CRITICAL: api_key 'ClauderAPI2' was committed to PUBLIC unlimitedcoding
repo (private:False on gitea) in 4 *_config.json + 8 ps1 scripts. Anyone
on the internet could read it via curl with no auth (HTTP 200 raw access).
This commit:
1. Sanitizes 4 *_config.json: api_key → "YOUR_API_KEY" + _note pointing
users to private config repo for production credentials.
2. Removes 'ClauderAPI2' literal from 8 ps1 installer/updater scripts
(claude/codex/gemini/qwen × install/update). Each script now has a
sanitized block at top that fetches api_key from private
unlimitedcoding-config repo at runtime via Authorization token.
3. Switches 6 sh installer scripts from public REPO_RAW to PRIVATE
unlimitedcoding-config base URL for *_config.json downloads.
4. Removes stale .patcher.config.cache.json (will regen on next install).
Production configs MOVED to private repo (separate commit e839102 on
unlimitedcoding-config/main).
KNOWN UNCHANGED:
- releases/v2.1.119/sea/cli-wrapper.cjs still has api_key (part of npm
package distribution; clients need it locally; sensey serves same).
- Read-only gitea token (cadffcb0...) remains in installers — needed
for token-auth fetch from private repo. Scoped read-only.
RECOMMEND: api_key rotation in proxy auth list because ClauderAPI2 was
publicly exposed for an unknown period. Existing client installs would
need re-install or env override.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- claude-haiku-4-5-20251001: was available in proxy but missing from config
- glm-5.1: new Zhipu model leading SWE-Bench Pro (Apr 2026), now registered
in proxy registry and reachable via /v1/messages
All previously listed models kept (qwen3.6-coder-* tokens are temporarily
expired but will recover once tokens refresh).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- patcher.config.json: opus-4-7 added to models list, set as default opus
- PS1 installers: ANTHROPIC_DEFAULT_OPUS_MODEL=claude-opus-4-7
- CLAUDE_CUSTOM_MODELS includes opus-4-7 first
- v2.1.111 cli.js with patches applied
Opus 4.7 (released 2026-04-16):
- 1M context, 128K output
- New xhigh effort level
- Adaptive thinking (no more budget_tokens)
- High-res vision (2576px), high token efficiency
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
