NesaRouter v0.1.40

Security

• Harden OAuth refresh/expiry handling, sanitize upstream OAuth failures, reject stale account targets, and isolate concurrent device flows.
• Retain callback state until successful persistence and clean up expired pending authorization data.

Fixed

• Preserve function calling across OpenAI Chat, Responses, Anthropic Messages, Gemini, Cursor, Kiro, Vertex, GitHub Copilot, OpenRouter, and OpenCode.
• Return proper JSON for stream:false on streaming upstreams while preserving usage and concurrency accounting.
• Keep tool continuations sticky to the correct provider/account and improve real inference validation for Cursor, OpenRouter, and OpenCode.

Validation

• 313 unit tests across 57 files, TypeScript, dependency audit, OSS boundary check, production build, GitHub Actions build, runtime startup, and smoke test pass.