Changes
- Forward client headers consistently across provider routes through a shared filter. Exclude transport headers, PasteGuard controls and Open WebUI identity metadata; other header values remain unmasked.
- Preserve client authentication precedence and keep client credentials out of local reroutes.
- Rebuild headers for masked JSON requests while preserving raw upload content type, encoding and length.
- Remask restored secrets in local Anthropic tool history and preserve existing tool-history masking protections.
- Add focused header, authentication and upload regressions and shorten provider documentation.
Validation
Header and tool-history regression tests, the Bun suite, TypeScript checks and Biome pass. Real-provider requests, multipart uploads and GLiNER inference were also exercised during validation.
Full changelog: v0.9.4...v0.9.5