[skygunner]

Fixes #18632.

src/shared/utils/inputSanitizer.ts resolved INPUT_SANITIZER_ENABLED and PII_REDACTION_ENABLED straight from process.env, so a dashboard Feature Flags override (persisted in the key-value store) never took effect — an operator toggling a security-relevant switch saw no behavior change until the env was edited and the process restarted. The sibling guardrail (promptInjection.ts::getMode) already reads INJECTION_GUARD_MODE through getFeatureFlagOverride() with env fallback; this applies the same pattern to the sanitizer's two registered flags.

Details:

• getConfig() reads the DB override first for both registered flags (INPUT_SANITIZER_ENABLED default "true", PII_REDACTION_ENABLED default "false" — definitions untouched, per the opt-in Hard Rule for PII flags), then falls back to the env var, then the existing default. Behavior is byte-identical for every deployment with no override stored.
• INPUT_SANITIZER_MODE is intentionally left env-only: it has no registered feature-flag definition, so setFeatureFlagOverride rejects it and the dashboard cannot set it (the issue listed it among env reads, but only the two keys above are registered flags).
• The DB read is wrapped in try/catch: an unavailable flag store falls back to the env-based behavior (fail-safe to today's semantics).

The second commit ratchets config/quality/api-typecheck-baseline.json to the live 246 errors (22 baselined errors no longer exist at this tip; identical to the ratchet commit in #18634). It makes the API Route Typecheck job pass on branches cut from the current release/v3.8.53.

Validation:

• New tests/unit/input-sanitizer-flag-overrides-18632.test.ts (drives sanitizeRequest): before the fix, 3 cases fail — dashboard disable suppresses scanning even with INPUT_SANITIZER_ENABLED=true in env, and dashboard PII-redaction override redacts without any env var; after the fix 3/3 pass, including the regression guard that the env fallback still works with no override stored.
• Adjacent sanitizer/injection suites (security-fase01, pii-gdpr-popia-patterns, pii-per-type-selection, injection-guard-scan-bound-3932, injection-system-prompt-leak-heuristic-4041, prompt-injection-invalid-pattern-16189): 75/75 pass.
• npm run typecheck:core clean; node scripts/check/check-api-typecheck.mjs OK on the ratcheted baseline; Prettier clean; ESLint clean on changed files.

---

⚠️ Inherited base-red (not caused by this PR). The remaining failing checks reproduce on the pristine upstream/release/v3.8.53 tip b2a64106c9 with no changes applied:

• scripts-direct-run-guard.test.ts: scripts/cli/omniroute-sso.mjs still uses the non-portable `file://${process.argv[1]}` guard (verified by running the test in a detached worktree at the tip: same failure).
• check-docs-counts-sync.test.ts: 7 STRICT drifts at the tip — provider count 377 vs real 380 (AGENTS.md, llm.txt, agentSkills.ts, skills/omni-auth, skills/omni-providers) and migrations 213 vs real 219 (AGENTS.md, llm.txt).
• Lint: npm audit reports 68 vulnerabilities from the base lockfile (same output on the base branch).
• Merge integrity: the agent-skills dry-run at the tip regenerates 4 skills (same drift as the provider count above).
• The Docs/Quality gate jobs aggregate those same failures; the base branch's own Release-Green run is failing at b2a64106c9.

No base-red issue is currently filed. Per the repository's rule I did not fold an inherited-failure fix into this PR.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: cheaper-inference/OmniRoute
• Branch: release/v3.8.53
• File: .coderabbit.yaml
• Commit: f000c11
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5a3fc09f-44e5-4cdd-a165-9c7f20846955

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts