diff --git a/CHANGELOG.md b/CHANGELOG.md index f2b73fcca5..788dad7944 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/changelog.d/fixes/10060-build-sqlite-native-addon-guard.md b/changelog.d/fixes/10060-build-sqlite-native-addon-guard.md deleted file mode 100644 index d5fac09583..0000000000 --- a/changelog.d/fixes/10060-build-sqlite-native-addon-guard.md +++ /dev/null @@ -1 +0,0 @@ -- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952), re-derived from the closed [#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060)) — thanks @arminanton and @davenamovich diff --git a/changelog.d/fixes/10952-copilot-wire-discovery.md b/changelog.d/fixes/10952-copilot-wire-discovery.md deleted file mode 100644 index e9fd2a6fc2..0000000000 --- a/changelog.d/fixes/10952-copilot-wire-discovery.md +++ /dev/null @@ -1 +0,0 @@ -- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton and @yidecode diff --git a/changelog.d/fixes/10952-provider-compatibility-followups.md b/changelog.d/fixes/10952-provider-compatibility-followups.md deleted file mode 100644 index 12f06e60fe..0000000000 --- a/changelog.d/fixes/10952-provider-compatibility-followups.md +++ /dev/null @@ -1 +0,0 @@ -- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952), re-derived from the closed [#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) and the #7620/#10898 follow-up) — thanks @arminanton, @rqzbeh and reporter @ahbeeahkao diff --git a/changelog.d/fixes/codex-appserver-hardening.md b/changelog.d/fixes/codex-appserver-hardening.md deleted file mode 100644 index 85d8a97b0e..0000000000 --- a/changelog.d/fixes/codex-appserver-hardening.md +++ /dev/null @@ -1 +0,0 @@ -- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark diff --git a/changelog.d/fixes/secret-leak-error-surface-hardening.md b/changelog.d/fixes/secret-leak-error-surface-hardening.md deleted file mode 100644 index 5bdb7a469c..0000000000 --- a/changelog.d/fixes/secret-leak-error-surface-hardening.md +++ /dev/null @@ -1 +0,0 @@ -- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton diff --git a/docs/i18n/ar/CHANGELOG.md b/docs/i18n/ar/CHANGELOG.md index e80e10db8f..468d89931f 100644 --- a/docs/i18n/ar/CHANGELOG.md +++ b/docs/i18n/ar/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/az/CHANGELOG.md b/docs/i18n/az/CHANGELOG.md index aa175e14f0..c8ecc0d711 100644 --- a/docs/i18n/az/CHANGELOG.md +++ b/docs/i18n/az/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/bg/CHANGELOG.md b/docs/i18n/bg/CHANGELOG.md index aa175e14f0..c8ecc0d711 100644 --- a/docs/i18n/bg/CHANGELOG.md +++ b/docs/i18n/bg/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/bn/CHANGELOG.md b/docs/i18n/bn/CHANGELOG.md index d49b6f618d..c14ce1f91f 100644 --- a/docs/i18n/bn/CHANGELOG.md +++ b/docs/i18n/bn/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/cs/CHANGELOG.md b/docs/i18n/cs/CHANGELOG.md index f0df72223b..4ed4d3101f 100644 --- a/docs/i18n/cs/CHANGELOG.md +++ b/docs/i18n/cs/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/da/CHANGELOG.md b/docs/i18n/da/CHANGELOG.md index 05a908abb5..707652ad9b 100644 --- a/docs/i18n/da/CHANGELOG.md +++ b/docs/i18n/da/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/de/CHANGELOG.md b/docs/i18n/de/CHANGELOG.md index d23f66390b..12b27db248 100644 --- a/docs/i18n/de/CHANGELOG.md +++ b/docs/i18n/de/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/es/CHANGELOG.md b/docs/i18n/es/CHANGELOG.md index 36b8ae64e6..4a85474699 100644 --- a/docs/i18n/es/CHANGELOG.md +++ b/docs/i18n/es/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/fa/CHANGELOG.md b/docs/i18n/fa/CHANGELOG.md index b6a576f894..26555bd84f 100644 --- a/docs/i18n/fa/CHANGELOG.md +++ b/docs/i18n/fa/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/fi/CHANGELOG.md b/docs/i18n/fi/CHANGELOG.md index ac71a3626e..8394480fce 100644 --- a/docs/i18n/fi/CHANGELOG.md +++ b/docs/i18n/fi/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/fr/CHANGELOG.md b/docs/i18n/fr/CHANGELOG.md index 5590dd6dd1..2ec5ccb034 100644 --- a/docs/i18n/fr/CHANGELOG.md +++ b/docs/i18n/fr/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/gu/CHANGELOG.md b/docs/i18n/gu/CHANGELOG.md index 64645cec43..bd5ededd90 100644 --- a/docs/i18n/gu/CHANGELOG.md +++ b/docs/i18n/gu/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/he/CHANGELOG.md b/docs/i18n/he/CHANGELOG.md