ldrouter 1.11.0 → 1.11.3

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.11.3] - 2026-09-03
+
+### Fixed
+
+- **Model Test streaming endpoint no longer returns an opaque 500 "Gateway error"**: when the provider credential can't be decrypted (master-key mismatch after backup restore), it now returns a readable `authentication_error` prompting to re-save the provider API key.
+- **Docker container restart no longer causes data loss**: added `docker-entrypoint.sh` that removes stale SQLite WAL/SHM files on startup and performs a checkpoint to ensure all data is persisted to the main database file before starting the gateway.
+
+## [1.11.2] - 2026-09-02
+
+### Fixed
+
+- **Custom API keys without an `ld-` prefix now authenticate**: the API-key creation form accepts any custom key value, but gateway authentication rejected every key not starting with `ld-` (401 "Invalid API key format"), making custom keys unusable. Authentication now accepts any stored secret verbatim — auto-generated keys still use the `ld-<base64url(32 bytes)>` format.
+
 ## [1.11.0] - 2026-09-01
 
 ### Added

package/dist/server/auth/api-key.js

@@ -37,9 +37,8 @@ export function authenticateGatewayKey(req) {
         candidate = anthropic;
     if (!candidate)
         return null;
-    if (!candidate.startsWith('ld-')) {
-        throw new GatewayError('authentication_error', 'Invalid API key format', { status: 401 });
-    }
+    // Custom keys are stored verbatim (no prefix requirement); auto-generated
+    // keys start with ld-, but authentication must accept any stored secret.
     const digest = sha256Hex(candidate);
     const db = getDb();
     const row = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.keyDigest, digest)).get();

package/dist/server/db/schema.js

@@ -188,7 +188,8 @@ export const modelAliases = sqliteTable('model_aliases', {
     aliasIdx: uniqueIndex('uniq_alias').on(t.alias),
 }));
 // ============================================================================
-// API keys (gateway keys with ld- prefix)
+// API keys (gateway keys; auto-generated ones start with ld-, but custom
+// values without prefix are now supported)
 // ============================================================================
 export const apiKeys = sqliteTable('api_keys', {
     id: text('id').primaryKey(),

package/dist/server/routes/admin/models.js

@@ -232,8 +232,9 @@ export async function registerModelRoutes(app) {
             protocol: 'openai',
             endpoint: 'chat/completions',
         };
+        let outcome;
         try {
-            const outcome = await runner.execute(gatewayReq, ctx);
+            outcome = await runner.execute(gatewayReq, ctx);
             // Runner already wrote [DONE]. Append our own test_meta event so the
             // client knows the test finished with full stats.
             send('test_meta', {
@@ -251,6 +252,10 @@ export async function registerModelRoutes(app) {
             });
         }
         catch (e) {
+            // Never let a raw non-GatewayError (e.g. MasterKeyError from credential
+            // decryption) escape into the global handler as an opaque "Gateway error".
+            if (e instanceof GatewayError)
+                throw e;
             send('test_error', { message: e.message });
         }
         finally {

package/dist/server/security/redact.js

@@ -39,7 +39,7 @@ const DEFAULT_SECRET_KEYS = [
 ];
 const SECRET_KEY_REGEX = /(authorization|api[-_]?key|api[-_]?secret|password|passwd|secret|token|cookie|master[-_]?key|totp|recovery|private[-_]?key|session)/i;
 const PLAINTEXT_PATTERNS = [
-    /\bld-[A-Za-z0-9_-]{20,}\b/g, // gateway api keys
+    /\bld-[A-Za-z0-9_-]{20,}\b/g, // auto-generated gateway api keys (custom keys are covered by the Bearer/x-api-key patterns below)
     /(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi,
     /sk-[A-Za-z0-9_-]{12,}/g, // OpenAI-style
     /anthropic[_-]?[A-Za-z0-9_-]{20,}/gi,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldrouter",
-  "version": "1.11.0",
+  "version": "1.11.3",
   "description": "LateDev Router — lightweight self-hosted LLM gateway with admin UI",
   "type": "module",
   "license": "MIT",