diff --git a/.env.example b/.env.example index 16a71dc9f6..c7e4911e4a 100644 --- a/.env.example +++ b/.env.example @@ -37,6 +37,8 @@ INITIAL_PASSWORD=CHANGEME # Base directory for all persistent data (SQLite DB, logs, backups). # Used by: src/lib/db/core.ts — resolves the SQLite database file path. # Default: ~/.omniroute/ | Override for Docker or custom installations. +# Hint: When running in Docker, consider mounting a host directory here for data persistence across container restarts +# also if you want to share the same database as "npm run dev" use "./data" # DATA_DIR=/var/lib/omniroute # Encryption key for SQLite database encryption at rest. diff --git a/CHANGELOG.md b/CHANGELOG.md index b3b92bb1d4..3fa907b355 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,15 +15,25 @@ - **docker:** rebuild `better-sqlite3` native bindings after hardened install to resolve container startup crash (#2772 — thanks @thanet-s) - **combos:** make combo target timeout configurable, inheriting resolved request timeout by default and clamping values so they only shorten fallback latency (#2775 — thanks @rdself) +- **oauth:** use public callbacks for remote Google OAuth with custom creds (#2787 — thanks @akarray) +- **combos:** allow rate-limited provider connections after transient 429s (#2786 — thanks @JxnLexn) +- **logs:** keep database log settings in sync with the pipeline toggle (#2785 — thanks @JxnLexn) +- **docker:** speedup docker creation by reducing steps and bunch up copy operations (#2784 — thanks @hartmark) +- **codex:** apply global service tiers to combo request bodies (#2783 — thanks @JxnLexn) ### ⚡ Performance / CI - **ci:** build Docker platforms on native runners (linux/amd64 on ubuntu-24.04 and linux/arm64 on ubuntu-24.04-arm) instead of emulated QEMU, reducing build times significantly (#2774 — thanks @thanet-s) +### 📝 Documentation + +- **docs:** fix broken documentation links in README after Fumadocs migration (#2782 — thanks @kjhq) + ### 🏆 Hall of Contributors A special thanks to everyone who contributed code, reviews, and tests for this release: -@hartmark, @hijak, @rdself, @thanet-s +@akarray, @hartmark, @hijak, @JxnLexn, @kjhq, @rdself, @thanet-s + --- diff --git a/Dockerfile b/Dockerfile index 853d9dc4e9..f23cd7b074 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,22 @@ -FROM node:24-trixie-slim AS builder +# ── Common base with runtime deps ────────────────────────────────────────── +FROM node:24-trixie-slim AS base WORKDIR /app -RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ - --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \ +RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \ + --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \ apt-get update \ - && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates python3 make g++ \ + && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \ + && rm -rf /var/lib/apt/lists/* + +# ── Builder ──────────────────────────────────────────────────────────────── +FROM base AS builder + +# Build tools for native module compilation +# apt-get update needed here because base's rm -rf clears the shared cache +RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \ + --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \ + apt-get update \ + && apt-get install -y --no-install-recommends python3 make g++ \ && rm -rf /var/lib/apt/lists/* COPY package*.json ./ @@ -26,12 +38,15 @@ RUN --mount=type=cache,target=/root/.npm \ && npm rebuild better-sqlite3 \ && node -e "require('better-sqlite3')(':memory:').close()" +# Use Turbopack for significant build speedup +ENV OMNIROUTE_USE_TURBOPACK=1 + COPY . ./ RUN --mount=type=cache,target=/app/.next/cache \ - mkdir -p /app/data && npm run build -- --webpack + mkdir -p /app/data && npm run build -FROM node:24-trixie-slim AS runner-base -WORKDIR /app +# ── Runner base ──────────────────────────────────────────────────────────── +FROM base AS runner-base LABEL org.opencontainers.image.title="omniroute" \ org.opencontainers.image.description="Unified AI proxy — route any LLM through one endpoint" \ @@ -46,15 +61,11 @@ ENV NODE_OPTIONS="--max-old-space-size=256" # Data directory inside Docker — must match the volume mount in docker-compose.yml ENV DATA_DIR=/app/data -RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ - --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \ - apt-get update \ - && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \ - && rm -rf /var/lib/apt/lists/* RUN mkdir -p /app/data -COPY --from=builder /app/public ./public -COPY --from=builder /app/.next/static ./.next/static +# The standalone build + syncStandaloneExtraModules bundles all runtime files +# (.next, node_modules, migrations, scripts, docs, etc.) into .next/standalone/. +# Explicit overrides