Merge remote-tracking branch 'origin/release/v3.8.49' into pr-7067-deps-production

# Conflicts: # package-lock.json
2026-08-17 20:52:15 +03:00 · 2026-07-15 14:13:58 -03:00
parent 57b421deed d3f88716bb
commit 741b4511ba
382 changed files with 15626 additions and 13464 deletions
--- a/.env.example
+++ b/.env.example
@@ -505,7 +505,9 @@ NEXT_PUBLIC_CLOUD_URL=
 #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
 #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
 #OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
-#OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit
+# OpenCode Go has no public quota API — this has no default and stays
+# unset unless you explicitly opt in to a self-hosted/mirrored endpoint:
+#OMNIROUTE_OPENCODE_GO_QUOTA_URL=
 #OMNIROUTE_OPENCODE_GO_DASHBOARD_URL=https://opencode.ai/workspace
 #OMNIROUTE_OLLAMA_CLOUD_USAGE_URL=https://ollama.com/settings

--- a/.env.homolog.example
+++ b/.env.homolog.example
@@ -0,0 +1,9 @@
+# Homologação E2E real — copie para .env.homolog (NUNCA commitar o real)
+HOMOLOG_BASE_URL=http://192.168.0.15:20128
+# Senha de management do dashboard da VPS (a mesma do /login)
+HOMOLOG_ADMIN_PASSWORD=
+# Deixe vazio: a suíte cria uma API key efêmera via admin e revoga no fim.
+# Só preencha para depurar uma camada isolada com uma key fixa.
+HOMOLOG_API_KEY=
+# Tier crítico (chat real, max_tokens=5). Demais providers: só validação de catálogo.
+HOMOLOG_CRITICAL_PROVIDERS=openai,anthropic,gemini,codex,grok,glm,deepseek,openrouter
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,7 @@ jobs:
      docs: ${{ steps.classify.outputs.docs }}
      i18n: ${{ steps.classify.outputs.i18n }}
      workflow: ${{ steps.classify.outputs.workflow }}
+      testsOnly: ${{ steps.classify.outputs.testsOnly }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
@@ -124,11 +125,23 @@ jobs:
      - run: npm run check:route-guard-membership
      - run: npm run check:test-discovery
      - run: npm run check:tracked-artifacts
+      # WS1.7 (v3.8.49 plan): Dockerfile lint (hadolint, pinned by digest).
+      # failure-threshold=error keeps the 5 pre-existing warnings (DL3008/DL3003/
+      # DL3016 version pinning / WORKDIR) visible without blocking; any ERROR fails.
+      - name: hadolint (Dockerfile)
+        run: docker run --rm -i hadolint/hadolint@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint --failure-threshold error - < Dockerfile
      - run: npm run check:lockfile
      - run: npm run check:licenses
      # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
      # husky pre-commit hook; the standalone copy here was redundant (ROI dedup).
      - run: npm run typecheck:core
+      # #7033: typecheck:core's curated file allowlist does not cover
+      # src/app/(dashboard) TSX (and next.config.mjs sets ignoreBuildErrors:
+      # true, so `next build` never type-checks it either) — orphaned
+      # identifiers there (see #6625/#6909) were invisible to CI. This gate
+      # runs tsc scoped to the dashboard tree against a frozen baseline of
+      # pre-existing errors; only NEW errors fail it.
+      - run: npm run check:dashboard-typecheck
      # typecheck:noimplicit:core dropped from this job (2026-07 optimize):
      # it was advisory (continue-on-error) and largely subsumed by the blocking
      # check:type-coverage ratchet in quality-gate. Local: npm run typecheck:noimplicit:core.
@@ -148,7 +161,7 @@ jobs:
    # The coverage.* metrics degrade gracefully: the download is continue-on-error and
    # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed.
    # Path filter: code-only — pure docs/i18n PRs have nothing for these ratchets to guard.
-    if: ${{ !cancelled() && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
+    if: ${{ !cancelled() && !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
    # security-events: read lets the CodeQL ratchet read open code-scanning alerts
    # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working.
    permissions:
@@ -258,7 +271,7 @@ jobs:
    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
    # Path filter: code-only (scanners/ratchets target production surface).
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true')) }}
    steps:
      # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base
      # spec via `git show <base_ref>:docs/openapi.yaml`; a shallow clone
@@ -609,12 +622,26 @@ jobs:
      - name: Assert dist/server.js exists
        run: test -f dist/server.js || (echo "dist/server.js missing — build:cli did not assemble correctly" && exit 1)
      - run: npm run check:pack-artifact
+      # WS1.2 (#7065 class): pack the real tarball, install it into a clean prefix and
+      # BOOT it to a healthy /api/monitoring/health — the gate that structure checks
+      # cannot provide (3 releases shipped boot-crashing tarballs with green lists).
+      - name: Boot-smoke the packed tarball
+        run: npm run check:pack-boot

  electron-package-smoke:
-    name: Electron Package Smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
+    name: Electron Package Smoke (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
    needs: build
+    # WS1.5 (v3.8.49 plan): the Electron rebuild/spawn path previously executed for
+    # the FIRST time on the release tag — the v3.8.48 Windows bug (npx.cmd spawned
+    # without shell, CVE-2024-27980 behavior change) could only surface at release.
+    # windows-latest runs prepare:bundle (the ABI rebuild + spawn plan) per release
+    # PR; ubuntu keeps the full pack + headless smoke.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
    env:
      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
      CSC_IDENTITY_AUTO_DISCOVERY: "false"
@@ -640,9 +667,15 @@ jobs:
        working-directory: electron
        run: npm install --no-audit --no-fund
      - name: Pack Electron app
+        if: runner.os == 'Linux'
        working-directory: electron
        run: npm run pack
+      - name: Prepare Electron standalone (Windows ABI rebuild + spawn path)
+        if: runner.os == 'Windows'
+        working-directory: electron
+        run: npm run prepare:bundle
      - name: Smoke packaged Electron app
+        if: runner.os == 'Linux'
        env:
          ELECTRON_SMOKE_TIMEOUT_MS: 60000
        run: xvfb-run -a npm run electron:smoke:packaged
@@ -725,12 +758,23 @@ jobs:
      - uses: ./.github/actions/npm-ci-retry
      # The second test runner (CLAUDE.md: "Both test runners must pass") — was never
      # wired into CI until the 2026-06-09 quality audit (Fase 6A.2).
-      - run: npm run test:vitest
-      # vitest:ui is RED today (14 fails — UI component drift accumulated while the
-      # suite never ran in CI). Informational until the Fase 6A triage (2026-06-16+)
-      # fixes the components/tests; then drop continue-on-error to make it blocking.
-      - run: npm run test:vitest:ui
+      # WS5.2/5.3 (v3.8.49 plan): JUnit output feeds Trunk Flaky Tests (advisory upload
+      # below). node:test stays OUT of the first wave (fd1-sensitive reporter stream).
+      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-mcp.xml
+      # vitest:ui went back to 870/870 green in the v3.8.49 quality plan (WS6.1,
+      # PR #7127 — 69 fails triaged: matchMedia polyfill, node:test→vitest migration,
+      # CompareTab D22 cap). Promoted to BLOCKING per the plan's post-merge step.
+      - run: npm run test:vitest:ui -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-ui.xml
+      # Trunk Flaky Tests upload — advisory (never blocks), own-origin only (fork PRs
+      # have no TRUNK_TOKEN). Pinned by SHA (tag v2.1.2).
+      - name: Upload test results to Trunk (advisory)
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
        continue-on-error: true
+        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
+        with:
+          junit-paths: trunk-junit/**/*.xml
+          org-slug: omniroute
+          token: ${{ secrets.TRUNK_TOKEN }}

