3 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
openhands	d1d4e0f02b	feat(providers): add status filter to providers dashboard ... Adds a client-side status filter (All / Active / Inactive / No connection) to the Providers page, applied over the already-fetched provider + connection list. Status derives from getProviderStats (total, allDisabled); noAuth providers count as Active. Filter composes with the existing search across all provider sections. Part of #3699.	2026-09-03 09:39:01 +07:00
openhands	b870b5d41b	fix(security): close SSRF guard bypasses in ssrfGuard.js (#3714) ... Closes four SSRF guard bypasses reported in #3714: - Block alternate IPv6 encodings (hex format, NAT64, IPv4-compatible, IPv4-mapped) by parsing to 16-bit groups - Normalize trailing dots on hostnames to prevent FQDN bypasses - Add assertPublicUrlResolved() with DNS resolution to block wildcard DNS domains resolving to private/metadata IPs - Add fetchPublic() to safely handle and validate HTTP redirects	2026-09-03 09:22:22 +07:00
openhands	b9c92cb83c	feat(quota): add usage tracking for Groq ... First slice of #3701: quota tracking for Groq via x-ratelimit-* response headers on the models endpoint (no dedicated quota endpoint exists, and reading usage costs zero tokens). - usage/groq.js: parse request+token limit/remaining headers; Go-style duration reset headers ("2m59.56s") resolve to future timestamps; missing key/401/403 -> message, 2xx without headers -> soft "not tracked yet" with quotas:{} - registry/groq.js: transport.usage.url (reuses validateUrl) + features {usage, usageApikey} - services/usage.js: groq entry in USAGE_HANDLERS - ProviderLimits/utils.js: parseQuotaData case (absolute used/total, codex/kiro style) - tests: groq-usage.test.js (registry flags, header parsing, soft not-tracked path, missing key/401, parseQuotaData)	2026-09-02 20:04:35 +07:00