StateFrame 0.4.30

StateFrame 0.4.30: credentials are stripped on cross-origin redirects.

Security

• When a server redirects a request to a different scheme, host or port, StateFrame now removes authentication, API-key and cookie headers before following the redirect, so credentials meant for your provider are not sent to another server.

Fixes

• Requests from routed runs can now follow allowed redirects. If your API endpoint redirects before replying, the request completes, and credentials are still removed when the redirect leaves the original origin.
• Every redirect hop keeps the original request deadline, so StateFrame does not start a new request after the deadline has passed.

Requests sent to the model are unchanged. Verified on a hosted OpenAI-compatible endpoint.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.