  # Node 24/26 compatibility matrices moved to .github/workflows/nightly-compat.yml
  # (plano mestre testes+CI, Eixo D2 — they cost ~28% of every heavy run to catch a
@@ -741,7 +785,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: test-unit
-    if: ${{ !cancelled() && needs.test-unit.result == 'success' }}
+    if: ${{ !cancelled() && needs.test-unit.result == 'success' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
@@ -789,6 +833,7 @@ jobs:
            --merge-async \
            --reporter=text-summary \
            --reporter=json-summary \
+            --reporter=lcov \
            --exclude=tests/** \
            --exclude=**/*.test.* \
            --check-coverage \
@@ -810,6 +855,18 @@ jobs:
              > coverage/coverage-report.md
          fi
          cat coverage/coverage-report.md >> "$GITHUB_STEP_SUMMARY"
+      # WS5.6 (D7, v3.8.49 plan): patch coverage on the PR diff via Codecov —
+      # informational during calibration (codecov.yml sets informational: true);
+      # promote to blocking only after ~2 weeks without false blocks. The lcov
+      # reporter above also fixes coverage/lcov.info being silently absent
+      # (if-no-files-found: warn) — Sonar consumes the same file.
+      - name: Upload coverage to Codecov (informational)
+        if: always()
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
+        with:
+          files: coverage/lcov.info
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
      - name: Upload coverage artifacts
        if: always()
        uses: actions/upload-artifact@v7
@@ -834,10 +891,14 @@ jobs:
        with:
          persist-credentials: false
          fetch-depth: 0
+      # The upload strips the common `coverage/` prefix, so the artifact root holds
+      # lcov.info directly — download into coverage/ so it lands at coverage/lcov.info,
+      # where sonar.javascript.lcov.reportPaths expects it (path: . left the Sonar
+      # new-code coverage at 0% every scan).
      - uses: actions/download-artifact@v8
        with:
          name: coverage-report
-          path: .
+          path: coverage/
      - name: Explain SonarQube skip
        if: ${{ github.event_name != 'pull_request' || env.SONAR_TOKEN == '' || env.SONAR_HOST_URL == '' }}
        run: |
@@ -956,7 +1017,12 @@ jobs:
    # ~33%. Playwright browser is cached across runs (~1.5min saved per shard).
    # Heavy shard target: ≤20min (was ~40min). Timeout 45min to cover slow runners.
    timeout-minutes: 45
-    needs: build
+    needs: [build, changes]
+    # WS3.1 hotfix fast-lane: the 9-shard E2E matrix is the CI critical path (~25min).
+    # It skips for (a) PRs labeled `hotfix` (entry policy in docs/ops/RELEASE_CHECKLIST.md:
+    # production-broken only, full-suite evidence from the previous green run linked in the
+    # PR) and (b) tests-only diffs outside tests/e2e/ (cannot change the served app).
+    if: ${{ needs.changes.outputs.testsOnly != 'true' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
    strategy:
      fail-fast: false
      matrix:
@@ -991,7 +1057,33 @@ jobs:
      - name: Extract Next.js build artifact
        run: |
          tar -xzf /tmp/e2e-build.tar.gz
-      - run: npx playwright test tests/e2e/*.spec.ts --shard=${{ matrix.shard }}/9
+      # WS4.1: duration-balanced shards (LPT over config/quality/e2e-timings.json).
+      # Measured skew of plain --shard was 14× (24m47s vs 1m47s) — E2E was the CI
+      # critical path. The balancer self-verifies completeness and exits non-zero on
+      # any inconsistency, falling back to plain --shard (never fewer specs).
+      - name: Run E2E tests (duration-balanced shard)
+        env:
+          SHARD: ${{ matrix.shard }}
+          PLAYWRIGHT_JUNIT_OUTPUT_NAME: junit-e2e-results.xml
+        run: |
+          if FILES=$(node scripts/quality/balance-e2e-shards.mjs "$SHARD" 9); then
+            if [ -z "$FILES" ]; then echo "[e2e-balance] shard $SHARD has no files"; exit 0; fi
+            echo "[e2e-balance] shard $SHARD runs:"; echo "$FILES"
+            # shellcheck disable=SC2086 — FILES is our own newline-separated path list
+            npx playwright test $(echo "$FILES" | tr '\n' ' ') --reporter=line,junit
+          else
+            echo "[e2e-balance] balancer unavailable — plain --shard fallback"
+            npx playwright test tests/e2e/*.spec.ts --shard="$SHARD"/9 --reporter=line,junit
+          fi
+      # WS5.2/5.3: Trunk Flaky Tests upload — advisory, own-origin only, SHA-pinned.
+      - name: Upload test results to Trunk (advisory)
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        continue-on-error: true
+        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
+        with:
+          junit-paths: junit-e2e-results.xml
+          org-slug: omniroute
+          token: ${{ secrets.TRUNK_TOKEN }}

  test-integration:
    name: Integration Tests (${{ matrix.shard }}/2)
--- a/.github/workflows/dast-smoke.yml
+++ b/.github/workflows/dast-smoke.yml
@@ -10,7 +10,10 @@ jobs:
    # ADVISORY while this new gate matures (repo convention: advisory -> blocking).
    # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
    continue-on-error: true
-    timeout-minutes: 12
+    # Build CLI bundle alone varies 6-11min on GitHub-hosted runners (3 consecutive
+    # timeouts observed on 2026-07-14 with the old 12min cap killing schemathesis
+    # mid-run) — 25min leaves real headroom for the actual DAST steps.
+    timeout-minutes: 25
    env:
      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
--- a/.github/workflows/nightly-release-green.yml
+++ b/.github/workflows/nightly-release-green.yml
@@ -1,11 +1,18 @@
-name: Nightly Release-Green
+name: Release-Green (continuous)

