Commits on Tue, Sep 29, 2026

1. Diego Rodrigues de Sa e Souza

   fix(build): derive the pack-boot CLI token against the smoke's DATA_DIR (#15147)

   2f42a9aSep 29
2. Diego Rodrigues de Sa e Souza

   test(e2e): align four release E2E specs with the contracts #11670/#11798 shipped (#15145)

   dfb563dSep 29
3. MumuTW

   fix(idempotency): namespace the replay key by the calling API key (#15128)

   3a1523aSep 29
4. Diego Rodrigues de Sa e Souza

   test(lease): classify the connection re-read #15130 added to the provider test route (#15134)

   0e29080Sep 29
5. Diego Rodrigues de Sa e Souza

   fix(release): drain base-reds r7 of v3.8.51 — connection-test operator-disable race, two vitest teardown leaks (#15130)

   ce0d215Sep 29
6. diegosouzapw

   chore(release): reconcile the v3.8.51 CHANGELOG, contributors hall and release date

   3804650Sep 29
7. diegosouzapw

   Merge remote-tracking branch 'origin/release/v3.8.51' into chore/reconcile-changelog-3.8.51

   4aed4b4Sep 29
8. diegosouzapw

   chore(release): reconcile the v3.8.51 CHANGELOG (pass 1)

   e8b5571Sep 29
9. Diego Rodrigues de Sa e Souza

   fix(deps): scope two nested overrides so npm 10 accepts the lockfile again (#15122)

   fc8e91bSep 29
10. Diego Rodrigues de Sa e Souza

    fix(telegram): skip malformed percent escapes in initData instead of throwing (#15121)

    6f665f3Sep 29
11. Diego Rodrigues de Sa e Souza

    fix(sse): scan Devin and PromptQL tool markup in linear time (#15120)

    cf95045Sep 29
12. Diego Rodrigues de Sa e Souza

    fix(sse): refuse traversal in the Codex /v1/responses subpath (#15119)

    6e6b071Sep 29
13. Aaron Scherer

    fix(cache): share one in-flight load across concurrent cache misses (#15101)

    4796624Sep 29
14. Diego Rodrigues de Sa e Souza

    fix(release): drain release/v3.8.51 base-reds (r1) — local cooldown vs #14190, proxyLogs import side effect (#15116)

    0816f62Sep 29
15. Diego Rodrigues de Sa e Souza

    test(ui): realign dashboard vitest suites with recent contract changes (#15115)

    4f65ef3Sep 29
16. Diego Rodrigues de Sa e Souza

    fix(release): clear 12 base-reds of release/v3.8.51 (opencode retry, tool-map side channel, audio id, CI cache key, stale contracts) (#15112)

    ed664fcSep 29
17. Diego Rodrigues de Sa e Souza

    fix(ci): clear 13 release/v3.8.51 unit base-reds (gpt-5 sampling strip, command-code none, contract drift) (#15111)

    a8e9796Sep 29
18. Diego Rodrigues de Sa e Souza

    fix(release): drain base-reds r6 of v3.8.51 — docs i18n drift, UI value drift, ai-attribution history (#15104)

    b566215Sep 29
19. Diego Rodrigues de Sa e Souza

    fix(release): clear 9 unit base-reds on release/v3.8.51 (shards 3 and 4) (#15109)

    ee0f283Sep 29
20. diegosouzapw

    chore(release): back-merge main into release/v3.8.51 (0a.0b)

    9bbf6efSep 29
21. Dizzle

    fix(build): ship the files postinstall and the WS proxy import (#15077)

    ae3e6ffSep 29
22. QuangBlue

    fix(cursor): end turns on the Connect end-of-stream frame instead of failing them (#15074)

    5e6624dSep 29
23. Diego Rodrigues de Sa e Souza

    test(skills): read CLI endpoint examples from the generated references too (#15078)

    f2e3b48Sep 29
24. Bob.Hou

    fix(auth): end dashboard sessions on a password change and on sign-out (#15063)

    497ef8dSep 29
25. Diego Rodrigues de Sa e Souza

    fix(security): never send raw exception text from the Responses WebSocket proxy (Hard Rule #12) (#15073)

    d573d40Sep 29
26. Diego Rodrigues de Sa e Souza

    fix(security): match virtual auto/* and qtSd/* routes against a key's combo allow-list (GHSA-7j4q-6gx6-pg77) (#15072)

    93f5520Sep 29
27. Bob.Hou

    fix(authz): treat every forwarding header as the mark of a proxied request (#15060)

    d3da8bbSep 29
28. Bob.Hou

    fix(network): check where a public-only host name resolves, not only how it is spelled (#15064)

    0739f92Sep 29
29. Bob.Hou

    fix(mcp): run memory and skill tools as the authenticated caller (#15068)

    0f92a5cSep 29
30. Bob.Hou

    fix(sse): keep a model name from rewriting the upstream URL path (#15067)

    2611af3Sep 29