below cover modules that NFT tracing may miss. COPY --from=builder /app/.next/standalone ./ # Explicitly copy @swc/helpers — not always traced by standalone output but needed at runtime COPY --from=builder /app/node_modules/@swc/helpers ./node_modules/@swc/helpers @@ -70,18 +81,6 @@ COPY --from=builder /app/node_modules/split2 ./node_modules/split2 # traced by Next.js standalone output — copy them explicitly. COPY --from=builder /app/src/lib/db/migrations ./migrations ENV OMNIROUTE_MIGRATIONS_DIR=/app/migrations -# MITM server.cjs is spawned at runtime via child_process — not traced by nft -COPY --from=builder /app/src/mitm/server.cjs ./src/mitm/server.cjs -# Runtime docs are pruned by .dockerignore to English markdown + OpenAPI. -# Next.js standalone tracing does not include docs read via fs. -COPY --from=builder /app/.next/standalone/docs ./docs - -COPY --from=builder /app/scripts/dev/run-standalone.mjs ./dev/run-standalone.mjs -COPY --from=builder /app/scripts/build/runtime-env.mjs ./build/runtime-env.mjs -COPY --from=builder /app/scripts/build/bootstrap-env.mjs ./build/bootstrap-env.mjs -COPY --from=builder /app/scripts/dev/healthcheck.mjs ./healthcheck.mjs - -RUN node -e "require('better-sqlite3')(':memory:').close()" # Hand /app over to the baked-in `node` non-root user (UID/GID 1000) so the # runtime process never holds root privileges. The chown happens after all diff --git a/open-sse/services/combo.ts b/open-sse/services/combo.ts index 743d0cb96d..63bb9f7dd2 100644 --- a/open-sse/services/combo.ts +++ b/open-sse/services/combo.ts @@ -190,7 +190,10 @@ type ComboLogger = { }; export type SingleModelTarget = - | (ResolvedComboTarget & { modelAbortSignal?: AbortSignal | null }) + | (ResolvedComboTarget & { + allowRateLimitedConnection?: boolean; + modelAbortSignal?: AbortSignal | null; + }) | { modelAbortSignal: AbortSignal }; type HandleSingleModel = ( @@ -201,7 +204,7 @@ type HandleSingleModel = ( type IsModelAvailable = ( modelStr: string, - target?: ResolvedComboTarget + target?: ResolvedComboTarget & { allowRateLimitedConnection?: boolean } ) => Promise | boolean; type ComboRelayOptions = { @@ -3098,6 +3101,7 @@ export async function handleComboChat({ // #1731: Per-set-iteration set of providers whose quota is fully exhausted. // Reset each retry so providers excluded in a previous attempt get another chance. const exhaustedProviders = new Set(); + const transientRateLimitedProviders = new Set(); if (setTry > 0) { log.info("COMBO", `All targets failed — retrying set (${setTry}/${maxSetRetries})`); await new Promise((resolve) => { @@ -3129,6 +3133,11 @@ export async function handleComboChat({ const modelStr = target.modelStr; const provider = target.provider; const profile = await getRuntimeProviderProfile(provider); + const allowRateLimitedConnection = + Boolean(provider && provider !== "unknown") && transientRateLimitedProviders.has(provider); + const targetForAttempt = allowRateLimitedConnection + ? { ...target, allowRateLimitedConnection: true } + : target; // #1731: Skip targets from a provider that already signaled full quota exhaustion this request. if (provider && exhaustedProviders.has(provider)) { @@ -3142,7 +3151,7 @@ export async function handleComboChat({ // Pre-check: skip models where no credentials are available (excluded, rate-limited, or unavailable) if (isModelAvailable) { - const available = await isModelAvailable(modelStr, target); + const available = await isModelAvailable(modelStr, targetForAttempt); if (!available) { log.info("COMBO", `Skipping ${modelStr} — no credentials available or model excluded`); if (i > 0) fallbackCount++; @@ -3232,7 +3241,7 @@ export async function handleComboChat({ } } const result = await handleSingleModelWithTimeout(attemptBody, modelStr, { - ...target, + ...targetForAttempt, failoverBeforeRetry: config.failoverBeforeRetry, }); @@ -3501,6 +3510,8 @@ export async function handleComboChat({ "COMBO", `Provider ${provider} quota exhausted — marking for skip on remaining targets (#1731)` ); + } else if (result.status === 429 && provider && provider !== "unknown") { + transientRateLimitedProviders.add(provider); } // Trigger shared provider circuit breaker for 5xx errors and connection failures. @@ -3690,6 +3701,7 @@ async function handleRoundRobinCombo({ // When a target returns a quota-exhausted 429, remaining targets from the same // provider are skipped to avoid the cascade through N same-provider targets. const exhaustedProviders = new Set(); + const transientRateLimitedProviders = new Set(); // Try each model starting from the round-robin target for (let offset = 0; offset < modelCount; offset++) { @@ -3699,10 +3711,15 @@ async function handleRoundRobinCombo({ const provider = target.provider; const profile = await getRuntimeProviderProfile(provider); const semaphoreKey = `combo:${combo.name}:${target.executionKey}`; + const allowRateLimitedConnection = + Boolean(provider && provider !