 # Solution D — continuous, NON-BLOCKING drift signal for the active release branch.
 #
 # WHY: the full gate (ci.yml) only runs on the release PR (PR → main), so reds
 # accrue silently on release/** and explode — in layers — at release time. This
-# nightly reproduces the release-equivalent validation on the active release branch
-# HEAD and, when there are HARD failures, opens/updates a single tracking issue.
+# workflow reproduces the release-equivalent validation on the release branch and,
+# when there are HARD failures, opens/updates a single tracking issue.
+#
+# WS5.1 (v3.8.49 quality plan) — two modes:
+#   push to release/v* (code paths) → --quick (fast HARD gates, ~5-8min). Catches the
+#     captain's direct pushes (sync-back — the one ungated write path) AND the merged
+#     COMBINATION right after every PR merge, attributing the offending push range in
+#     the issue. Base-red MTTD drops from ≤24h to ≤~15min after the offending push.
+#   schedule (3×/day) → full --with-build --full-ci (the deep sweep incl. build+suites).
 #
 # It is NOT a required status check and never touches a contributor PR — it only
 # reports. Ratchet drift (eslint warnings / cognitive-complexity / file-size) is
@@ -14,8 +21,23 @@ name: Nightly Release-Green
 # package-artifact) flip the issue open.

 on:
+  push:
+    branches: ["release/v*"]
+    paths:
+      - "src/**"
+      - "open-sse/**"
+      - "bin/**"
+      - "electron/**"
+      - "scripts/**"
+      - "tests/**"
+      - "config/**"
+      - "package.json"
+      - "package-lock.json"
+      - "tsconfig*.json"
  schedule:
-    - cron: "23 5 * * *" # 05:23 UTC daily — off-peak, distinct from other nightlies
+    - cron: "23 5 * * *" # full sweep — off-peak, distinct from other nightlies
+    - cron: "23 12 * * *" # full sweep — midday (WS5.1: 3×/day instead of 1×)
+    - cron: "23 18 * * *" # full sweep — evening
  workflow_dispatch:
    inputs:
      branch:
@@ -28,7 +50,9 @@ permissions:
  issues: write

 concurrency:
-  group: nightly-release-green
+  # push storms during merge campaigns collapse to the newest commit per branch;
+  # scheduled full sweeps keep their own single lane.
+  group: release-green-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

 env:
@@ -56,10 +80,15 @@ jobs:
        id: branch
        env:
          INPUT_BRANCH: ${{ github.event.inputs.branch }}
+          EVENT_NAME: ${{ github.event_name }}
+          PUSHED_REF: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ -n "${INPUT_BRANCH:-}" ]; then
            TARGET="$INPUT_BRANCH"
+          elif [ "$EVENT_NAME" = "push" ]; then
+            # validate exactly what was pushed, not the highest branch
+            TARGET="$PUSHED_REF"
          else
            # highest release/vX.Y.Z by semver among remote branches
            TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
@@ -93,16 +122,26 @@ jobs:

      - name: Release-green validation (full)
        id: validate
+        env:
+          EVENT_NAME: ${{ github.event_name }}
        run: |
          set +e
          # --hermetic: scrub live-test trigger vars (self-hosted runner may carry
          # operator env; hosted ignores the unknown flag before #6300 lands).
-          # --full-ci: ALSO run every static gate from ci.yml's gate jobs (lint,
-          # quality-gate, quality-extended, docs-sync-strict, pr-test-policy). PRs into
-          # release/** only get the fast-gates, so these accrue silently and explode in
-          # layers on the release PR (v3.8.46: 11 static base-reds leaked). Running them
-          # nightly opens the tracking issue the moment one lands, not at release time.
-          node scripts/quality/validate-release-green.mjs --json --with-build --hermetic --full-ci \
+          # push → --quick: fast HARD gates only (~5-8min), per-merge signal.
+          # schedule/dispatch → --with-build --full-ci: ALSO run every static gate from
+          # ci.yml's gate jobs (lint, quality-gate, quality-extended, docs-sync-strict,
+          # pr-test-policy) + build + full suites. PRs into release/** only get the
+          # fast-gates, so these accrue silently and explode in layers on the release PR
+          # (v3.8.46: 11 static base-reds leaked).
+          if [ "$EVENT_NAME" = "push" ]; then
+            MODE="--quick"
+          else
+            MODE="--with-build --full-ci"
+          fi
+          echo "[release-green] mode: $MODE (event: $EVENT_NAME)"
+          # shellcheck disable=SC2086 — MODE is an intentional flag list
+          node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
            1> release-green.json 2> release-green.log
          echo "exit=$?" >> "$GITHUB_OUTPUT"
          echo "------- report -------"
@@ -114,15 +153,28 @@ jobs:
          GH_TOKEN: ${{ github.token }}
          TARGET: ${{ steps.branch.outputs.target }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          EVENT_NAME: ${{ github.event_name }}
+          BEFORE_SHA: ${{ github.event.before }}
+          AFTER_SHA: ${{ github.event.after }}
        run: |
          set -euo pipefail
          TITLE="🔴 Release branch not green: ${TARGET}"
          {
-            echo "The nightly **release-green** validation found HARD failures on \`${TARGET}\`."
+            echo "The **release-green** validation found HARD failures on \`${TARGET}\`."
            echo "These are real defects that would block the release PR — fix them in the"
            echo "originating PR branch (via co-authorship), not by demanding it from contributors."
            echo ""
-            echo "**Run:** ${RUN_URL}"
+            echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})"
+            # WS5.1 attribution: on push events the offending change IS this push's range
+            # (one merge per push in the normal queue), so name it — no bisect needed.
+            if [ "$EVENT_NAME" = "push" ] && [ -n "${BEFORE_SHA:-}" ] && \
+               git cat-file -e "$BEFORE_SHA" 2>/dev/null; then
+              echo ""
+              echo "**Offending push range** (\`${BEFORE_SHA:0:9}..${AFTER_SHA:0:9}\`):"
+              echo '```'
+              git log --no-decorate --oneline "${BEFORE_SHA}..${AFTER_SHA}" | head -20
+              echo '```'
+            fi
            echo ""
            echo '```'
            sed -n '/──────── verdict ────────/,$p' release-green.log || tail -40 release-green.log
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -22,6 +22,14 @@ on:
          - latest
          - next
          - historic
+      publish_mode:
+        description: "staged = npm stage publish (owner approves with 2FA after the staged boot-verify); direct = legacy immediate publish (emergency fallback only)"
+        required: false
+        default: "staged"
+        type: choice
+        options:
+          - staged
+          - direct
  workflow_call:
    inputs:
      version:
@@ -166,8 +174,34 @@ jobs:
          TAG: ${{ github.ref_name }}
        run: gh release upload "$TAG" sbom-npm.cdx.json --clobber

