@hivemagnus/hive-router 1.0.0 → 1.0.2

package/dist/src/admin/app.js

@@ -574,9 +574,12 @@ async function probeHiveService(key, name, role, internalUrl, publicUrl, healthP
         };
     }
 }
-async function buildHiveStatus(env, requestId) {
+export async function buildHiveStatus(env, requestId) {
     const tlsCertificate = inspectTlsCertificate({ publicUrl: env.PUBLIC_ADMIN_URL, ...(env.TLS_CERT_PATH ? { certPath: env.TLS_CERT_PATH } : {}) });
     const securityExporterJwks = getSecurityExporterJwksStatus(env.HIVE_ROUTER_IAM_JWKS_MAX_AGE_MS);
+    // Exporter keys load on demand; an unused cache is expected on a fresh install.
+    const exporterKeysDegraded = securityExporterJwks.state !== 'healthy'
+        && securityExporterJwks.state !== 'uninitialized';
     const [providerCount, enabledProviders, routeRuleCount, traceCount, failureCount, failoverCount] = await Promise.all([
         prisma.provider.count(),
         prisma.provider.count({ where: { enabled: true } }),
@@ -589,7 +592,7 @@ async function buildHiveStatus(env, requestId) {
         key: 'router',
         name: 'Hive Router',
         role: 'traffic routing and OpenAI-compatible gateway',
-        status: failureCount > 0 || tlsCertificate.status !== 'pass' || securityExporterJwks.state !== 'healthy' ? 'degraded' : 'online',
+        status: failureCount > 0 || tlsCertificate.status !== 'pass' || exporterKeysDegraded ? 'degraded' : 'online',
         summary: `${enabledProviders}/${providerCount} providers enabled`,
         internalUrl: env.PUBLIC_ADMIN_URL,
         publicUrl: env.PUBLIC_API_URL,
@@ -603,7 +606,7 @@ async function buildHiveStatus(env, requestId) {
                 name: 'security-exporter-jwks',
                 status: securityExporterJwks.state === 'healthy' ? 'pass' : securityExporterJwks.state === 'expired' ? 'fail' : 'warn',
                 message: securityExporterJwks.state === 'uninitialized'
-                    ? 'not cached yet'
+                    ? 'not cached yet; first exporter request will load IAM keys'
                     : `${Math.ceil(securityExporterJwks.remainingMs / 1_000)}s remaining (${securityExporterJwks.state})`,
             },
         ],

package/dist/src/commands/check.js

@@ -151,15 +151,20 @@ function checkAuth(env, source, options, results) {
 }
 async function checkDependency(name, url, required, tls, probe, results) {
     const failStatus = required ? 'fail' : 'warn';
+    const displayUrl = new URL(url);
+    displayUrl.username = '';
+    displayUrl.password = '';
+    displayUrl.search = '';
+    displayUrl.hash = '';
     try {
         const result = await probe(url, tls());
         results.push(result.ok
-            ? { name, status: 'ok', message: `${url} is reachable (HTTP ${result.statusCode})` }
-            : { name, status: failStatus, message: `${url} answered HTTP ${result.statusCode}; the service is up but not ready.` });
+            ? { name, status: 'ok', message: `${displayUrl} is reachable (HTTP ${result.statusCode})` }
+            : { name, status: failStatus, message: `${displayUrl} answered HTTP ${result.statusCode}; the service is up but not ready.` });
     }
-    catch (error) {
+    catch {
         const variable = name === 'iam' ? 'HIVE_IAM_INTERNAL_URL' : 'HIVEMEM_INTERNAL_URL';
-        results.push({ name, status: failStatus, message: `${url} is unreachable (${error instanceof Error ? error.message : String(error)}). Start the service or fix ${variable}.` });
+        results.push({ name, status: failStatus, message: `${displayUrl} is unreachable. Start the service or fix ${variable}.` });
     }
 }
 const defaultProbe = async (url, tls) => {

package/dist/src/openapi/spec.js

@@ -1,3 +1,4 @@
+import { packageInfo } from '../config/paths.js';
 export const builtinApiDocs = [
     { scope: 'router', method: 'GET', route: '/v1/models', title: 'List models', summary: 'Aggregated model registry across configured providers', implemented: true },
     { scope: 'router', method: 'POST', route: '/v1/responses', title: 'Responses API', summary: 'OpenAI-compatible responses proxy endpoint', implemented: true },
@@ -39,7 +40,7 @@ export function buildRouterOpenApiDocument(adminBaseUrl) {
         openapi: '3.1.0',
         info: {
             title: 'Hive Router Admin API',
-            version: '0.1.0',
+            version: packageInfo().version,
             description: 'Administrative and enumerated API surface for Hive Router',
         },
         servers: [{ url: adminBaseUrl }],

package/dist/src/security/headers.js

@@ -33,7 +33,7 @@ const CLIENT_CONTROLLED_PROXY_HEADER_NAMES = new Set([
 ]);
 export function shouldForwardClientHeader(name) {
     const lower = name.toLowerCase();
-    return !SENSITIVE_HEADER_NAMES.has(lower)
+    return !isSensitiveHeaderName(lower)
         && !HOP_BY_HOP_HEADER_NAMES.has(lower)
         && !CLIENT_CONTROLLED_PROXY_HEADER_NAMES.has(lower)
         && lower !== 'host'
@@ -49,7 +49,9 @@ function isSensitiveHeaderName(name) {
     return SENSITIVE_HEADER_NAMES.has(lower)
         || lower.includes('secret')
         || lower.includes('token')
-        || lower.includes('credential');
+        || lower.includes('credential')
+        || lower.includes('password')
+        || /(?:^|[-_])api[-_]?key(?:$|[-_])/.test(lower);
 }
 export function redactHeaders(headers) {
     return Object.fromEntries(Object.entries(headers).map(([key, value]) => [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/hive-router",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Hive Router: OpenAI-compatible model gateway with routing, failover, quotas and traces, plus the admin API and the unified Hive console",
   "keywords": [
     "hive",