ldrouter 1.13.1 → 1.14.1

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.14.1] - 2026-09-12
+
+### Fixed
+
+- Do not reject any model solely because its stored `reasoning` capability is `false`; reasoning support is advisory for OpenAI-compatible providers and must not block Claude/Hermes requests.
+- Redact API-key digests and metadata from authentication debug logs.
+
+## [1.14.0] - 2026-09-11
+
+### Added
+
+- **Docker request logging**: every request now emits structured `info` logs when received and a completion log classified as `info` (2xx/3xx), `warn` (4xx), or `error` (5xx), with request ID, method, route, status, and duration. Query strings, headers, bodies, and secrets are excluded.
+
 ## [1.13.1] - 2026-09-11
 
 ### Fixed

package/dist/server/app.js

@@ -21,7 +21,7 @@ import { registerGatewayRoutes } from './routes/gateway.js';
 import { registerHealthRoutes } from './routes/health.js';
 import { registerAdminIpGate } from './security/admin-ip-gate.js';
 import { metricsRegistry } from './metrics/registry.js';
-import { fatal, lifecycle, formatError, getDebugFlags, errorLine } from './logging/debug.js';
+import { fatal, lifecycle, formatError, getDebugFlags, errorLine, requestLogFields, requestLogLevel, requestLogMessage } from './logging/debug.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 export async function buildApp(opts = {}) {
     const cfg = loadConfig();
@@ -43,9 +43,19 @@ export async function buildApp(opts = {}) {
         crossOriginEmbedderPolicy: false,
     });
     await app.register(cors, { origin: false, credentials: true });
-    // Per-request logging + error shaping
+    // Every request is logged as structured JSON for Docker. Bodies and headers
+    // are intentionally excluded; sensitive values must never reach logs.
+    app.addHook('onRequest', async (req) => {
+        req.requestStartedAt = Date.now();
+        log.info({ requestId: req.id, method: req.method, url: req.url }, 'request received');
+    });
     app.addHook('onResponse', async (req, reply) => {
         reply.header('x-request-id', req.id);
+        const startedAt = req.requestStartedAt ?? Date.now();
+        const statusCode = reply.statusCode;
+        const fields = requestLogFields(String(req.id), req.method, req.url, statusCode, Date.now() - startedAt, req.routeOptions?.url);
+        const level = requestLogLevel(statusCode);
+        log[level](fields, requestLogMessage(statusCode));
     });
     app.setErrorHandler((err, req, reply) => {
         // Zod validation failures surface as 400 with readable field messages;

package/dist/server/auth/api-key.js

@@ -37,17 +37,17 @@ export function authenticateGatewayKey(req) {
         candidate = anthropic;
     if (!candidate)
         return null;
-    // DEBUG: Log what we're trying to authenticate
-    console.log(`🔑 API KEY AUTH - Candidate extracted: ${candidate.slice(0, 8)}...${candidate.slice(-4)}`);
+    // Never log API-key material, including partial values.
+    console.log('🔑 API KEY AUTH - Candidate received');
     // Custom keys are stored verbatim (no prefix requirement); auto-generated
     // keys start with ld-, but authentication must accept any stored secret.
     const digest = sha256Hex(candidate);
-    console.log(`🔑 API KEY AUTH - SHA256 Digest: ${digest.slice(0, 16)}...`);
+    console.log('🔑 API KEY AUTH - Digest computed');
     const db = getDb();
     // DEBUG: Check total keys in database
     const allKeys = db.select().from(schema.apiKeys).all();
     console.log(`📊 TOTAL KEYS IN DB: ${allKeys.length}`);
-    console.log(`📋 ALL KEYS:`, allKeys.map(k => ({ id: k.id.slice(0, 8), name: k.name, keyPrefix: k.keyPrefix, digestPreview: k.keyDigest?.slice(0, 16) + '...' })));
+    console.log('📋 API key metadata loaded');
     const row = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.keyDigest, digest)).get();
     console.log(`❓ QUERY RESULT: Found match? ${!!row}`);
     if (!row) {

package/dist/server/logging/debug.js

@@ -14,6 +14,24 @@
 // they emit at debug, so set LOG_LEVEL=debug to see them.
 import process from 'node:process';
 import { redactValue } from '../security/redact.js';
+export function requestLogLevel(statusCode) {
+    if (statusCode >= 500)
+        return 'error';
+    if (statusCode >= 400)
+        return 'warn';
+    return 'info';
+}
+export function requestLogMessage(statusCode) {
+    if (statusCode >= 500)
+        return 'request completed with server error';
+    if (statusCode >= 400)
+        return 'request completed with client error';
+    return 'request completed';
+}
+export function requestLogFields(requestId, method, url, statusCode, durationMs, route) {
+    const safeUrl = url.split('?')[0] ?? url;
+    return { requestId, method, url: safeUrl, route: route ?? safeUrl, statusCode, durationMs };
+}
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'yes';

package/dist/server/routes/admin/api-keys.js

@@ -114,8 +114,8 @@ export async function registerApiKeyRoutes(app) {
         const enc = encryptSecret(secret);
         // DEBUG: Log what we're about to insert
         console.log(`📝 CREATE API KEY - Name: ${body.name}, Prefix: ${keyPrefix}`);
-        console.log(`📝 CREATE API KEY - Secret (full): ${secret}`);
-        console.log(`📝 CREATE API KEY - Digest: ${keyDigest}`);
+        console.log('📝 CREATE API KEY - Secret: [REDACTED]');
+        console.log('📝 CREATE API KEY - Digest: [REDACTED]');
         db.insert(schema.apiKeys).values({
             id,
             name: body.name,

package/dist/server/routing/capabilities.js

@@ -38,7 +38,9 @@ export function deriveRequiredCapabilities(req) {
  * IMPORTANT: Treat undefined as "unknown" rather than "unsupported".
  * For generic OpenAI-compatible providers where capabilities weren't explicitly imported,
  * undefined means we don't know, so we should assume it's potentially supported.
- * Explicit false means "known unsupported".
+ * Explicit false means "known unsupported" for protocol capabilities such as
+ * tools, images, and streaming. Reasoning is advisory metadata because the
+ * upstream may support it even when discovery cannot identify it.
  */
 export function modelMeets(caps, req) {
     // Only reject if capability is explicitly false, not if unknown (undefined)
@@ -52,8 +54,6 @@ export function modelMeets(caps, req) {
         return false;
     if (req.audioInput && caps.audio_input === false)
         return false;
-    if (req.reasoning && caps.reasoning === false)
-        return false;
     if (req.responses && caps.responses === false)
         return false;
     return true;

package/dist/server/routing/combo.js

@@ -69,8 +69,6 @@ function capabilityRejection(caps, req) {
         return 'image_input';
     if (req.audioInput && caps.audio_input === false)
         return 'audio_input';
-    if (req.reasoning && caps.reasoning === false)
-        return 'reasoning';
     if (req.responses && caps.responses === false)
         return 'responses';
     return 'capability_mismatch';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldrouter",
-  "version": "1.13.1",
+  "version": "1.14.1",
   "description": "LateDev Router — lightweight self-hosted LLM gateway with admin UI",
   "type": "module",
   "license": "MIT",