-      - name: Publish to npm
+      # WS1.2/WS1.3 (#7065 class): the artifact that is about to be published must
+      # BOOT. build:cli already assembled dist/ above; this packs+installs+boots the
+      # real tarball and fails the publish before anything reaches the registry.
+      - name: Boot-smoke the tarball before ANY publish
        if: steps.resolve.outputs.skip != 'true'
+        run: npm run check:pack-boot
+
+      # WS1.3 (D2, v3.8.49 plan): STAGED publishing by default — `npm stage publish`
+      # parks the exact bytes on the registry WITHOUT making them installable; the
+      # owner then verifies and approves with 2FA (`npm stage approve`), moving the
+      # human gate to AFTER the proof instead of before it. Requires npm >= 11.15
+      # (staged publishing GA 2026-05-22). publish_mode=direct is the emergency
+      # fallback (legacy immediate publish) via workflow_dispatch.
+      - name: Ensure npm supports staged publishing
+        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
+        run: |
+          set -euo pipefail
+          CUR=$(npm --version)
+          if ! node -e "const [a,b]='$(npm --version)'.split('.').map(Number); process.exit(a>11||(a===11&&b>=15)?0:1)"; then
+            # Pinned exact version (supply-chain: never float @latest in the publish
+            # job); bump deliberately when a newer npm is required.
+            echo "npm $CUR < 11.15 — installing pinned npm 11.15.0 for staged publishing"
+            npm install -g --ignore-scripts npm@11.15.0
+          fi
+          npm --version
+
+      - name: Publish to npm (staged — owner approves with 2FA)
+        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
        env:
          VERSION: ${{ steps.resolve.outputs.version }}
          TAG: ${{ steps.resolve.outputs.tag }}
@@ -175,10 +209,32 @@ jobs:
        run: |
          set -euo pipefail
          # Always pass --tag explicitly. Defense in depth: even if VERSION is
-          # accidentally an older release, `npm publish --tag historic` will
-          # NOT promote it to `@latest`.
+          # accidentally an older release, the historic tag will NOT claim `@latest`.
+          npm stage publish --provenance --access public --tag "$TAG"
+          {
+            echo "## 📦 omniroute@$VERSION STAGED (not yet installable)"
+            echo ""
+            echo "The exact bytes are parked on the registry. To release them:"
+            echo '```'
+            echo "npm stage list omniroute            # find the stage id"
+            echo "npm stage approve <id>              # owner 2FA — THE publish"
+            echo '```'
+            echo "To verify the staged bytes first: npm stage download <id> → run"
+            echo "scripts/check/check-pack-boot.mjs against them (see RELEASE_CHECKLIST)."
+            echo "To discard: npm stage reject <id>."
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "✅ Staged omniroute@$VERSION (dist-tag=$TAG) — awaiting owner 'npm stage approve'"
+
+      - name: Publish to npm (DIRECT — emergency fallback)
+        if: steps.resolve.outputs.skip != 'true' && github.event_name == 'workflow_dispatch' && inputs.publish_mode == 'direct'
+        env:
+          VERSION: ${{ steps.resolve.outputs.version }}
+          TAG: ${{ steps.resolve.outputs.tag }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
          npm publish --provenance --access public --tag "$TAG"
-          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG)"
+          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG) [DIRECT mode]"

      - name: Publish to GitHub Packages
        if: steps.resolve.outputs.skip != 'true'
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -62,7 +62,7 @@ jobs:
  docs-gates:
    name: Docs Gates (fast-path)
    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
@@ -82,7 +82,7 @@ jobs:
    name: Fast Quality Gates
    needs: changes
    # Code surface only — pure docs/i18n PRs skip this bag (docs-gates covers docs).
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
    # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the
    # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin
    # branches only — a fork PR must never execute on the LAN runner). Var unset/false
@@ -143,6 +143,24 @@ jobs:
      - run: npm run check:complexity-ratchets
      - name: Typecheck (core)
        run: npm run typecheck:core
+      # #7033: dashboard-scoped typecheck gate — src/app/(dashboard) TSX is not
+      # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs.
+      - name: Typecheck (dashboard)
+        run: npm run check:dashboard-typecheck
+      # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only.
+      # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only
+      # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x
+      # (the hybrid is the officially documented pattern). Isolated npx on purpose:
+      # installing an alias package could collide node_modules/.bin/tsc with 6.x.
+      # Promote to the blocking gate after ~1 week of parity with the step above.
+      - name: Typecheck (core) — TS7 native shadow (advisory)
+        continue-on-error: true
+        run: |
+          RC=0
+          START=$(date +%s)
+          npx -y -p typescript@7 tsc --pretty false -p tsconfig.typecheck-core.json || RC=$?
+          echo "[ts7-shadow] exit=$RC elapsed=$(( $(date +%s) - START ))s — the 6.x step above stays authoritative"
+          exit $RC
      # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
      # unit tests impacted by this PR's changed files. On hub/unmapped changes the
      # selector returns __RUN_ALL__ — full-suite authority is the parallel
@@ -196,7 +214,7 @@ jobs:
  fast-vitest:
    name: Vitest (fast-path)
    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
    env:
@@ -212,12 +230,23 @@ jobs:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
      - run: npm ci
-      - run: npm run test:vitest
+      # WS5.2/5.3: JUnit feeds Trunk Flaky Tests — the fast-path runs on EVERY PR,
+      # which is where flaky-detection volume actually comes from (ci.yml's heavy
+      # jobs only run on the release PR). Advisory upload, own-origin only.
+      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-fastpath.xml
+      - name: Upload test results to Trunk (advisory)
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        continue-on-error: true
+        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
+        with:
+          junit-paths: trunk-junit/**/*.xml
+          org-slug: omniroute
+          token: ${{ secrets.TRUNK_TOKEN }}

