[Sivadheeraj5356]

Summary

Fixes #5850.

buildHeliconeApiKey generates customer-portal keys shaped [sp]k(-eu)?-cp(-gov)?(-rl)?- (and org keys [sp]k-helicone(-eu)?(-gov)?(-rl)?-), but the shared HELICONE_API_KEY_REGEX stopped at (-cp)?. Keys like sk-cp-rl-* and sk-cp-gov-* were therefore not recognized: containsHeliconeKey in the worker returned false for them, so buildProviderRequestHeaders did not strip them from outbound provider headers, and the identical regex copy in jawn's requestWrapper rejected them as malformed.

This extends the shared pattern with (-gov)?(-rl)? in the generator's segment order, in both copies.

Testing

• New spec cases in worker/test/security/outboundHeaders.spec.ts cover sk-cp-rl, sk-cp-gov, pk-cp-gov-rl, sk-eu-cp-rl, pk-eu-cp-gov, sk-helicone-gov and sk-helicone-eu-gov-rl.
• Verified locally by executing the patched regex module directly (Node type-stripping): all 32 generator-possible key shapes (sk/pk x eu x gov x rl x customer/org) match; the pre-fix code misses exactly the 5 customer-portal -gov/-rl shapes from the issue; provider keys (sk-proj-, sk-ant-, sk-or-v1-*) still do not match.
• The repo's vitest suite needs the Cloudflare workers test pool and full worker dependencies, so I could not run it locally; the regex module itself was executed directly.

[cursor]

Bugbot is paused — your team has an unpaid invoice

Bugbot is paused because your team has an unpaid invoice.

Pay it from the billing page in the Cursor dashboard and Bugbot resumes automatically.

(requestId: b5071040-38c8-4e9a-9191-cbe83f2abd8c)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
helicone	Skipped		Oct 27, 2026 5:16am UTC
helicone-bifrost	Skipped		Oct 27, 2026 5:16am UTC
helicone-eu	Skipped		Oct 27, 2026 5:16am UTC