feat: api key token control + qol - #1107
Open
AntiTamper wants to merge 25 commits into
Open
Conversation
AntiTamper
force-pushed
the
feature/api-key-token-control-qol
branch
from
May 15, 2026 11:42
cb07dab to
1afcc1b
Compare
- Adapt PR decolua#1247: gate /api/v1 and /api/v1beta as public LLM APIs; require API key for remote access - Replace spoofable Host/Origin local-only check with CLI token requirement - Add dynamic CORS helper (src/lib/cors.js) for LLM API routes - Expand sanitizeHeaders and add sanitizeBody in requestDetailsRepo to redact secrets - Hash apiKey before persistence in usageRepo (SHA-256) - Replace unbounded global state in usageRepo with module-local bounded caps - Fix requestDetailsRepo flushTimer leak and deduplicate shutdown handlers - Bound codex.js assistantSessionMap to 5k entries; unref cleanup interval - Add streamHandler abortTimeout cleanup - Cap notificationStore at 50 items; track and clear dismiss timers - Mobile UI: viewport meta, safe-area CSS, responsive toast width, table padding reduction - Add dashboard-guard unit tests
This was referenced Jun 5, 2026
… pipeline - Unconditional reasoning_content stripping broke thinking models for OpenAI clients. Now only strips for Firecrawl AI SDK or x-strip-reasoning header. - hasValuableContent now recognizes delta.reasoning and delta.thinking. - stream.js passthrough + translate paths accumulate from all reasoning fields. - openai-responses.js and responsesTransformer.js normalize reasoning/thinking. - sseToJsonHandler.js extracts reasoning from all fields + conditional stripping. - streamingHandler.js shows thinking instead of [Empty streaming response]. - Added FORMATS.KIMI and kimi-to-openai translator registration. - Fixed test import path. All 455 tests pass.
…e.content fallbacks - streamToJsonConverter.js: process output_text.delta and reasoning_summary_text.delta events to accumulate text/reasoning when output_item.done is incomplete. - sseToJsonHandler.js: extract reasoning from Codex response output items. Add delta.message?.content fallback for non-standard providers. - stream.js: passthrough + translate paths use delta.message?.content fallback. - streamHelpers.js: hasValuableContent recognizes delta.message?.content. - openai-responses.js + responsesTransformer.js: delta.message?.content fallback. All 455 tests pass.
…imi→Codex context window corruption
…act actually triggers TOON compression
AntiTamper
force-pushed
the
feature/api-key-token-control-qol
branch
from
June 25, 2026 03:25
8bc5c7a to
a033cc3
Compare
…ipeline
- streamToJsonConverter: handle delta as string OR {text:...} (extractDeltaText helper)
- streamToJsonConverter: fall back to parsed.item?.id when item_id missing on output_item.done
- responsesTransformer: emit delta: {text} for reasoning/output_text deltas (spec compliant)
- openai-responses.js: emit delta: {text} for reasoning/output_text; read back robustly
Fixes: thinking/reasoning content lost in non-streaming Codex path; output_item.done
merge never firing when item_id missing from transformer-emitted events.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Synced this with the latest master and kept the API key/quota work in place.
What's in here:
Checked with lint, unit tests, build, API smoke, dashboard smoke, and a real Claude CLI smoke through Kimi Code.