  fast-unit:
    name: Unit Tests fast-path (${{ matrix.shard }}/4)
    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
    # This is the heaviest fast-path job; 4-way sharding (was 2, #6781) halves the
    # critical path again (~8.5min → ~4.5min on ubuntu-latest; ~2min on the 8-slot
@@ -263,7 +292,7 @@ jobs:
  lint-guard:
    name: No new ESLint warnings
    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
    runs-on: ubuntu-latest
    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
    steps:
@@ -302,7 +331,7 @@ jobs:
  merge-integrity:
    name: Merge integrity (changelog + generated skills)
    # Always on non-draft PRs — CHANGELOG/skills can break on docs-only merges too.
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) }}
    runs-on: ubuntu-latest
    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
    env:
--- a/.gitignore
+++ b/.gitignore
@@ -72,6 +72,7 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
+!.env.homolog.example
 # Provider API keys (never commit)
 *.api-key
 .nvidia-api-key
@@ -242,3 +243,9 @@ _artifacts/

 # CI/local quality artifacts (eslint-results.json, etc.)
 .artifacts/
+
+# Homologation E2E suite (npm run homolog) — real-environment credentials + report output
+.env.homolog
+tests/homolog/.auth/
+tests/homolog/ui/.auth/
+homolog-report/
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -74,3 +74,16 @@
 #       '''tests/unit/''',
 #     ]
 #
+
+[[rules]]
+  # Falsos-positivos comprovados do generic-api-key — zerados em 2026-07-13 (WS6/D3,
+  # plano v3.8.49). Revisar em v3.9.0. Nenhum é credencial: dois são NOMES DE CAMPO
+  # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API
+  # da Anthropic (documentado publicamente, não é segredo).
+  id = "generic-api-key"
+  [rules.allowlist]
+    description = "Field names + public Anthropic beta-header value (não são segredos)"
+    regexes = [
+      '''latencyP\d{2}Ms''',
+      '''interleaved-thinking-2025-05-14''',
+    ]
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -0,0 +1,55 @@
+# Mergify merge queue — WS3.4/D5 of the v3.8.49 quality/velocity master plan.
+#
+# WHY: ~85-100 active PR authors/month and 300+ PRs/week peaks, all merged by ONE
+# identity. The manual merge-train validated batches by hand; this queue automates
+# it with batching + automatic batch bisection (a red batch of N costs ~log2(N)
+# revalidations instead of N). Mergify Open Source plan: free, unlimited, public repo.
+#
+# GOVERNANCE (non-negotiable, mirrors CLAUDE.md Hard Rules #21/#22 + the owner's
+# pre-merge ⭐ gate):
+#   • A PR enters the queue ONLY via the `queue` label — applied by the owner (or a
+#     session acting for the owner) AFTER the pre-merge ⭐ report/decision. The label
+#     IS the merge approval; Mergify only executes it.
+#   • During a release-freeze (open issue labeled `release-freeze`), do NOT label PRs
+#     targeting the frozen branch — the freeze is a human-honored coordination signal
+#     the queue cannot see. Retarget to the active release/vX+1 first (Hard Rule #21).
+#   • Never label a PR another session is actively working (Hard Rule #22b).
+#   • Fallback path if Mergify misbehaves or the OSS plan changes: the manual
+#     merge-train runbook (docs/ops/MERGE_TRAIN.md) — remove labels, proceed by hand.
+
+queue_rules:
+  - name: release
+    # Any current or future release branch — the reason GitHub's native queue was
+    # rejected (no wildcard support on personal-account repos).
+    queue_conditions:
+      - base~=^release/v\d+\.\d+\.\d+$
+      - label=queue
+      - -draft
+      - -conflict
+    # "Everything that ran is green, nothing still running, AND the always-on
+    # anchor check succeeded" — robust to the path-filtered fast-gates (docs-only
+    # PRs skip code jobs; matrix shard names vary) while never fail-open: a PR with
+    # zero checks cannot vacuously merge, because `Merge integrity` runs on EVERY
+    # non-draft PR (quality.yml) and must be an affirmative success. Review approval
+    # is intentionally NOT a condition here: the owner-applied `queue` label IS the
+    # approval in this repo's single-maintainer model (see governance header).
+    merge_conditions:
+      - "#check-failure=0"
+      - "#check-pending=0"
+      - "#check-success>=1"
+      - check-success=Merge integrity (changelog + generated skills)
+    # Batching: validate up to 10 queued PRs together (the manual train's sweet spot);
+    # don't hold a lone PR hostage waiting for siblings.
+    batch_size: 10
+    batch_max_wait_time: 5 min
+    # Squash keeps the one-commit-per-PR history the CHANGELOG reconciliation expects.
+    merge_method: squash
+
+pull_request_rules:
+  - name: clean up the queue label after merge
+    conditions:
+      - merged
+    actions:
+      label:
+        remove:
+          - queue
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,23 @@

 ---

+## [3.8.49] — TBD
+
+---
+
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13

 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -189,7 +206,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -259,70 +276,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.

