine credentials Co-authored-by: AndreAlmeidaDC <AndreAlmeidaDC@users.noreply.github.com> * fix(cli): stop returning plaintext API keys to machine credentials on /api/cli-tools/keys (GHSA-qx9v) Co-authored-by: AndreAlmeidaDC <AndreAlmeidaDC@users.noreply.github.com> --------- Co-authored-by: AndreAlmeidaDC <AndreAlmeidaDC@users.noreply.github.com>
…GHSA-p42h) (#16655) * test(db): reproduce JSON import resurrecting revoked keys and storing plaintext credentials (GHSA-p42h) * fix(db): preserve API key state and encrypt credentials on JSON settings import (GHSA-p42h) The JSON importer rewrote every API key from 8 columns, so revoked, expired and banned keys became valid again and their restrictions (scopes, allowlists, connection/combo access, rate and usage limits) were dropped. The key column list is now derived from the live api_keys schema, so every column present in the backup is restored and future columns are not silently lost. Connections were also written with plaintext credentials and lost group, max_concurrent, proxy_enabled, per_key_proxy_enabled, quota_visible and quota_window_thresholds. Credentials now go through encryptConnectionFields() and those columns are restored. Co-authored-by: xiaoyaner0201 <xiaoyaner0201@users.noreply.github.com> --------- Co-authored-by: xiaoyaner0201 <xiaoyaner0201@users.noreply.github.com>
…odeQL #1136) (#16616) The CodeQL incomplete-url-substring check compares the parsed hostname. The old assertion searched the URL string. Test only. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
Cloudflare Workers AI messages always include content. A tool-call turn whose content is missing or null is sent as an empty string, and tool_calls stay in place. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
… Gemini (#16644) A bare property-map tool schema is wrapped under properties before it is sent to Gemini. JSON Schema keywords stay where they are. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
…emini user turns (#16642) When consecutive Gemini user turns are merged, functionResponse parts stay last. Other parts keep their relative order and come first. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
…o OpenAI-hub providers (#16617) Claude document blocks survive translation to OpenAI-hub providers. A base64 document becomes a file part. Text and URL documents become text. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
…s credits_exhausted (#16675) GLM HTTP 429 code 1113 and new-api credit-exhaustion bodies park the connection as credits_exhausted. An ordinary HTTP 400 and GLM 1302 stay transient. The signal list moved to a new module, and accountFallback.ts shrinks. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
…lay (#16646) Once reasoning_content carries the replay, the reasoning alias is removed so an upstream serde schema does not see a duplicate field. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
…y provider (#16626) output_config.format stays on the official Anthropic API-key provider. Compatible providers still have that format stripped. The helper moved out of chatCore.ts, and that file shrinks. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
…ion bearer is present (#16483) A valid x-api-key or x-goog-api-key is accepted when an unrelated Authorization bearer is also present. Identity and API-key policy bind to the credential that validated. Credentials that fail validation still fail, and a valid bearer keeps precedence. Boarded on release/v3.8.52 at 88c1e33. Focused tests: 66 passed, 0 failed. File-size on this board reports four inherited tip overages this pull request does not touch: responseSanitizer.ts 1216 > 1214, error.ts 1218 > 1217, translator-openai-responses-req.test.ts 1476 > 1470, vscode-token-routes.test.ts 1268 > 1267.⚠️ base-red inherited: #15306
Collaborator
Author
|
Progress on the remaining real source deltas:
GUARDRAILS is still pending. Separately owned draft #16635 changes its video fallback contract beyond the originally planned scope; the final integration target must be settled before certifying translations for that source. #16634/#16635 also intersect currently failing integration tests. Their branches/worktrees were only read, not modified. Full exact-current-candidate CI and merge admission remain pending. These focused passes do not authorize a merge of a base-red candidate. |
#16643) * fix(mitm): serve and trust the active AgentBridge cert in root-CA mode GET /api/tools/agent-bridge/cert/download always streamed the legacy <DATA_DIR>/mitm/server.crt. Under the root-CA model (fresh installs, or MITM_ROOT_CA_ENABLED=true) the MITM server signs per-host leaves with ca.crt, so the file users downloaded (including via the #4546 manual-install guide, which links this endpoint) could never make interception work. The sibling GET/POST/DELETE /api/tools/agent-bridge/cert had the same hard-coded path: status reported no cert, trust returned 404, and untrust silently no-oped while the root CA stayed trusted. Both routes now resolve the file through resolveActiveMitmCert(), a thin wrapper over the existing resolveActiveCertPath() that reads MITM_ROOT_CA_ENABLED the same way manager.ts and the state/diagnose/server routes do. The download filename is mode-specific (omniroute-mitm-ca.crt vs omniroute-mitm.crt), and the not-found message in root-CA mode now says to start the bridge (the only path that mints the CA) instead of pointing at cert/regenerate, which mints a legacy leaf. The integration fixture that wrote a lone server.crt now writes the server.crt + server.key pair, which is what decideCertMigration() treats as a legacy install. * docs(changelog): add fragment for #16643
…6638) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (ee767e5).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
… keyless free models (#15540) (#16042) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (da88f98).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…16723) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (f83c6d9).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…wer (#16521) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (be96a63).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…ter, coalescing) (#16480) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (6ec49cf).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…es route (#16704) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (eeb30f5).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (bd32a68).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…reset (#16705) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (2135f8d).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
… output (#16495) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (85fc894).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (2b592b2).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (0a7ab95).⚠️ base-red inherited: #15306 Closes #16225 Thanks @diegosouzapw.
Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (7ccf491).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (1db721c).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (0b88490).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…) to non-Anthropic providers (#16720) Validated on local board 917689fb. The squash includes the type guard that narrows the Claude passthrough body before hoistDeferredToolsForTarget (head 99d62e8). The Claude passthrough case already passed on the board; the guard keeps open-sse typecheck inside the empty baseline.⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (0176042).⚠️ base-red inherited: #15306 Fixes #16220. Thanks @diegosouzapw.
Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (7b942e1).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
) Validated on local board 917689fb (batch-owner-1015) with the owner wave: static gates plus focused tests. This squash is that same head (48db7b5).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…tions (#16684) Validated on local board 917689fb. The squash includes the priority-helper narrowing so optional connection ids typecheck (head 83f0ffb). tests/unit/provider-connection-priority-updates.test.ts passed 7/7 after the change. Dashboard typecheck on the board rerun stayed inside the frozen baseline (195).⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…ive_finish_reason errors (#16524) Validated on local board 917689fb. merge-tree against the post-wave tip is clean. Head 766ed38.⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…l stall watchdog (#16722) Opt-in Claude delta coalescing, frame batching, and an interval stall watchdog. Everything stays off unless SSE_COALESCE_* / SSE_FRAME_COALESCE_MS / SSE_STALL_WATCHDOG=interval is set. Conflict with #16524 resolved in stream.ts: keep the landed idle-timer cancel and close outputSink.wrap(). Focused tests on the merged tree: sse-delta-coalesce, sse-output-coalescing, stream-stall-watchdog, and the passthrough finish helpers — 37 pass, 0 fail. Three-dot diff is the 11 PR files only. Head 9860ead. Thanks to @WYSTAF for the original delta-coalescing implementation, and to @wallerjenifernk530-hash for the frame-coalescing and stall-watchdog analysis.⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…16527) (#16696) Full backup export now writes a portable tar.gz inside an exclusive temp directory and deletes that directory on failure, so a drive-colon path is not treated as a remote archive and partial archives do not leak. Conflict with the operator-only export gate was the file comment. Kept tar.gz and the 403 note for API keys and oma_ tokens. Focused tests on the merged tree: backup-export-portability-16527 and log-export-routes — 7 pass, 0 fail. Three-dot diff is the 4 PR files. Head f673f0a. Closes #16527⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
…ared tool names (#16645) Map provider-injected tool-call prefixes (`functions.exec`) back to the declared tool name, on both the stream and the non-streaming Chat to Responses path. Undeclared names stay unchanged. Import conflict kept both sides: `finalizeResponsesTerminalStatus` from the release tip and the declared-tool-name helpers from this PR. Focused tests on the merged tree: responses-provider-prefix-tool-name — 10 pass, 0 fail. Thanks to @vianhanif for the original implementation.⚠️ base-red inherited: #15306 Thanks @diegosouzapw.