== "unknown") && transientRateLimitedProviders.has(provider); + const targetForAttempt = allowRateLimitedConnection + ? { ...target, allowRateLimitedConnection: true } + : target; // Pre-check availability if (isModelAvailable) { - const available = await isModelAvailable(modelStr, target); + const available = await isModelAvailable(modelStr, targetForAttempt); if (!available) { log.info("COMBO-RR", `Skipping ${modelStr} — no credentials available or model excluded`); if (offset > 0) fallbackCount++; @@ -3766,7 +3783,7 @@ async function handleRoundRobinCombo({ ); const result = await handleSingleModel(body, modelStr, { - ...target, + ...targetForAttempt, failoverBeforeRetry: config.failoverBeforeRetry, }); @@ -3932,6 +3949,8 @@ async function handleRoundRobinCombo({ if (providerExhausted) { exhaustedProviders.add(provider); log.info("COMBO-RR", `Provider ${provider} quota exhausted — marking for skip (#1731)`); + } else if (result.status === 429 && provider && provider !== "unknown") { + transientRateLimitedProviders.add(provider); } // Transient errors → mark in semaphore so round-robin stops stampeding this target. diff --git a/scripts/build/build-next-isolated.mjs b/scripts/build/build-next-isolated.mjs index 97e6792d7e..c251de747e 100644 --- a/scripts/build/build-next-isolated.mjs +++ b/scripts/build/build-next-isolated.mjs @@ -147,6 +147,18 @@ export async function syncStandaloneNativeAssets( sourcePath: path.join(rootDir, "node_modules", "wreq-js", "rust"), destinationPath: path.join(rootDir, ".next", "standalone", "node_modules", "wreq-js", "rust"), }, + { + label: "better-sqlite3 native binary", + sourcePath: path.join(rootDir, "node_modules", "better-sqlite3", "build"), + destinationPath: path.join( + rootDir, + ".next", + "standalone", + "node_modules", + "better-sqlite3", + "build" + ), + }, ]; let changed = false; @@ -171,6 +183,90 @@ export async function syncStandaloneNativeAssets( return changed; } +export async function syncStandaloneExtraModules( + rootDir = projectRoot, + fsImpl = fs, + log = console +) { + const entries = [ + { + label: "@swc/helpers", + sourcePath: path.join(rootDir, "node_modules", "@swc", "helpers"), + destRelative: path.join("node_modules", "@swc", "helpers"), + }, + { + label: "pino-abstract-transport", + sourcePath: path.join(rootDir, "node_modules", "pino-abstract-transport"), + destRelative: path.join("node_modules", "pino-abstract-transport"), + }, + { + label: "pino-pretty", + sourcePath: path.join(rootDir, "node_modules", "pino-pretty"), + destRelative: path.join("node_modules", "pino-pretty"), + }, + { + label: "split2", + sourcePath: path.join(rootDir, "node_modules", "split2"), + destRelative: path.join("node_modules", "split2"), + }, + { + label: "migrations", + sourcePath: path.join(rootDir, "src", "lib", "db", "migrations"), + destRelative: "migrations", + }, + { + label: "MITM server", + sourcePath: path.join(rootDir, "src", "mitm", "server.cjs"), + destRelative: path.join("src", "mitm", "server.cjs"), + }, + { + label: "run-standalone script", + sourcePath: path.join(rootDir, "scripts", "dev", "run-standalone.mjs"), + destRelative: path.join("dev", "run-standalone.mjs"), + }, + { + label: "runtime-env script", + sourcePath: path.join(rootDir, "scripts", "build", "runtime-env.mjs"), + destRelative: path.join("build", "runtime-env.mjs"), + }, + { + label: "bootstrap-env script", + sourcePath: path.join(rootDir, "scripts", "build", "bootstrap-env.mjs"), + destRelative: path.join("build", "bootstrap-env.mjs"), + }, + { + label: "healthcheck script", + sourcePath: path.join(rootDir, "scripts", "dev", "healthcheck.mjs"), + destRelative: "healthcheck.mjs", + }, + { + label: "public directory", + sourcePath: path.join(rootDir, "public"), + destRelative: "public", + }, + { + label: "playwright-core (dynamic import by gemini-web executor)", + sourcePath: path.join(rootDir, "node_modules", "playwright-core"), + destRelative: path.join("node_modules", "playwright-core"), + }, + ]; + + let changed = false; + const standaloneRoot = path.join(rootDir, ".next", "standalone"); + + for (const entry of entries) { + if (!