-
-
 ### 🙌 Contributors

 Thanks to everyone whose work landed in v3.8.47:

-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |

 ---

--- a/6
+++ b/6
@@ -62,9 +62,13 @@ RUN test -f package-lock.json \
 # from that indirection. Invoking `node-gyp rebuild` directly inside the package
 # directory bypasses npm's script-running layer entirely and is deterministic
 # regardless of npm version or ignore-scripts allowlist behavior.
+# node-gyp comes from npm's own bundled copy (deterministic, already in the image)
+# instead of `npx --yes`, which would install an arbitrary registry version
+# on-demand and run its lifecycle scripts (Sonar docker:S6505).
 RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
  npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) \
+  && (cd node_modules/better-sqlite3 \
+      && node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
  && node -e "require('better-sqlite3')(':memory:').close()"

 # Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
--- a/changelog.d/features/6072-ws-server-inprocess-autostart.md
+++ b/changelog.d/features/6072-ws-server-inprocess-autostart.md
@@ -0,0 +1 @@
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
--- a/changelog.d/features/6556-omniglyph-engine.md
+++ b/changelog.d/features/6556-omniglyph-engine.md
@@ -0,0 +1 @@
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
--- a/changelog.d/features/6611-native-container-runtimes.md
+++ b/changelog.d/features/6611-native-container-runtimes.md
@@ -0,0 +1 @@
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
--- a/changelog.d/features/6708-gemma4-thinkingconfig-guard.md
+++ b/changelog.d/features/6708-gemma4-thinkingconfig-guard.md
@@ -0,0 +1 @@
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
--- a/changelog.d/features/6709-xai-responses-endpoint.md
+++ b/changelog.d/features/6709-xai-responses-endpoint.md
@@ -0,0 +1 @@
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
--- a/changelog.d/features/6727-model-capability-override-ui.md
+++ b/changelog.d/features/6727-model-capability-override-ui.md
@@ -0,0 +1 @@
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
--- a/changelog.d/features/6763-operator-configurable-account-rotation.md
+++ b/changelog.d/features/6763-operator-configurable-account-rotation.md
@@ -0,0 +1 @@
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
--- a/changelog.d/features/6774-cursor-grok-4-5-effort-fast.md
+++ b/changelog.d/features/6774-cursor-grok-4-5-effort-fast.md
@@ -0,0 +1 @@
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
--- a/changelog.d/features/6776-discover-live-codex-models.md
+++ b/changelog.d/features/6776-discover-live-codex-models.md
@@ -0,0 +1 @@
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
--- a/changelog.d/features/6779-cursor-opus48-fable5-sonnet5.md
+++ b/changelog.d/features/6779-cursor-opus48-fable5-sonnet5.md
@@ -0,0 +1 @@
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
--- a/changelog.d/features/6783-changelog-fragments.md
+++ b/changelog.d/features/6783-changelog-fragments.md
@@ -0,0 +1 @@
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
--- a/changelog.d/features/6798-latency-optimized-proxy-rotation.md
+++ b/changelog.d/features/6798-latency-optimized-proxy-rotation.md
@@ -0,0 +1 @@
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
--- a/changelog.d/features/6804-fusion-judge-own-knowledge.md
+++ b/changelog.d/features/6804-fusion-judge-own-knowledge.md
@@ -0,0 +1 @@
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
--- a/changelog.d/features/6811-playground-model-picker-search.md
+++ b/changelog.d/features/6811-playground-model-picker-search.md
@@ -0,0 +1 @@
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
--- a/changelog.d/features/6818-antigravity-weekly-quota.md
+++ b/changelog.d/features/6818-antigravity-weekly-quota.md
@@ -0,0 +1 @@
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
--- a/changelog.d/features/6820-codex-effort-model-echo.md
+++ b/changelog.d/features/6820-codex-effort-model-echo.md
@@ -0,0 +1 @@
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
--- a/changelog.d/features/6823-zai-web-cookie-provider.md
+++ b/changelog.d/features/6823-zai-web-cookie-provider.md
@@ -0,0 +1 @@
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
--- a/changelog.d/features/6838-headroom-gcf-v3.2-nested-flattening.md
+++ b/changelog.d/features/6838-headroom-gcf-v3.2-nested-flattening.md
@@ -0,0 +1 @@
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
--- a/changelog.d/features/6862-gpt-5-6-providers.md
+++ b/changelog.d/features/6862-gpt-5-6-providers.md
@@ -0,0 +1,2 @@
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
--- a/changelog.d/features/homolog-e2e-suite.md
+++ b/changelog.d/features/homolog-e2e-suite.md
@@ -0,0 +1 @@
+- **Homologation suite**: new `npm run homolog` runs the full release-homologation battery against the deployed VPS — health/version parity, API + real SSE streaming with an ephemeral API key (created and revoked by the run), minimal-cost real-provider smoke (promptfoo generated from the live catalog), and a Playwright sweep that loads every dashboard route and exercises the API-key UI flow — emitting a unified CTRF report that backs the release STOP #2 checklist
--- a/changelog.d/fixes/5716-proxy-pool-relayauth-dropped.md
+++ b/changelog.d/fixes/5716-proxy-pool-relayauth-dropped.md
@@ -0,0 +1 @@
+- fix(providers): preserve relayAuth for vercel/deno/cloudflare relay proxies referenced by-id from the no-auth-provider Proxy Pool dropdown (#5716)
--- a/changelog.d/fixes/6142-6142-devin-unified-api.md
+++ b/changelog.d/fixes/6142-6142-devin-unified-api.md
@@ -0,0 +1 @@
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
--- a/changelog.d/fixes/6272-6272-mimo-proxy.md
+++ b/changelog.d/fixes/6272-6272-mimo-proxy.md
@@ -0,0 +1 @@
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
--- a/changelog.d/fixes/6276-toolcall-args-logs.md
+++ b/changelog.d/fixes/6276-toolcall-args-logs.md
@@ -0,0 +1 @@
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
--- a/changelog.d/fixes/6280-lmarena-arena-modernize.md
+++ b/changelog.d/fixes/6280-lmarena-arena-modernize.md
@@ -0,0 +1 @@
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
--- a/changelog.d/fixes/6308-web-model-discovery.md
+++ b/changelog.d/fixes/6308-web-model-discovery.md
@@ -0,0 +1 @@