Keep tip translation hashes where the tip moved, and record hashes for locale files this merge actually changed.
diegosouzapw
added a commit
that referenced
this pull request
Oct 18, 2026
…port, route-guard locale proof, parseModel alias, family-fallback consent (#17007) * test(sse): align the parseModel cache-key expectation with the #16811 Opus 4.5 contract #16811 made the provider-qualified `anthropic/claude-opus-4.5` alias keep its `anthropic` prefix and resolve to the dashed wire ID (`claude-opus-4-5`), leaving only the bare alias on the dated snapshot. It updated its own regression test but not this sibling from #16341, which still expected `provider: null`, `claude-opus-4-5-20251101`, `isAlias: true`. The compat on/off results still differ, which is what the cache-key test is about. Refs #15306 * test(docs): bound the route-guard locale proof by the current paragraph order #16691 moved the deny-list test reference ahead of the regex companion constant in docs/security/ROUTE_GUARD_TIERS.md; the mirrors followed, but this test (from #16504) still searched for that reference AFTER `SPAWN_CAPABLE_PATTERN_ANCESTORS` and reported "missing localized policy proof" for all 66 locales. The window now runs from the Kiro auto-import deny-list entry to the regex companion and asserts the deny-list proof inside it; all 66 mirrors pass and the English-fallback and hash checks are unchanged. Refs #15306 * fix(mcp): keep apiKeyPolicy and next/headers out of the MCP server bundle's import time `git bisect` on tests/unit/build/mcp-bundle-startup.test.ts lands on #16810, which made src/shared/utils/modelFallbackAuthorization.ts import `resolveEnforcedPolicyKey` from apiKeyPolicy. That module is reached from open-sse (modelFamilyFallbackPolicy), so the MCP server bundle started carrying apiKeyPolicy → apiAuth → `next/headers` (esbuild hoists the external import; plain Node cannot resolve it) and, once that is out of the way, an async init cycle around sse/services/auth that leaves the import with an unsettled top-level await (exit 13). #16499 then opened a second path into apiKeyPolicy through keyConnectionScope → comboTargetKeyPolicy on the embeddings service. Load the three edges lazily, at the call sites that are already async: modelFallbackAuthorization and keyConnectionScope import apiKeyPolicy / comboTargetKeyPolicy inside the functions that use them, and apiAuth imports `next/headers` only when it actually falls back to the request cookie store. The bundle imports again on Node 24 and the request paths are unchanged. Refs #15306 * test(chat): opt the family-fallback effort cases into the #16810 cross-version consent #16810 gated the internal cross-version family hop behind `x-omniroute-allow-cross-version-fallback: true`; without it an empty-content answer from claude-sonnet-4.6 is returned as 502 instead of being recovered on claude-sonnet-4.5. The three "empty family fallback preserves only explicit effort" cases (from #13720) exercise exactly that hop and never sent the header, so they failed with `502 !== 200` after 24s. Send the opt-in; the effort propagation they assert is unchanged. Refs #15306
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three documentation additions reached the release without their translated mirrors: four CLI environment variables (#16441), the cold-start quality-tracker note (#16408), and pre-dispatch model-cooldown recovery (#16360 / #16319). The strict translation checker therefore reports three changed sources.
This updates the corresponding 198 mirrors across 66 locales with the reviewed technical contracts and preserves their existing translated prose. The two bounded repair utilities verify the exact source delta and every old target hash before writing, reject unsafe locale paths, and update the canonical section/source/target provenance only after preparing the content. The other 163 source records are unchanged. No translation API calls are needed.
Credit to @pacocartones, @maxmad64bis and @skygunner for the original documentation and behavior changes.
Validation:
ac590dafa6and the Relay candidate; no targets were missing or independently modified.e2d5747872; publication head3643b2b6e8045a43daa032b2131c9ec4b95c53f6, tree03518d489b29c296c8805c8f61cacae5a877db1a: all eight new contracts PASS, strict i18n PASS with zero drift/missing/stale, changelog integrity PASS, anti-test-masking PASS and whitespace PASS.Full admission is still pending.
check:docs-allindependently fails on the benchmark-onlyMODEL_VARIANTreference introduced by #16355; the same signature was reproduced on pure ac590. PR #16506 fixes that independent defect. The pure ac590 base also has 20 generated skills awaiting synchronization, covered by the original generator PRs #15945/#15948. Dependencies were physical hard links from a prior completed clean install with the same lockfile, so the local receipts do not establish a new clean installation.Interaction validation: current release
47688ba5eaplus the five published heads (#15945, #15948, #15682, this PR and #16506) produced local candidate43479bca09cba5ace3e6cc3c1ce5bd3264711453, tree413f21f64a55862d7619a63e5f2ed7ddc0ff9131. It passes 108 focused tests, core typecheck, complete docs validation, strict i18n (10,032 targets, zero drift/missing/stale), generated skills (46 unchanged, zero pending/errors), changelog integrity and whitespace. This proves the scoped interaction; actual PR landings still require their current applicable CI results.