v6.9.3-0

Changelog

• b4f95c7 build(deps): bump github.com/router-for-me/CLIProxyAPI/v6 (#999)
• 67a442a build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.0 (#1000)
• 0963f3f build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#1001)
• 806c670 chore: remove deny.toml (no Cargo.toml in workspace) [org-bootstrap-2026-05-03]
• 198fd46 chore: add FUNDING.yml
• b7aca17 chore: bootstrap trufflehog.yml
• 9fc278c fix: add stubs for missing upstream SDK types and handlers
• fd04830 chore: add deny.toml for Rust dependency auditing (#998)
• 91064bc fix: add missing proxyutil import and isClaudeCodeClient function
• 89d7200 Merge branch 'main' of github.com:KooshaPari/cliproxyapi-plusplus
• c949d4c chore: add .gitattributes for consistent line-ending handling
• 75da1b5 ci: add trufflehog secrets scan (#996)
• 5e01746 chore: bootstrap .trufflehog.yml secrets scanning (#997)
• b33d8bf chore: gitignore journey-fix/ workdir artifact
• d4cd8be Merge pull request #995 from KooshaPari/feat/journey-impl
• 8c2304d docs(iconography): complete Fluent + Material icon sets (20+20)
• 4aa30c9 docs(iconography): add combined icons.svg sprite
• c0ed262 Merge pull request #994 from KooshaPari/feat/journey-impl
• 969f4d5 docs: add journey-traceability + iconography docs
• ad23199 Merge pull request #993 from KooshaPari/feat/journey-impl
• 26764df docs: add journey-traceability + iconography implementation
• 1d04521 fix(security-guard): pin Python version to 3.13 in setup-python
• c97e5dd chore: pin all GitHub Actions to commit SHAs
• 353dd76 chore: add lockfiles for npm and go dependencies
• 585d1d2 docs: bootstrap OpenAPI 3.1 spec for CLIProxyAPI Plus
• d85f723 docs: add sladge badge
• d1cfa04 taskfile: show common entrypoints by default (#991)
• 7764b05 taskfile: clarify common task set (#990)
• 9a7e879 taskfile: add json language detector (#989)
• 9082dd9 taskfile: report language detection source (#987)
• 976f140 taskfile: report language detection source (#988)
• 4a708ad taskfile: make build independent of checksum cache (#985)
• 1ccabcb taskfile: make build independent of checksum cache (#986)
• b5edbad taskfile: clarify common entrypoints (#984)
• c8882d1 taskfile: isolate Go build cache (#983)
• 68345a2 taskfile: clean Go lint cache (#982)
• 055b586 taskfile: add language alias (#981)
• 509bdca taskfile: clean task cache artifacts (#980)
• 3759d1b taskfile: harden golangci-lint v2 fallback (#979)
• 5f92ae1 taskfile: expose common task entrypoints (#978)
• 8b63f84 taskfile: build common Go entrypoints (#977)
• 64a1a48 taskfile: detect repo language (#976)
• 5333c2e task: add common task targets (#975)
• 7adbb44 docs: add CODEOWNERS
• 78393f2 Merge pull request #974 from KooshaPari/docs/worklog-index-pointer
• 304960a docs: fix worklog canonical index pointer
• 6b9ca09 docs: add Pages base to cliproxyapi docs
• 1448552 ci: restore phenoShared reusable workflow refs
• f164547 ci: use top-level phenoShared reusable workflows
• 1d719f1 build(deps): bump github.com/router-for-me/CLIProxyAPI/v6 (#967)
• 0b58c18 build(deps): bump github.com/minio/minio-go/v7 from 7.0.99 to 7.1.0 (#968)
• e3dadc1 build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (#969)
• 457dd36 build(deps): bump modernc.org/sqlite from 1.48.1 to 1.50.0 (#970)
• 6608f6b chore(ci): add least-privilege permissions to scorecard.yml (#966)
• fb343c3 chore: add baseline .editorconfig (wave-16) (#964)
• d212bef chore(governance): scaffold CODEOWNERS (#965)
• 1dde13c fix: harden Cursor JSON and management API calls
• 36b60ce chore(codeql): pin actions to SHA
• 3f1a671 chore(security): add minimal token permissions to 11 workflows (CodeQL TokenPermissionsID) (#961)
• 30f1023 fix(executor,amp): restore missing imports and helpers (cat 3+4)
• 9133a78 fix(sdk/api/handlers/openai): restore imports + []byte boundaries
• a5762d2 fix(translator): restore missing imports + []byte/string boundaries