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
--- a/changelog.d/fixes/6323-log-detail-stale-reopen.md
+++ b/changelog.d/fixes/6323-log-detail-stale-reopen.md
@@ -0,0 +1 @@
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
--- a/changelog.d/fixes/6330-sensenova-token-plan.md
+++ b/changelog.d/fixes/6330-sensenova-token-plan.md
@@ -0,0 +1 @@
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
--- a/changelog.d/fixes/6343-6343-v0web-creds.md
+++ b/changelog.d/fixes/6343-6343-v0web-creds.md
@@ -0,0 +1 @@
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
--- a/changelog.d/fixes/6377-6377-agentrouter-key.md
+++ b/changelog.d/fixes/6377-6377-agentrouter-key.md
@@ -0,0 +1 @@
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
--- a/changelog.d/fixes/6401-6401-usage-migrations.md
+++ b/changelog.d/fixes/6401-6401-usage-migrations.md
@@ -0,0 +1 @@
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
--- a/changelog.d/fixes/6409-6409-build-ram.md
+++ b/changelog.d/fixes/6409-6409-build-ram.md
@@ -0,0 +1 @@
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
--- a/changelog.d/fixes/6479-6479-compression-pipeline.md
+++ b/changelog.d/fixes/6479-6479-compression-pipeline.md
@@ -0,0 +1 @@
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
--- a/changelog.d/fixes/6524-6524-reasoning-buffer-clamp.md
+++ b/changelog.d/fixes/6524-6524-reasoning-buffer-clamp.md
@@ -0,0 +1 @@
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
--- a/changelog.d/fixes/6538-tier-flow-svg-public.md
+++ b/changelog.d/fixes/6538-tier-flow-svg-public.md
@@ -0,0 +1 @@
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
--- a/changelog.d/fixes/6557-6557-disabled-provider.md
+++ b/changelog.d/fixes/6557-6557-disabled-provider.md
@@ -0,0 +1 @@
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
--- a/changelog.d/fixes/6586-preserve-server-tool-names.md
+++ b/changelog.d/fixes/6586-preserve-server-tool-names.md
@@ -0,0 +1 @@
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
--- a/changelog.d/fixes/6612-combo-diagnostics-header-bytestring-crash.md
+++ b/changelog.d/fixes/6612-combo-diagnostics-header-bytestring-crash.md
@@ -0,0 +1 @@
+- fix(sse): sanitize non-Latin1 characters before embedding combo diagnostics in HTTP headers, preventing a ByteString crash on quality-check failure (#6612)
--- a/changelog.d/fixes/6623-6623-mimo-502-messages.md
+++ b/changelog.d/fixes/6623-6623-mimo-502-messages.md
@@ -0,0 +1 @@
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
--- a/changelog.d/fixes/6628-6628-sqljs-adapter.md
+++ b/changelog.d/fixes/6628-6628-sqljs-adapter.md
@@ -0,0 +1,2 @@
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
--- a/changelog.d/fixes/6632-probe-restore-loop-cycle-breaker.md
+++ b/changelog.d/fixes/6632-probe-restore-loop-cycle-breaker.md
@@ -0,0 +1 @@
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
--- a/changelog.d/fixes/6634-6634-testmasking-selfref.md
+++ b/changelog.d/fixes/6634-6634-testmasking-selfref.md
@@ -0,0 +1 @@
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
--- a/changelog.d/fixes/6637-6637-combo-kimi-fallback.md
+++ b/changelog.d/fixes/6637-6637-combo-kimi-fallback.md
@@ -0,0 +1 @@
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
--- a/changelog.d/fixes/6647-winget-claude-detect.md
+++ b/changelog.d/fixes/6647-winget-claude-detect.md
@@ -0,0 +1 @@
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
--- a/changelog.d/fixes/6675-remove-obsolete-providers.md
+++ b/changelog.d/fixes/6675-remove-obsolete-providers.md
@@ -0,0 +1 @@
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
--- a/changelog.d/fixes/6698-count-gate-rejected-usage.md
+++ b/changelog.d/fixes/6698-count-gate-rejected-usage.md
@@ -0,0 +1 @@
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
--- a/changelog.d/fixes/6699-jules-chat-executor-misroute.md
+++ b/changelog.d/fixes/6699-jules-chat-executor-misroute.md
@@ -0,0 +1 @@
+- fix(providers): reject chat-completions requests for cloud-agent-only providers like jules instead of silently mis-routing them to OpenAI's endpoint (#6699)
--- a/changelog.d/fixes/6704-unwrap-bare-function-tool.md
+++ b/changelog.d/fixes/6704-unwrap-bare-function-tool.md
@@ -0,0 +1 @@
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
--- a/changelog.d/fixes/6706-codex-oauth-bare-email-dedup.md
+++ b/changelog.d/fixes/6706-codex-oauth-bare-email-dedup.md
@@ -0,0 +1 @@
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
--- a/changelog.d/fixes/6710-codex-200-sse-capacity-error.md
+++ b/changelog.d/fixes/6710-codex-200-sse-capacity-error.md
@@ -0,0 +1 @@
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
--- a/changelog.d/fixes/6712-volcengine-kimi-max-tokens.md
+++ b/changelog.d/fixes/6712-volcengine-kimi-max-tokens.md
@@ -0,0 +1 @@
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
--- a/changelog.d/fixes/6713-antigravity-abort-finish-reason.md
+++ b/changelog.d/fixes/6713-antigravity-abort-finish-reason.md
@@ -0,0 +1 @@
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
--- a/changelog.d/fixes/6714-reasoning-buffer-cap-aware.md
+++ b/changelog.d/fixes/6714-reasoning-buffer-cap-aware.md
@@ -0,0 +1 @@
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
--- a/changelog.d/fixes/6717-cli-health-monitoring-route.md
+++ b/changelog.d/fixes/6717-cli-health-monitoring-route.md
@@ -0,0 +1 @@
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
--- a/changelog.d/fixes/6718-reasoningcontrols-case-collision.md
+++ b/changelog.d/fixes/6718-reasoningcontrols-case-collision.md
@@ -0,0 +1 @@
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
--- a/changelog.d/fixes/6720-turbopack-agentskills-warning.md
+++ b/changelog.d/fixes/6720-turbopack-agentskills-warning.md
@@ -0,0 +1 @@
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
--- a/changelog.d/fixes/6721-codex-spark-image-drop.md
+++ b/changelog.d/fixes/6721-codex-spark-image-drop.md
@@ -0,0 +1 @@
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
--- a/changelog.d/fixes/6722-quota-card-fixed-order.md
+++ b/changelog.d/fixes/6722-quota-card-fixed-order.md
@@ -0,0 +1 @@
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
--- a/changelog.d/fixes/6723-i18n-pt-br-backfill.md
+++ b/changelog.d/fixes/6723-i18n-pt-br-backfill.md
@@ -0,0 +1 @@
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
--- a/changelog.d/fixes/6725-lazy-ioredis-mcp.md