(await exists(entry.sourcePath))) continue; + + const destPath = path.join(standaloneRoot, entry.destRelative); + await fsImpl.mkdir(path.dirname(destPath), { recursive: true }); + await fsImpl.cp(entry.sourcePath, destPath, { recursive: true, force: true }); + log.log(`[build-next-isolated] Synced standalone module: ${entry.label}`); + changed = true; + } + + return changed; +} + export async function main() { const movedPaths = []; const transientBuildPaths = getTransientBuildPaths(); @@ -225,6 +321,15 @@ export async function main() { nativeAssetErr ); } + + try { + await syncStandaloneExtraModules(projectRoot); + } catch (extraModuleErr) { + console.warn( + "[build-next-isolated] Non-fatal error syncing extra modules:", + extraModuleErr + ); + } } process.exitCode = result.code; } catch (error) { diff --git a/src/app/api/logs/detail/route.ts b/src/app/api/logs/detail/route.ts index 4a85321e42..90fa93ca2d 100644 --- a/src/app/api/logs/detail/route.ts +++ b/src/app/api/logs/detail/route.ts @@ -9,6 +9,7 @@ import { getRequestDetailLogCount, isDetailedLoggingEnabled, } from "@/lib/db/detailedLogs"; +import { getUserDatabaseSettings, updateDatabaseSettings } from "@/lib/db/databaseSettings"; import { updateSettings } from "@/lib/db/settings"; export const dynamic = "force-dynamic"; @@ -36,6 +37,14 @@ export async function POST(req: NextRequest) { const enabled = body.enabled === true || body.enabled === "1"; await updateSettings({ call_log_pipeline_enabled: enabled }); + const databaseSettings = getUserDatabaseSettings(); + updateDatabaseSettings({ + logs: { + ...databaseSettings.logs, + detailedLogsEnabled: enabled, + callLogPipelineEnabled: enabled, + }, + }); return NextResponse.json({ success: true, diff --git a/src/app/api/oauth/[provider]/[action]/route.ts b/src/app/api/oauth/[provider]/[action]/route.ts index 194601c698..56c74dd71b 100755 --- a/src/app/api/oauth/[provider]/[action]/route.ts +++ b/src/app/api/oauth/[provider]/[action]/route.ts @@ -6,6 +6,7 @@ import { exchangeTokens, requestDeviceCode, pollForToken, + resolveBrowserOAuthRedirectUri, } from "@/lib/oauth/providers"; import { createProviderConnection, @@ -80,7 +81,9 @@ export async function GET( const { searchParams } = new URL(request.url); if (action === "authorize") { - const redirectUri = searchParams.get("redirect_uri") || "http://localhost:8080/callback"; + const requestedRedirectUri = + searchParams.get("redirect_uri") || "http://localhost:8080/callback"; + const redirectUri = resolveBrowserOAuthRedirectUri(provider, requestedRedirectUri); const authData = generateAuthData(provider, redirectUri); if (provider === "qoder" && !authData.authUrl) { return NextResponse.json({ diff --git a/src/lib/db/databaseSettings.ts b/src/lib/db/databaseSettings.ts index f9fa21b109..4b67b073b2 100644 --- a/src/lib/db/databaseSettings.ts +++ b/src/lib/db/databaseSettings.ts @@ -83,6 +83,17 @@ function parseStoredValue(rawValue: unknown): unknown { } } +function toBooleanSetting(value: unknown): boolean | null { + if (typeof value === "boolean") return value; + if (typeof value === "number") return !Number.isNaN(value) && value !== 0; + if (typeof value !== "string") return null; + + const normalized = value.trim().toLowerCase(); + if (["1", "true", "yes", "on"].includes(normalized)) return true; + if (["0", "false", "no", "off"].includes(normalized)) return false; + return null; +} + function readNamespace(namespace: string): Record { const db = getDbInstance(); const rows = db @@ -119,6 +130,18 @@ function mergeTopLevelSections(target: UserDatabaseSettings, values: Record) { + const pipelineEnabled = toBooleanSetting(values.call_log_pipeline_enabled); + if (pipelineEnabled !== null) { + target.logs.callLogPipelineEnabled = pipelineEnabled; + } + + const legacyDetailedEnabled = toBooleanSetting(values.detailed_logs_enabled); + if (legacyDetailedEnabled !== null) { + target.logs.detailedLogsEnabled = legacyDetailedEnabled; + } +} + function mergeDatabaseSettingsNamespace( target: UserDatabaseSettings, values: Record @@ -195,6 +218,7 @@ export function getUserDatabaseSettings(): UserDatabaseSettings { mergeTopLevelSections(settings, mainSettings); mergeDatabaseSettingsNamespace(settings, readNamespace(DATABASE_SETTINGS_NAMESPACE)); + mergeRuntimeLogSettings(settings, mainSettings); return settings; } @@ -236,6 +260,14 @@ export function updateDatabaseSettings( const insert = db.prepare( "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES (?, ?, ?)" ); + const settingsInsert = db.prepare( + "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('settings', ?, ?)" + ); + + const requestedLogs = updates.logs as Partial | undefined; + const pipelineEnabled = requestedLogs?.callLogPipelineEnabled; + const detailedEnabled = requestedLogs?.detailedLogsEnabled; + const tx = db.transaction(() => { for (const section of DATABASE_SETTINGS_SECTIONS) { const sectionValues = nextSettings[section] as Record; @@ -244,6 +276,10 @@ export function updateDatabaseSettings( insert.run(DATABASE_SETTINGS_NAMESPACE, `${section}.${key}`, JSON.stringify(value)); } } + + if (pipelineEnabled !