dev_agentandClaude Opus 5.5 f333440256 Never quote caller-supplied text in New errors ...

A managed-header error named the canonical header, which equals the API
key when the key is itself a managed header name such as Authorization.
The unknown structured-output error quoted the mode after redacting the
whole key, which still leaked any fragment of the key. Both now return
fixed messages, so no New error interpolates caller input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-03 18:07:31 -04:00

..

ai/llm

Never quote caller-supplied text in New errors

2026-10-03 18:07:31 -04:00

auth

Feature 03 integration fix: sanitize ID-token verification errors (#26)

2026-10-03 11:32:36 -04:00

config

Feature 04 task 3 (rebased): Household settings seeding and API (#27)

2026-10-03 11:50:15 -04:00

db

Feature 04 task 5: Async job runner and GET /api/v1/jobs/{id} (#29)

2026-10-03 15:24:01 -04:00

forwarded

Feature 03 task 5: Trusted proxy handling for forwarded headers (#23)

2026-10-03 11:05:33 -04:00

frontend

Feature 01 task 3: Embed the PWA build with SPA fallback (#4)

2026-10-02 22:47:01 -04:00

household

Feature 04 task 4: Default seeding for AI settings and notification preferences (#28)

2026-10-03 14:58:30 -04:00

jobs

Feature 04 integration fix: authenticated job enqueue API and progressive HTTP flow (#31)

2026-10-03 15:46:19 -04:00

secretbox

Feature 04 task 1: secretbox: AES-256-GCM secrets at rest (#17)

2026-10-03 09:46:29 -04:00

secureurl

Feature 03 task 1: OIDC login and callback against Authentik (#16)

2026-10-03 09:58:05 -04:00

server

Feature 04 integration fix: authenticated job enqueue API and progressive HTTP flow (#31)

2026-10-03 15:46:19 -04:00

store

Feature 04 task 5: Async job runner and GET /api/v1/jobs/{id} (#29)

2026-10-03 15:24:01 -04:00