+++ b/changelog.d/fixes/6725-lazy-ioredis-mcp.md
@@ -0,0 +1 @@
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
--- a/changelog.d/fixes/6726-kiro-adaptive-thinking-allowlist.md
+++ b/changelog.d/fixes/6726-kiro-adaptive-thinking-allowlist.md
@@ -0,0 +1 @@
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
--- a/changelog.d/fixes/6729-cursor-subagent-strip-cloud-base.md
+++ b/changelog.d/fixes/6729-cursor-subagent-strip-cloud-base.md
@@ -0,0 +1 @@
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
--- a/changelog.d/fixes/6730-glm-split-tool-name.md
+++ b/changelog.d/fixes/6730-glm-split-tool-name.md
@@ -0,0 +1 @@
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
--- a/changelog.d/fixes/6731-apikey-429-quota-exhausted.md
+++ b/changelog.d/fixes/6731-apikey-429-quota-exhausted.md
@@ -0,0 +1 @@
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
--- a/changelog.d/fixes/6732-fp-pinned-combo-resolve.md
+++ b/changelog.d/fixes/6732-fp-pinned-combo-resolve.md
@@ -0,0 +1 @@
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
--- a/changelog.d/fixes/6735-responses-commentary-event-frame.md
+++ b/changelog.d/fixes/6735-responses-commentary-event-frame.md
@@ -0,0 +1 @@
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
--- a/changelog.d/fixes/6741-compression-preview-token-reconcile.md
+++ b/changelog.d/fixes/6741-compression-preview-token-reconcile.md
@@ -0,0 +1 @@
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
--- a/changelog.d/fixes/6742-quota-preflight-coverage.md
+++ b/changelog.d/fixes/6742-quota-preflight-coverage.md
@@ -0,0 +1 @@
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
--- a/changelog.d/fixes/6743-reasoning-content-web-sse.md
+++ b/changelog.d/fixes/6743-reasoning-content-web-sse.md
@@ -0,0 +1 @@
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
--- a/changelog.d/fixes/6757-rtk-enable-renderers-schema.md
+++ b/changelog.d/fixes/6757-rtk-enable-renderers-schema.md
@@ -0,0 +1 @@
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
--- a/changelog.d/fixes/6759-cookie-provider-apikey-cap.md
+++ b/changelog.d/fixes/6759-cookie-provider-apikey-cap.md
@@ -0,0 +1 @@
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
--- a/changelog.d/fixes/6766-6766-auto-update.md
+++ b/changelog.d/fixes/6766-6766-auto-update.md
@@ -0,0 +1 @@
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
--- a/changelog.d/fixes/6769-i18n-translate-pt-dashboard.md
+++ b/changelog.d/fixes/6769-i18n-translate-pt-dashboard.md
@@ -0,0 +1 @@
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
--- a/changelog.d/fixes/6772-6772-connid-model-400.md
+++ b/changelog.d/fixes/6772-6772-connid-model-400.md
@@ -0,0 +1 @@
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
--- a/changelog.d/fixes/6773-6773-nim-404.md
+++ b/changelog.d/fixes/6773-6773-nim-404.md
@@ -0,0 +1 @@
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
--- a/changelog.d/fixes/6780-bump-codex-client-version.md
+++ b/changelog.d/fixes/6780-bump-codex-client-version.md
@@ -0,0 +1 @@
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
--- a/changelog.d/fixes/6788-tia-dashboard-loader.md
+++ b/changelog.d/fixes/6788-tia-dashboard-loader.md
@@ -0,0 +1 @@
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
--- a/changelog.d/fixes/6790-gemini-pdf-video-attachments.md
+++ b/changelog.d/fixes/6790-gemini-pdf-video-attachments.md
@@ -0,0 +1 @@
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
--- a/changelog.d/fixes/6791-deepseek-web-done-after-finished.md
+++ b/changelog.d/fixes/6791-deepseek-web-done-after-finished.md
@@ -0,0 +1 @@
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
--- a/changelog.d/fixes/6792-compression-put-all-catalog-engines.md
+++ b/changelog.d/fixes/6792-compression-put-all-catalog-engines.md
@@ -0,0 +1 @@
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
--- a/changelog.d/fixes/6795-cursor-client-version-build-id.md
+++ b/changelog.d/fixes/6795-cursor-client-version-build-id.md
@@ -0,0 +1 @@
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
--- a/changelog.d/fixes/6800-6800-listen-banner-early.md
+++ b/changelog.d/fixes/6800-6800-listen-banner-early.md
@@ -0,0 +1 @@
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
--- a/changelog.d/fixes/6803-6803-flaky-timing-tests.md
+++ b/changelog.d/fixes/6803-6803-flaky-timing-tests.md
@@ -0,0 +1 @@
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
--- a/changelog.d/fixes/6805-strip-include-compact-responses.md
+++ b/changelog.d/fixes/6805-strip-include-compact-responses.md
@@ -0,0 +1 @@
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
--- a/changelog.d/fixes/6806-6806-claude-quota-data.md
+++ b/changelog.d/fixes/6806-6806-claude-quota-data.md
@@ -0,0 +1 @@
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
--- a/changelog.d/fixes/6812-request-count-by-provider-date.md
+++ b/changelog.d/fixes/6812-request-count-by-provider-date.md
@@ -0,0 +1 @@
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
--- a/changelog.d/fixes/6817-ollama-cloud-weekly-quota.md
+++ b/changelog.d/fixes/6817-ollama-cloud-weekly-quota.md
@@ -0,0 +1 @@
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
--- a/changelog.d/fixes/6821-budget-tokens-zero-gemini.md
+++ b/changelog.d/fixes/6821-budget-tokens-zero-gemini.md
@@ -0,0 +1 @@
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				- feat(ws): the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to 20132 to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
				`@@ -0,0 +1 @@`
				- feat(compression): new omniglyph engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
				`@@ -0,0 +1 @@`
				- feat(sandbox): the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
				`@@ -0,0 +1 @@`
				- fix(sse): skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
				`@@ -0,0 +1 @@`
				- feat(xai): route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
				`@@ -0,0 +1 @@`
				- feat(models): add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
				`@@ -0,0 +1 @@`
				- feat(resilience): operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
				`@@ -0,0 +1 @@`
				`- chore(cursor): add Grok 4.5 effort/fast model IDs (#6774 — thanks @andrewmunsell).`
				`@@ -0,0 +1 @@`
				- feat(codex): Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
				`@@ -0,0 +1 @@`
				`- feat(cursor): register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).`