== undefined) { + settingsInsert.run("call_log_pipeline_enabled", JSON.stringify(Boolean(pipelineEnabled))); + } }); tx(); diff --git a/src/lib/oauth/providers.ts b/src/lib/oauth/providers.ts index 5709042630..3689b4aa47 100644 --- a/src/lib/oauth/providers.ts +++ b/src/lib/oauth/providers.ts @@ -10,6 +10,66 @@ import { generatePKCE, generateState } from "./utils/pkce"; import { PROVIDERS } from "./providers/index"; +const GOOGLE_BROWSER_PROVIDERS = new Set(["antigravity", "gemini-cli"]); + +function normalizeBaseUrl(value) { + const trimmed = typeof value === "string" ? value.trim() : ""; + if (!trimmed) return ""; + return trimmed.replace(/\/+$/, ""); +} + +function hasCustomGoogleOAuthCredentials(providerName, env = process.env) { + if (providerName === "antigravity") { + return !!env.ANTIGRAVITY_OAUTH_CLIENT_ID?.trim(); + } + + if (providerName === "gemini-cli") { + return !!env.GEMINI_CLI_OAUTH_CLIENT_ID?.trim() || !!env.GEMINI_OAUTH_CLIENT_ID?.trim(); + } + + return false; +} + +/** + * Google providers default to localhost redirects so the embedded public + * credentials keep working on out-of-the-box local installs. When operators + * provide their own Google OAuth client IDs for a remote deployment, prefer the + * public callback URL documented in .env.example / docs/README so the popup can + * navigate back to OmniRoute instead of stalling on localhost. + */ +export function resolveBrowserOAuthRedirectUri( + providerName, + redirectUri, + env = process.env +) { + if (!GOOGLE_BROWSER_PROVIDERS.has(providerName)) { + return redirectUri; + } + + if (!hasCustomGoogleOAuthCredentials(providerName, env)) { + return redirectUri; + } + + const publicBaseUrl = + normalizeBaseUrl(env.NEXT_PUBLIC_BASE_URL) || normalizeBaseUrl(env.OMNIROUTE_PUBLIC_BASE_URL); + + if (!publicBaseUrl) { + return redirectUri; + } + + try { + const requested = new URL(redirectUri); + const isLocalhostRedirect = /^(localhost|127\.0\.0\.1)$/i.test(requested.hostname); + if (!isLocalhostRedirect) { + return redirectUri; + } + } catch { + return redirectUri; + } + + return `${publicBaseUrl}/callback`; +} + /** * Get provider handler */ diff --git a/src/lib/providers/codexFastTier.ts b/src/lib/providers/codexFastTier.ts index de796f2087..9fe973e467 100644 --- a/src/lib/providers/codexFastTier.ts +++ b/src/lib/providers/codexFastTier.ts @@ -130,8 +130,8 @@ export interface ApplyCodexGlobalFastServiceTierOptions { */ model?: string | null; /** - * Outbound request body. Per-request body.service_tier is left untouched if - * already set. + * Outbound request body. A valid per-request body.service_tier is left untouched + * when already set. */ body?: Record | null; } @@ -188,12 +188,11 @@ export function applyCodexGlobalFastServiceTier global mode > connection defaults. diff --git a/src/shared/components/OAuthModal.tsx b/src/shared/components/OAuthModal.tsx index 8f021c54d4..df0c59b69f 100644 --- a/src/shared/components/OAuthModal.tsx +++ b/src/shared/components/OAuthModal.tsx @@ -381,9 +381,9 @@ export default function OAuthModal({ // - Codex/OpenAI: always port 1455 (registered in OAuth app) // - Windsurf/Devin CLI (remote fallback): use localhost with OmniRoute port + /auth/callback // (on true localhost the callback server handles it; this is only reached on remote) - // - Google OAuth providers (antigravity, gemini-cli): always localhost, regardless of - // where OmniRoute is hosted — Google only accepts pre-registered localhost URIs with - // the built-in credentials. Remote users must configure their own credentials. + // - Google OAuth providers (antigravity, gemini-cli): default to localhost so the + // bundled credentials keep working. The authorize route upgrades this to the public + // callback when custom Google credentials + NEXT_PUBLIC_BASE_URL are configured. // - Other providers on remote: use actual origin (supports PUBLIC_URL env var) // - Localhost: use localhost:port let redirectUri: string; @@ -433,7 +433,7 @@ export default function OAuthModal({ ); } - setAuthData({ ...data, redirectUri }); + setAuthData({ ...data, redirectUri: data.redirectUri || redirectUri }); // For non-true-localhost (LAN IPs, remote) or manual fallback: use manual input mode (user pastes callback URL) if (!isTrueLocalhost || forceManual) { diff --git a/src/sse/handlers/chat.ts b/src/sse/handlers/chat.ts index ca5da75c62..7c2988cfaa 100644 --- a/src/sse/handlers/chat.ts +++ b/src/sse/handlers/chat.ts @@ -438,6 +438,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) { const checkModelAvailable = async ( modelString: string, target?: { + allowRateLimitedConnection?: boolean; connectionId?: string | null; allowedConnectionIds?: string[] | null; executionKey?: string | null; @@ -469,6 +470,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) { resolvedModel, { sessionKey: sessionAffinityKey, + ...(target?.allowRateLimitedConnection ? { allowRateLimitedConnections: true } : {}), ...