From b1240c6ca3b56bfa48317c5e1013eac150496b14 Mon Sep 17 00:00:00 2001 From: rcourtman <8825017+rcourtman@users.noreply.github.com> Date: Tue, 1 Sep 2026 15:49:05 +0100 Subject: [PATCH] Point OpenRouter attribution at pulserelay.pro and fix Fireworks key link External-reference audit after the fabricated security@pulseapp.io find: the OpenRouter HTTP-Referer claimed pulse.app, a third-party domain Pulse has never owned, and the in-app Fireworks 'Get API key' link 404s (fireworks.ai/account/api-keys moved to app.fireworks.ai/settings/users/api-keys). --- frontend-modern/src/components/Settings/aiSettingsModel.ts | 2 +- internal/ai/providers/openai.go | 2 +- internal/ai/providers/openai_test.go | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/frontend-modern/src/components/Settings/aiSettingsModel.ts b/frontend-modern/src/components/Settings/aiSettingsModel.ts index 49569ca8c..08ab5b67f 100644 --- a/frontend-modern/src/components/Settings/aiSettingsModel.ts +++ b/frontend-modern/src/components/Settings/aiSettingsModel.ts @@ -245,7 +245,7 @@ export const AI_PROVIDER_CONFIGS: AIProviderConfig[] = [ placeholder: 'Fireworks API key', configuredPlaceholder: '••••••••••• (configured)', actionLinkLabel: 'Get API key →', - actionLinkHref: 'https://fireworks.ai/account/api-keys', + actionLinkHref: 'https://app.fireworks.ai/settings/users/api-keys', helperText: 'Uses https://api.fireworks.ai/inference/v1 automatically.', clearTitle: 'Clear API key', }, diff --git a/internal/ai/providers/openai.go b/internal/ai/providers/openai.go index 73945de00..7172aa88e 100644 --- a/internal/ai/providers/openai.go +++ b/internal/ai/providers/openai.go @@ -24,7 +24,7 @@ const ( openaiStreamMaxRetries = 1 openaiStreamInitialBackoff = 1 * time.Second openaiStreamChunkTimeout = 12 * time.Second - openrouterRefererURL = "https://pulse.app" + openrouterRefererURL = "https://pulserelay.pro" openrouterAppTitle = "Pulse" // OpenRouter preflights affordability against the requested maximum // completion budget. Leaving it unset can make small chat turns reserve a diff --git a/internal/ai/providers/openai_test.go b/internal/ai/providers/openai_test.go index 99c0a53b0..2c58049fd 100644 --- a/internal/ai/providers/openai_test.go +++ b/internal/ai/providers/openai_test.go @@ -1243,7 +1243,7 @@ func TestOpenAIClient_ListModels_OpenRouterReturnsCatalog(t *testing.T) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { assert.Equal(t, "/api/v1/models", r.URL.Path) assert.Equal(t, "Bearer sk-test", r.Header.Get("Authorization")) - assert.Equal(t, "https://pulse.app", r.Header.Get("HTTP-Referer")) + assert.Equal(t, "https://pulserelay.pro", r.Header.Get("HTTP-Referer")) assert.Equal(t, "Pulse", r.Header.Get("X-Title")) w.Header().Set("Content-Type", "application/json") @@ -1274,7 +1274,7 @@ func TestOpenAIClient_TestConnection_OpenRouterValidatesCurrentKey(t *testing.T) server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { assert.Equal(t, "/api/v1/key", r.URL.Path) assert.Equal(t, "Bearer sk-test", r.Header.Get("Authorization")) - assert.Equal(t, "https://pulse.app", r.Header.Get("HTTP-Referer")) + assert.Equal(t, "https://pulserelay.pro", r.Header.Get("HTTP-Referer")) assert.Equal(t, "Pulse", r.Header.Get("X-Title")) w.Header().Set("Content-Type", "application/json")