• c13f12c fix(translator/openai/claude): retype toolUseBlock as []byte
• d24001c fix(translator): bridge []string<->[][]byte at delegate boundaries + small []byte conversions
• a1b1f31 fix(translator): restore missing imports for translatorcommon/util/log + drop unused sdkconfig + align codex []byte return
• 0910b49 fix(executor): correct cliproxyauth/cliproxyexecutor import alias typo + add bufio import
• 78c32f4 fix(util): restore ToolNameMapFromClaudeRequest/MapToolName/CanonicalToolName lost in adef5c2 squash
• 96231f7 fix(executor): delete duplicate kiro_streaming/kiro_auth partials (per kiro_websearch precedent)
• bdb236a fix(translator/openai/gemini-cli): use translatorcommon.WrapGeminiCLIResponse + align signatures with SDK
• 7a25c65 fix(translator/gemini/openai/chat-completions): adopt []byte sjson type-flow
• f29ae94 fix(translator/gemini/claude): adopt []byte sjson type-flow + append-bytes (util cascade out of scope)
• 2c094bb fix(translator/gemini-cli/claude): adopt []byte sjson type-flow + append-bytes
• d0d01ae fix(translator/codex/openai-responses): adopt []byte sjson type-flow boundaries
• 196d2c4 fix(translator/codex/claude): adopt []byte sjson type-flow + align NonStream return type
• b52c957 fix(translator/gemini/openai-responses): adopt consistent []byte sjson type-flow + align NonStream return type with SDK
• 935e9fd fix(translator/antigravity/claude): adopt consistent []byte sjson type-flow
• b69ca80 fix(translator/claude/gemini-cli,translatorcommon): restore WrapGeminiCLIResponse + fix []byte return signatures
• 6504ba4 fix(translator/claude/openai): adopt consistent sjson type-flow with []byte boundaries
• 4256b0b fix(translator/openai-responses,gemini): adopt consistent string sjson type-flow
• 790d5ca fix(kiro/common): restore MinToolDescriptionLength + ToolCompressionTargetSize constants (lost in adef5c2)
• 6872ab8 fix(vertex): restore NormalizeServiceAccountMap + VertexCredentialStorage (lost in adef5c2)
• 0d36a3f fix(auth): restore Email/Type/AccessToken via embedded BaseTokenStorage in struct literals (lost in adef5c2)
• 3d7249f fix(api/auth): dedupe overlapping handler files
• 0154f4f fix(watcher): restore stopServerUpdateTimer method lost in adef5c2 squash
• cd98fe1 fix(config): restore MaxRetryCredentials field lost in adef5c2 squash
• ced413a fix(sdk/auth): adopt LoginWithMethodSelection(ctx) + LoginWithIDC API
• 8c27f1d fix(sdk/auth): repoint browser import to pkg/llmproxy/browser
• 60b2abf fix(sdk/auth): correct GCPProjectProjects import path
• 372aa1a fix(kiro/claude): dedupe WebSearchResult and MCP types in handler
• 67fae60 docs: first-run quick start (local Go) + minimal config (#960)
• 2a93c6a fix(build): repair kiro auth package compilation (round 3) (#959)
• 7cb78ef fix(build): repair package compilation failures (round 2) (#958)
• 22cbd89 chore(ci): set alert-sync min_severity=high to reduce noise (#957)
• ed32a32 fix(build): repair qwen/gemini auth + manager_ops compilation (#956)
• 50e9bed fix(security): urlguard for go/request-forgery (closes SEC-1/2/3, bot #848, #808) (#955)
• 0532be9 fix(security): pathsafe.SafeJoin for go/path-injection (closes SEC-9..13, 18, 19) (#954)
• 134a878 build(deps): bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 (#946)
• 92f73fa build(deps): bump github.com/fxamacker/cbor/v2 from 2.9.0 to 2.9.1 (#948)
• 8ecac86 build(deps): bump github.com/router-for-me/CLIProxyAPI/v6 (#949)
• cb00481 build(deps): bump github.com/go-git/go-git/v6 (#951)
• 12c0565 build(deps): bump modernc.org/sqlite from 1.48.0 to 1.48.1 (#950)
• 28df14c fix(executor): merge orphaned runtime tests and remove drift (#945)
• bbf5609 chore: add OpenSSF Scorecard workflow (audit #256) (#953)
• a661163 chore: add CODE_OF_CONDUCT.md (Contributor Covenant v2.1) (#952)
• b168e5c Add license scan report and status (#941)
• 5c36a0b Add Kilo Gastown methodology spec to cliproxyapi++ (#940)