(target?.connectionId ? { forcedConnectionId: target.connectionId } : {}), } ); @@ -496,6 +498,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) { b: any, m: string, target?: { + allowRateLimitedConnection?: boolean; connectionId?: string | null; executionKey?: string | null; stepId?: string | null; @@ -520,6 +523,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) { comboStepId: target?.stepId || null, comboExecutionKey: target?.executionKey || target?.stepId || null, skipUpstreamRetry: target?.failoverBeforeRetry ?? false, + allowRateLimitedConnection: target?.allowRateLimitedConnection === true, preselectedCredentials: comboPreselectedCredentials.get( getComboCredentialCacheKey(m, target) ), @@ -651,6 +655,7 @@ async function handleSingleModelChat( comboStepId?: string | null; comboExecutionKey?: string | null; skipUpstreamRetry?: boolean; + allowRateLimitedConnection?: boolean; preselectedCredentials?: any; cachedSettings?: any; } = {}, @@ -811,6 +816,9 @@ async function handleSingleModelChat( { sessionKey: runtimeOptions.sessionAffinityKey ?? runtimeOptions.sessionId ?? null, excludeConnectionIds: Array.from(excludedConnectionIds), + ...(runtimeOptions.allowRateLimitedConnection + ? { allowRateLimitedConnections: true } + : {}), ...(forceLiveComboTest ? { allowSuppressedConnections: true, diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts index 06e4e56550..79edfc1169 100644 --- a/src/sse/services/auth.ts +++ b/src/sse/services/auth.ts @@ -94,6 +94,7 @@ interface RecoverableConnectionState { interface CredentialSelectionOptions { allowSuppressedConnections?: boolean; + allowRateLimitedConnections?: boolean; bypassQuotaPolicy?: boolean; forcedConnectionId?: string | null; excludeConnectionIds?: string[] | null; @@ -846,6 +847,8 @@ export async function getProviderCredentials( } const allowSuppressedConnections = options.allowSuppressedConnections === true; + const allowRateLimitedConnections = + allowSuppressedConnections || options.allowRateLimitedConnections === true; const bypassQuotaPolicy = options.bypassQuotaPolicy === true; const forcedConnectionId = typeof options.forcedConnectionId === "string" && options.forcedConnectionId.trim().length > 0 @@ -973,7 +976,7 @@ export async function getProviderCredentials( return false; } if (!allowSuppressedConnections) { - if (isAccountUnavailable(c.rateLimitedUntil)) return false; + if (!allowRateLimitedConnections && isAccountUnavailable(c.rateLimitedUntil)) return false; if (isTerminalConnectionStatus(c)) return false; if (provider === "codex" && isCodexScopeUnavailable(c, requestedModel)) return false; // Per-model lockout: if this specific model is locked on this connection, skip it diff --git a/tests/integration/chat-pipeline.test.ts b/tests/integration/chat-pipeline.test.ts index 7476240b2c..2773023a11 100644 --- a/tests/integration/chat-pipeline.test.ts +++ b/tests/integration/chat-pipeline.test.ts @@ -606,6 +606,47 @@ test("chat pipeline persists Codex responses cache and reasoning tokens to call assert.equal(callLog.tokens.reasoning, 13); }); +test("chat pipeline applies global Codex priority service tier inside combos", async () => { + await seedConnection("codex", { apiKey: "sk-codex-combo-priority" }); + await settingsDb.updateSettings({ + codexServiceTier: { enabled: true, tier: "priority" }, + }); + await combosDb.createCombo({ + name: "codex-priority-combo", + strategy: "priority", + config: { maxRetries: 0, retryDelayMs: 0 }, + models: ["codex/gpt-5.5"], + }); + const fetchCalls = []; + + globalThis.fetch = async (url, init: RequestInit = {}) => { + fetchCalls.push({ + url: String(url), + headers: toPlainHeaders(init.headers), + body: init.body ? JSON.parse(String(init.body)) : null, + }); + return buildOpenAIResponsesSSE({ text: "combo priority ok", model: "gpt-5.5" }); + }; + + const response = await handleChat( + buildRequest({ + body: { + model: "codex-priority-combo", + stream: false, + messages: [{ role: "user", content: "Use Codex combo priority" }], + }, + }) + ); + + const json = (await response.json()) as any; + assert.equal(response.status, 200); + assert.equal(fetchCalls.length, 1); + assert.match(fetchCalls[0].url, /\/responses$/); + assert.equal(fetchCalls[0].headers.Authorization, "Bearer sk-codex-combo-priority"); + assert.equal(fetchCalls[0].body.service_tier, "priority"); + assert.equal(json.choices[0].message.content, "combo priority ok"); +}); + test("chat pipeline applies Codex CLI fingerprint to OAuth responses requests", async () => { setCliCompatProviders(["codex"]); await seedConnection("codex", { @@ -950,12 +991,7 @@ test("chat pipeline sends Gemini CLI OAuth requests with native Cloud Code trans assert.equal(generateCall.body.requestId, undefined); assert.equal(generateCall.body.user_prompt_id, generateCall.body.request.session_id); const