Commit graph

6 commits

Author SHA1 Message Date
zmf
8a527fec91 fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction
- resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search)
- fresh-install remote login with default password returns 403 without issuing a JWT
- /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads
- declare chalk and prop-types in package.json (used but previously undeclared)
2026-08-13 11:50:25 +07:00
decolua
9be6588cc8 chore: drop source-attribution comments from provider code
Remove "Ported from OmniRoute" and cockpit-tools attribution comments.
User-Agent strings and README/landing credits are left intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-29 21:05:23 +07:00
newnol
ce6bdf7fc2 feat(perplexity): add Agent API provider (#2492)
Add perplexity-agent provider using OpenAI-compatible Responses API,
routing third-party models (GPT, Claude, Gemini, Grok, GLM, Kimi, Sonar)
through one endpoint. Expose /v1/models discovery, add chat-search wrapper
via web_search tool. Existing Sonar provider unchanged.
2026-07-10 11:57:15 +07:00
decolua
e53ce79abb refactor(open-sse): B1 consolidate media endpoint URLs into registry
- image/embed/tts/search base URLs derive from media.*Config.baseUrl /
  searchViaChat.endpoint (single source); handlers read PROVIDER_MEDIA.
- ~18 hardcoded endpoints moved: bfl/fal/stability/runway/hf/gemini/
  cloudflare/recraft/sdwebui/comfyui/nanobanana image, voyage embed,
  gemini/openrouter tts, chatSearch endpoints.
- Byte-identical: PROVIDERS 62 + alias 90 baselines, image buildUrl outputs.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-14 13:58:12 +07:00
decolua
bb9e9aa91f refactor(open-sse): registry consolidation + DRY media/oauth/adhoc cleanup
- Single-source registry: oauth clientId/tokenUrl, usage URLs, image/embed
  configs, search defaultModel, codex fixedPort, google token url derive.
- Remove 29 unused OmniRoute providers (registry 100→71); media intact.
- De-adhoc: codex literals → registry format/oauth flags; reasoningInject,
  image/embed openrouter headers + xai bodyFields config-driven.
- Add REGISTRY_TEMPLATE.js + expand PROVIDER_DEFAULTS/schema JSDoc.
- Baselines updated; PROVIDERS 62 + alias 90 byte-for-byte, golden snapshots.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-14 13:15:48 +07:00
decolua
8f81363675 Enhance token refresh functionality across multiple executors
- Updated refreshCredentials methods in various executors (Antigravity, Base, Default, Github, Kiro) to accept optional proxyOptions for improved proxy handling.
- Modified token refresh logic to utilize proxy-aware fetch for better network management.
- Enhanced usage retrieval functions to support proxy options, ensuring seamless integration with proxy configurations.
- Updated ModelSelectModal and ProviderInfoCard components to incorporate kind filtering for improved user experience in model selection.
- Added validation for API keys in the provider validation route, including support for webSearch/webFetch providers.
2026-04-28 17:28:57 +07:00