@oh-my-pi/pi-ai 18.1.21 → 18.1.22

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [18.1.22] - 2026-09-14
+
+### Fixed
+
+- 400-request debug dumps now redact provider-specific auth headers (`x-goog-api-key`, `x-amz-security-token`, and any header whose name carries a key/token/secret), not just a fixed allow-list, so a shared dump can no longer leak a live API key ([#12007](https://github.com/can1357/oh-my-pi/issues/12007)).
+
 ## [18.1.20] - 2026-09-13
 
 ### Fixed

package/dist/types/registry/types.d.ts

@@ -60,6 +60,8 @@ export interface ProviderDefinition {
     readonly envKeys?: KeyResolver;
     /** Provider transport can authenticate without a resolved API-key string. */
     readonly allowsMissingApiKey?: boolean;
+    /** APIs whose provider transport resolves credentials without a stored account. */
+    readonly nativeAuthApis?: readonly string[];
     /** Provider-owned model normalization that must run before API-specific option mapping. */
     readonly prepareModel?: ProviderModelPreparer;
     /** Provider-owned request shaping applied before generic API dispatch. */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.1.21",
+	"version": "18.1.22",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -124,11 +124,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.1.21",
-		"@oh-my-pi/pi-catalog": "18.1.21",
-		"@oh-my-pi/pi-natives": "18.1.21",
-		"@oh-my-pi/pi-utils": "18.1.21",
-		"@oh-my-pi/pi-wire": "18.1.21"
+		"@oh-my-pi/omptype": "18.1.22",
+		"@oh-my-pi/pi-catalog": "18.1.22",
+		"@oh-my-pi/pi-natives": "18.1.22",
+		"@oh-my-pi/pi-utils": "18.1.22",
+		"@oh-my-pi/pi-wire": "18.1.22"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/registry/build.ts

@@ -62,6 +62,7 @@ export function buildProviderDefinition(
 		...transport,
 		...(envKeys !== undefined ? { envKeys } : {}),
 		...(policy.allowsMissingApiKey !== undefined ? { allowsMissingApiKey: policy.allowsMissingApiKey } : {}),
+		...(policy.nativeAuthApis !== undefined ? { nativeAuthApis: policy.nativeAuthApis } : {}),
 		...(policy.available !== undefined ? { available: policy.available } : {}),
 		...(policy.showInLoginList !== undefined ? { showInLoginList: policy.showInLoginList } : {}),
 		...(policy.storeAs !== undefined ? { storeCredentialsAs: policy.storeAs } : {}),

package/src/registry/types.ts

@@ -69,6 +69,8 @@ export interface ProviderDefinition {
 	readonly envKeys?: KeyResolver;
 	/** Provider transport can authenticate without a resolved API-key string. */
 	readonly allowsMissingApiKey?: boolean;
+	/** APIs whose provider transport resolves credentials without a stored account. */
+	readonly nativeAuthApis?: readonly string[];
 	/** Provider-owned model normalization that must run before API-specific option mapping. */
 	readonly prepareModel?: ProviderModelPreparer;
 	/** Provider-owned request shaping applied before generic API dispatch. */

package/src/utils/http-inspector.ts

@@ -20,7 +20,16 @@ export type CapturedHttpErrorResponse = {
 	bodyJson?: unknown;
 };
 
-const SENSITIVE_HEADERS = ["authorization", "x-api-key", "api-key", "cookie", "set-cookie", "proxy-authorization"];
+/**
+ * Matches any header name whose value carries a credential, so a persisted dump
+ * never leaks one. A substring match — not a hand-maintained allow-list — so
+ * provider-specific auth headers (`x-goog-api-key`, `x-amz-security-token`, …)
+ * are redacted without enumerating every provider's spelling; the fixed list it
+ * replaced silently leaked any auth header it did not name. Redacting a benign
+ * header that happens to match is harmless: dumps exist to diagnose the request
+ * body, not its transport headers.
+ */
+const SENSITIVE_HEADER_PATTERN = /key|token|secret|auth|credential|cookie/i;
 
 /**
  * Build the JSON persisted for a rejected request. Request fields stay at the
@@ -167,7 +176,7 @@ function redactHeaders(headers: Record<string, string> | undefined): Record<stri
 
 	const redacted: Record<string, string> = {};
 	for (const [key, value] of Object.entries(headers)) {
-		if (SENSITIVE_HEADERS.includes(key.toLowerCase())) {
+		if (SENSITIVE_HEADER_PATTERN.test(key)) {
 			redacted[key] = "[redacted]";
 			continue;
 		}