keys = Object.keys(generateCall.body).slice(0, 4); - assert.deepEqual(keys.sort(), [ - "model", - "project", - "request", - "user_prompt_id", - ]); + assert.deepEqual(keys.sort(), ["model", "project", "request", "user_prompt_id"]); assert.equal(generateCall.body.request.sessionId, undefined); assert.match(generateCall.body.request.session_id, /^[0-9a-f-]{36}$/i); assert.equal(generateCall.body.request.contents.at(-1).parts[0].text, "Hello Gemini CLI"); diff --git a/tests/integration/combo-provider-exhaustion.test.ts b/tests/integration/combo-provider-exhaustion.test.ts index 8957695b8b..2d20c96dbb 100644 --- a/tests/integration/combo-provider-exhaustion.test.ts +++ b/tests/integration/combo-provider-exhaustion.test.ts @@ -495,3 +495,79 @@ test.skip("round-robin path fast-skip: round-robin combo also skips exhausted pr assert.equal(openaiCalls, 1, "round-robin should skip second openai target"); assert.equal(anthropicCalls, 1); }); + +test("allow rate-limited connections after transient 429 on subsequent targets in same combo", async () => { + const now = Date.now(); + await seedConnection("openai", { + name: "openai-rate-limited-reused", + apiKey: "sk-openai-rate-limited-reused", + rateLimitedUntil: new Date(now + 60000).toISOString(), + }); + + await seedConnection("openai", { + name: "openai-fresh-429", + apiKey: "sk-openai-fresh-429", + }); + + await settingsDb.updateSettings({ + requestRetry: 0, + maxRetryIntervalSec: 0, + }); + + await combosDb.createCombo({ + name: "rate-limit-reuse-combo", + strategy: "priority", + config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 }, + models: [ + "openai/gpt-4o-mini", + "openai/gpt-3.5-turbo", + ], + }); + + let openaiCalls = 0; + let usedApiKeys: string[] = []; + + globalThis.fetch = async (_url: string, init: any = {}) => { + const headers = toPlainHeaders(init.headers); + const authHeader = headers.authorization ?? headers.Authorization; + + openaiCalls += 1; + if (authHeader === "Bearer sk-openai-fresh-429") { + usedApiKeys.push("fresh"); + return new Response(JSON.stringify({ error: { message: "Too many requests" } }), { + status: 429, + headers: { "Content-Type": "application/json" }, + }); + } + + if (authHeader === "Bearer sk-openai-rate-limited-reused") { + usedApiKeys.push("rate-limited"); + return new Response( + JSON.stringify({ choices: [{ message: { content: "rate limited reuse success" } }] }), + { + status: 200, + headers: { "Content-Type": "application/json" }, + } + ); + } + + throw new Error(`unexpected upstream headers: ${JSON.stringify(headers)}`); + }; + + const response = await handleChat( + buildRequest({ + body: { + model: "rate-limit-reuse-combo", + stream: false, + messages: [{ role: "user", content: "test rate limit reuse" }], + }, + }) + ); + + const body = (await response.json()) as any; + assert.equal(response.status, 200); + assert.equal(body.choices[0].message.content, "rate limited reuse success"); + assert.equal(openaiCalls, 2); + assert.deepEqual(usedApiKeys, ["fresh", "rate-limited"]); +}); + diff --git a/tests/unit/codex-fast-tier.test.ts b/tests/unit/codex-fast-tier.test.ts index 4aea837ccb..f411574345 100644 --- a/tests/unit/codex-fast-tier.test.ts +++ b/tests/unit/codex-fast-tier.test.ts @@ -106,15 +106,17 @@ test("Codex global service tier injects selected mode and can override connectio }); test("Codex global service tier matches provider-prefixed combo model ids", () => { + const body: Record = {}; assert.deepEqual( applyCodexGlobalFastServiceTier( "codex", { providerSpecificData: {} }, { codexServiceTier: { enabled: true, tier: "priority" } }, - { model: "codex/gpt-5.5" } + { model: "codex/gpt-5.5", body } ), { providerSpecificData: { requestDefaults: { serviceTier: "priority" } } } ); + assert.equal(body.service_tier, "priority"); const unsupported = { providerSpecificData: {} }; assert.equal( @@ -155,7 +157,7 @@ test("Codex global service tier only short-circuits on valid body service_tier", assert.deepEqual(injected, { providerSpecificData: { requestDefaults: { serviceTier: "priority" } }, }); - assert.equal(invalidBody.service_tier, "invalid"); + assert.equal(invalidBody.service_tier, "priority"); const validBody: Record = { service_tier: " Flex " }; const unchanged = { providerSpecificData: {} }; diff --git a/tests/unit/database-settings-maintenance.test.ts b/tests/unit/database-settings-maintenance.test.ts index 299c7fa370..fa553eb687 100644 --- a/tests/unit/database-settings-maintenance.test.ts +++ b/tests/unit/database-settings-maintenance.test.ts @@ -11,6 +11,7 @@ process.env.DISABLE_SQLITE_AUTO_BACKUP = "true"; const core = await import("../../src/lib/db/core.ts"); const databaseSettings = await import("../../src/lib/db/databaseSettings.ts"); const