dev_agentandClaude Opus 5.5 3ddc18fa0d Redact the API key from all config errors and reject empty URL delimiters ...

An invalid extra-header name is no longer echoed, and every other New
error that quotes caller-supplied text (structured output mode, header
names) has the API key redacted first via a shared redactKey helper, also
used for transport errors.

A base URL containing "?" or "#" is rejected even when the query or
fragment is empty, so endpoint paths can no longer land in either.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-03 16:45:44 -04:00

..

ai/llm

Redact the API key from all config errors and reject empty URL delimiters

2026-10-03 16:45:44 -04:00

auth

Feature 03 integration fix: sanitize ID-token verification errors (#26)

2026-10-03 11:32:36 -04:00

config

Feature 04 task 3 (rebased): Household settings seeding and API (#27)

2026-10-03 11:50:15 -04:00

db

Feature 04 task 5: Async job runner and GET /api/v1/jobs/{id} (#29)

2026-10-03 15:24:01 -04:00

forwarded

Feature 03 task 5: Trusted proxy handling for forwarded headers (#23)

2026-10-03 11:05:33 -04:00

frontend

Feature 01 task 3: Embed the PWA build with SPA fallback (#4)

2026-10-02 22:47:01 -04:00

household

Feature 04 task 4: Default seeding for AI settings and notification preferences (#28)

2026-10-03 14:58:30 -04:00

jobs

Feature 04 integration fix: authenticated job enqueue API and progressive HTTP flow (#31)

2026-10-03 15:46:19 -04:00

secretbox

Feature 04 task 1: secretbox: AES-256-GCM secrets at rest (#17)

2026-10-03 09:46:29 -04:00

secureurl

Feature 03 task 1: OIDC login and callback against Authentik (#16)

2026-10-03 09:58:05 -04:00

server

Feature 04 integration fix: authenticated job enqueue API and progressive HTTP flow (#31)

2026-10-03 15:46:19 -04:00

store

Feature 04 task 5: Async job runner and GET /api/v1/jobs/{id} (#29)

2026-10-03 15:24:01 -04:00