[zhiru]

Summary

Adds a defensive sanitizer for VS Code-compatible tokenized endpoints so implicit active-editor context is stripped before requests are forwarded to model providers. Explicit attachments remain available, while common sensitive file contexts are redacted.

Why

VS Code/Copilot-compatible clients can include active editor/current file context even when users only intended to attach a different file. Forwarding that implicit context can accidentally expose unrelated or sensitive files to upstream model providers.

Changes

• Add sanitizeVscodeRequestBody / sanitizeVscodeRequest for tokenized VS Code routes.
• Strip implicit editor-context keys such as editorContext, activeEditor, currentFile, selection, and visible/open editor metadata.
• Preserve explicit attachment/reference payloads.
• Redact content for sensitive paths such as .env, private keys, kubeconfig, credentials/secrets, and server-access.md.
• Apply sanitization to normal and raw VS Code chat, responses, v1 chat, and Ollama-compatible /api/chat tokenized routes.
• Add unit tests for explicit attachments, implicit editor stripping, sensitive redaction, text-block stripping, and request rewriting.

Validation

• node --import tsx/esm --test tests/unit/vscode-context-sanitizer.test.ts
• node --import tsx/esm --test tests/unit/vscode-token-routes.test.ts
• npx eslint <changed files>
• npm run typecheck:core

Security

The default is secure-by-default. The sanitizer can only be disabled explicitly with OMNIROUTE_VSCODE_SANITIZE_CONTEXT=0. File contents are not logged by this change.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[diegosouzapw]

Thanks for this, @zhiru! 🙏 Solid secure-by-default addition — stripping implicit active-editor context on the tokenized VS Code routes closes a real leakage path, and I appreciate the explicit-attachment preservation + object-level sensitive-file redaction.

Before merging I pushed two small review fixes to your branch (co-authored, your authorship preserved):

1. Narrowed the free-form text scan. The bare-word sensitive patterns (credentials/kubeconfig/secrets) were applied to all text values, so a normal prompt like "how do I store API credentials?" got partially redacted to [REDACTED SENSITIVE CONTEXT]. Those words still flag a sensitive file path at the object level (the redactSensitiveObject path+content redaction is untouched) — only the text scan is now restricted to the anchored filename/extension patterns. Added a regression test proving prose mentioning credentials/secrets is preserved, plus one proving structured sensitive paths (e.g. ~/.aws/credentials) are still redacted.
2. Documented OMNIROUTE_VSCODE_SANITIZE_CONTEXT in .env.example and docs/reference/ENVIRONMENT.md so the check:env-doc-sync contract stays green.

Validated locally: sanitizer tests 7/7, existing vscode-token-routes 37/37, typecheck:core, env-doc-sync, and the Fast Quality Gates all pass. Merged into release/v3.8.29 — it'll ship in the upcoming release. 🚀