databaseSettingsRoute = await import("../../src/app/api/settings/database/route.ts"); +const settingsDb = await import("../../src/lib/db/settings.ts"); const cleanup = await import("../../src/lib/db/cleanup.ts"); const aggregateHistory = await import("../../src/lib/usage/aggregateHistory.ts"); @@ -101,6 +102,23 @@ test("database settings reader supports legacy flat keys and lets nested saves w assert.equal(databaseSettings.getUserDatabaseSettings().retention.callLogs, 7); }); +test("database log settings mirror the runtime pipeline toggle", async () => { + await settingsDb.updateSettings({ call_log_pipeline_enabled: false }); + + assert.equal(databaseSettings.getUserDatabaseSettings().logs.callLogPipelineEnabled, false); + + databaseSettings.updateDatabaseSettings({ + logs: { + ...databaseSettings.getUserDatabaseSettings().logs, + callLogPipelineEnabled: true, + }, + }); + + const settings = await settingsDb.getSettings(); + assert.equal(settings.call_log_pipeline_enabled, true); + assert.equal(databaseSettings.getUserDatabaseSettings().logs.callLogPipelineEnabled, true); +}); + test("purgeDetailedLogs deletes request_detail_logs", async () => { const db = core.getDbInstance(); db.prepare("INSERT INTO request_detail_logs (id, timestamp, duration_ms) VALUES (?, ?, ?)").run( diff --git a/tests/unit/oauth-providers-config.test.ts b/tests/unit/oauth-providers-config.test.ts index c277c5aea3..dc0c0d3103 100644 --- a/tests/unit/oauth-providers-config.test.ts +++ b/tests/unit/oauth-providers-config.test.ts @@ -18,8 +18,10 @@ const providersModule = await import("../../src/lib/oauth/providers/index.ts"); const oauthModule = await import("../../src/lib/oauth/constants/oauth.ts"); const registryModule = await import("../../open-sse/config/providerRegistry.ts"); const antigravityHeadersModule = await import("../../open-sse/services/antigravityHeaders.ts"); +const oauthHelpersModule = await import("../../src/lib/oauth/providers.ts"); const PROVIDERS = providersModule.default; +const { resolveBrowserOAuthRedirectUri } = oauthHelpersModule; const { ANTIGRAVITY_CONFIG, CLAUDE_CONFIG, @@ -316,6 +318,44 @@ test("browser-based providers expose buildAuthUrl and return provider-specific a assert.equal(clineUrl.origin, "https://api.cline.bot"); }); +test("custom Google OAuth credentials switch Antigravity remote callbacks to NEXT_PUBLIC_BASE_URL", () => { + const redirectUri = resolveBrowserOAuthRedirectUri( + "antigravity", + "http://localhost:20128/callback", + { + NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com/", + ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com", + } + ); + + assert.equal(redirectUri, "https://omniroute.example.com/callback"); +}); + +test("custom Google OAuth credentials switch Gemini remote callbacks to OMNIROUTE_PUBLIC_BASE_URL", () => { + const redirectUri = resolveBrowserOAuthRedirectUri( + "gemini-cli", + "http://127.0.0.1:20128/callback", + { + OMNIROUTE_PUBLIC_BASE_URL: "https://omniroute.example.com", + GEMINI_CLI_OAUTH_CLIENT_ID: "custom-gemini.apps.googleusercontent.com", + } + ); + + assert.equal(redirectUri, "https://omniroute.example.com/callback"); +}); + +test("Google OAuth callbacks stay on localhost when no custom credentials are configured", () => { + const redirectUri = resolveBrowserOAuthRedirectUri( + "antigravity", + "http://localhost:20128/callback", + { + NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com", + } + ); + + assert.equal(redirectUri, "http://localhost:20128/callback"); +}); + test("device and import-token providers expose the flow-specific fields expected by their configs", () => { const deviceProviders = ["qwen", "kimi-coding", "github", "kiro", "amazon-q", "kilocode"]; diff --git a/tests/unit/sse-auth.test.ts b/tests/unit/sse-auth.test.ts index f72348303e..5b57edbe46 100644 --- a/tests/unit/sse-auth.test.ts +++ b/tests/unit/sse-auth.test.ts @@ -608,6 +608,22 @@ test("getProviderCredentials retains rate-limited accounts when allowSuppressedC assert.equal(bypassed.connectionId, connection.id); }); +test("getProviderCredentials retains rate-limited accounts when allowRateLimitedConnections is enabled", async () => { + const connection = await seedConnection("openai", { + name: "allow-rate-limit-option", + rateLimitedUntil: futureIso(), + }); + + const blocked = await auth.getProviderCredentials("openai"); + const bypassed = await auth.getProviderCredentials("openai", null, null, null, { + allowRateLimitedConnections: true, + }); + + assert.equal(blocked.allRateLimited, true); + assert.equal(bypassed.connectionId, connection.id); +}); + + test("getProviderCredentials retains terminal accounts for combo live tests", async () => { const connection = await seedConnection("openai", { name: "suppressed-terminal",