Merge branch 'release/v3.8.50' into chore/remove-iflow-ttl

skills/omni-auth/SKILL.md

@@ -36,6 +36,37 @@ curl -X POST https://localhost:20128/api/auth/logout \
   -d '{}'
 ```
 
+### GET /api/auth/oidc/login
+
+Start OIDC login for the dashboard admin gate
+
+Builds an authorization URL from the configured OIDC issuer/client (discovered
+via `{issuer}/.well-known/openid-configuration`, falling back to `{issuer}/authorize`),
+sets a short-lived `oidc_state` cookie, and redirects the browser. Password login
+remains available as a fallback while OIDC is enabled.
+
+
+```bash
+curl https://localhost:20128/api/auth/oidc/login \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/auth/oidc/callback
+
+Complete OIDC login for the dashboard admin gate
+
+Validates the `state` cookie, exchanges the authorization `code` for tokens,
+verifies the ID token against the issuer's JWKS (audience = client id), and —
+if `oidcAllowedSubjects` is configured — checks the token's `sub`/`email` against
+that allowlist. On success it mints the same 30-day `auth_token` dashboard-session
+JWT used by password login and redirects to `/dashboard`.
+
+
+```bash
+curl https://localhost:20128/api/auth/oidc/callback \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.

skills/omni-inference/SKILL.md

@@ -219,6 +219,87 @@ curl https://localhost:20128/api/v1/providers/{provider}/models \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/v1/management/proxy-subscriptions
+
+List proxy subscriptions
+
+Lists all operator-supplied proxy subscription links. Also starts the background auto-refresh scheduler (idempotent) so enabled subscriptions stay in sync. Credentials embedded in `url` are redacted in the response.
+
+```bash
+curl https://localhost:20128/api/v1/management/proxy-subscriptions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/management/proxy-subscriptions
+
+Create a proxy subscription
+
+Creates a subscription record. If `mode` is `rule`, at least one entry in `ruleProviders` is required. `updateIntervalMinutes` defaults to 60 and `enabled` defaults to `false` when omitted or not exactly `true`.
+
+```bash
+curl -X POST https://localhost:20128/api/v1/management/proxy-subscriptions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/management/proxy-subscriptions/{id}
+
+Get a proxy subscription
+
+```bash
+curl https://localhost:20128/api/v1/management/proxy-subscriptions/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PATCH /api/v1/management/proxy-subscriptions/{id}
+
+Update a proxy subscription
+
+Partial update — only fields present in the body are changed (name/url/mode/ruleProviders/localCoreEndpoint/updateIntervalMinutes/enabled).
+
+```bash
+curl -X PATCH https://localhost:20128/api/v1/management/proxy-subscriptions/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/management/proxy-subscriptions/{id}
+
+Delete a proxy subscription
+
+Removes the subscription record and unbinds/drops its synced proxy_registry rows.
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/management/proxy-subscriptions/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/management/proxy-subscriptions/{id}/nodes
+
+Get a subscription's last-parsed node summary
+
+Returns the last-parsed node list without re-fetching the (possibly slow) subscription URL.
+
+```bash
+curl https://localhost:20128/api/v1/management/proxy-subscriptions/{id}/nodes \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/management/proxy-subscriptions/{id}/refresh
+
+Refresh a proxy subscription
+
+Re-fetches and re-parses the subscription URL, syncs its nodes into `proxy_registry`, and (re)binds the pool.
+
+```bash
+curl -X POST https://localhost:20128/api/v1/management/proxy-subscriptions/{id}/refresh \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ### POST /api/v1/ocr
 
 Document OCR

skills/omni-usage-logs/SKILL.md

@@ -110,6 +110,33 @@ curl -X POST https://localhost:20128/api/usage/budget \
   -d '{}'
 ```
 
+### GET /api/usage/cache-health
+
+Get prompt-cache health summary
+
+Summarizes the `write/read` cache ratio from `call_logs` for a time window:
+distribution (p50/p90/p99/max of cache-write tokens), warm/cold/rewrite/uncached
+call counts, the "heavy write" outlier share (10x the window median, floored at
+1024 tokens — Anthropic's cache-creation minimum), and a per-model breakdown.
+Only successful (`status = 200`) calls with a non-null cache column are counted.
+
+
+```bash
+curl https://localhost:20128/api/usage/cache-health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/model-latency-stats
+
+Get per-model/provider latency statistics
+
+Aggregates `usage_history` rows into per-(provider, model) latency stats (avg/p50/p95/p99, std-dev, TTFT, tokens/sec) over a rolling window. Falls back from successful-only to all-sample rows when the successful count is below `minSamples`.
+
+```bash
+curl https://localhost:20128/api/usage/model-latency-stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.