• 0cfa8f7 Add Kilo Gastown methodology spec for cliproxyapi++ (#938)
• acd6803 Add AgilePlus methodology spec to cliproxyapi++ (#936)
• e2035a8 build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 (#935)
• d2499d1 build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 (#932)
• a6c986d fix: security fixes and executor improvements from pr-465 (#934)
• 9e55251 fix: security fixes and executor improvements from pr-465 (#933)
• adef5c2 fix: security fixes and executor improvements from pr-465-fix
• 28dd251 docs: add CHANGELOG.md with semantic versioning (#931)
• 21308d5 chore: add governance files (CLAUDE.md, AGENTS.md)
• 7f738d7 docs: add USER_JOURNEYS.md spec document
• 305406e docs: add PLAN.md implementation plan
• 699079b docs: add ADR.md architecture decision records
• f35bfae docs: add FUNCTIONAL_REQUIREMENTS.md spec document
• 12f38ae docs: add PRD.md spec document
• 058a1ed ci: add standard CI workflow with vet and test
• 665a430 fix(sdk/auth): prevent path-injection in resolveAuthPath
• 56435fc fix: resolve build errors and test failures across multiple packages
• 224c5b0 fix: path-injection in token repository and postgres store
• 8c557e5 fix(auth): prevent path-injection in token repository
• c6a040a test: add regression tests for payloadModelRulesMatch
• 024a1d3 feat(executor): fix payloadModelRulesMatch for unconditional rules
• b8b89f3 Merge pull request #442 from LuxVTZ/feat/gitlab-duo-panel-parity
• 1fa094d Merge pull request #461 from MrHuangJser/main
• f557546 Merge pull request #464 from router-for-me/plus
• ac26e7d Merge branch 'main' into plus
• 10b824f fix(security): validate auth file names to prevent unsafe input
• 7dccc7b docs(readme): remove redundant whitespace in BmoPlus sponsorship section of Chinese README
• 70c9068 docs(readme): fix formatting in BmoPlus sponsorship section of Chinese README
• 8144ffd Merge pull request router-for-me#2370 from B3o/add-bmoplus-sponsor
• 6b45d31 add BmoPlus sponsorship banners to READMEs
• 7386a70 feat(cursor): auto-identify accounts from JWT sub for multi-account support
• 1821bf7 docs: add BmoPlus sponsorship banners to READMEs
• d42b5d4 docs(readme): update QQ group information in Chinese README
• 1b7447b feat(cursor): implement StatusError for conductor cooldown integration
• 40dee44 feat(cursor): auto-migrate sessions to healthy account on quota exhaustion
• 8902e1c style(cursor): replace fmt.Print* with log package for consistent logging
• de5fe71 feat(cursor): multi-account routing with round-robin and session isolation
• dcfbec2 feat(cursor): add management API for Cursor OAuth authentication
• c95620f feat(cursor): conversation checkpoint + session_id for multi-turn context
• 9613f0b feat(cursor): deterministic conversation_id from Claude Code session cch
• 274f29e fix(cursor): improve session key uniqueness for multi-session safety
• c8e79c3 fix(cursor): prevent session key collision across users
• 8afef43 fix(cursor): preserve tool call context in multi-turn conversations
• c1083cb fix(cursor): MCP tool call resume, H2 flow control, and token usage
• 1e6bc81 refactor(config): replace auto-update-panel with disable-auto-update-panel for clarity
• 1a14947 Merge pull request router-for-me#2293 from Xvvln/fix/management-asset-security
• e516684 Merge pull request router-for-me#2310 from shellus/fix/claude-openai-system-top-level
• 19c52bc feat: stash code
• bb9b2d1 Merge pull request router-for-me#2320 from cikichen/build/freebsd-support
• d312422 build: add freebsd support to releases
• 09c92aa fix: keep a fallback turn for system-only Claude inputs
• 8c67b3a test: verify remaining user message after system merge
• 000e4ce fix: map OpenAI system messages to Claude top-level system
• 7333619 fix: reject oversized downloads instead of truncating; warn on unverified fallback
• 2db8df8 fix(security): harden management panel asset updater
• 5da0dec Improve GitLab Duo gateway compatibility