index 6afc725e21..29261e389e 100644 --- a/docs/i18n/he/CHANGELOG.md +++ b/docs/i18n/he/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/hi/CHANGELOG.md b/docs/i18n/hi/CHANGELOG.md index 1c4afa62a5..4da3aad5bd 100644 --- a/docs/i18n/hi/CHANGELOG.md +++ b/docs/i18n/hi/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/hu/CHANGELOG.md b/docs/i18n/hu/CHANGELOG.md index 932f7def93..fe16f0311c 100644 --- a/docs/i18n/hu/CHANGELOG.md +++ b/docs/i18n/hu/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/id/CHANGELOG.md b/docs/i18n/id/CHANGELOG.md index 4bb55cb9d5..caf24489cf 100644 --- a/docs/i18n/id/CHANGELOG.md +++ b/docs/i18n/id/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/in/CHANGELOG.md b/docs/i18n/in/CHANGELOG.md index dbcbd8f76c..c671039ae4 100644 --- a/docs/i18n/in/CHANGELOG.md +++ b/docs/i18n/in/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/it/CHANGELOG.md b/docs/i18n/it/CHANGELOG.md index 5b8d5882b6..356237207e 100644 --- a/docs/i18n/it/CHANGELOG.md +++ b/docs/i18n/it/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/ja/CHANGELOG.md b/docs/i18n/ja/CHANGELOG.md index 8e85d83978..0e4092e135 100644 --- a/docs/i18n/ja/CHANGELOG.md +++ b/docs/i18n/ja/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/ko/CHANGELOG.md b/docs/i18n/ko/CHANGELOG.md index 09431131ca..c4560c73a7 100644 --- a/docs/i18n/ko/CHANGELOG.md +++ b/docs/i18n/ko/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/mr/CHANGELOG.md b/docs/i18n/mr/CHANGELOG.md index b4103c613e..4ff3cf25ca 100644 --- a/docs/i18n/mr/CHANGELOG.md +++ b/docs/i18n/mr/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/ms/CHANGELOG.md b/docs/i18n/ms/CHANGELOG.md index 6febaaa55f..11b23b79f0 100644 --- a/docs/i18n/ms/CHANGELOG.md +++ b/docs/i18n/ms/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/nl/CHANGELOG.md b/docs/i18n/nl/CHANGELOG.md index 687bfc8da7..7988bfce0a 100644 --- a/docs/i18n/nl/CHANGELOG.md +++ b/docs/i18n/nl/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/no/CHANGELOG.md b/docs/i18n/no/CHANGELOG.md index c517847f41..d9a7a12b27 100644 --- a/docs/i18n/no/CHANGELOG.md +++ b/docs/i18n/no/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/phi/CHANGELOG.md b/docs/i18n/phi/CHANGELOG.md index 5ec176472f..2c4b6bbfbf 100644 --- a/docs/i18n/phi/CHANGELOG.md +++ b/docs/i18n/phi/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/pl/CHANGELOG.md b/docs/i18n/pl/CHANGELOG.md index 48628f1bd7..fe4aece0bd 100644 --- a/docs/i18n/pl/CHANGELOG.md +++ b/docs/i18n/pl/CHANGELOG.md @@ -973,7 +973,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1030,8 +1030,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1227,6 +1227,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1510,6 +1515,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1525,6 +1533,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1539,7 +1548,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1568,6 +1577,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1596,7 +1606,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1702,7 +1712,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1726,6 +1736,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1744,6 +1755,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1762,7 +1774,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/pt-BR/CHANGELOG.md b/docs/i18n/pt-BR/CHANGELOG.md index b60af4c89d..0cefe5cee5 100644 --- a/docs/i18n/pt-BR/CHANGELOG.md +++ b/docs/i18n/pt-BR/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/pt/CHANGELOG.md b/docs/i18n/pt/CHANGELOG.md index 2175ae4205..b46d354374 100644 --- a/docs/i18n/pt/CHANGELOG.md +++ b/docs/i18n/pt/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/ro/CHANGELOG.md b/docs/i18n/ro/CHANGELOG.md index 164a18d6fb..34c9404f1d 100644 --- a/docs/i18n/ro/CHANGELOG.md +++ b/docs/i18n/ro/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/ru/CHANGELOG.md b/docs/i18n/ru/CHANGELOG.md index ec5f2c86d6..700cf0efb0 100644 --- a/docs/i18n/ru/CHANGELOG.md +++ b/docs/i18n/ru/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/sk/CHANGELOG.md b/docs/i18n/sk/CHANGELOG.md index c131feaf48..60afabfbba 100644 --- a/docs/i18n/sk/CHANGELOG.md +++ b/docs/i18n/sk/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/sv/CHANGELOG.md b/docs/i18n/sv/CHANGELOG.md index f550e1e1d3..ec4b38c307 100644 --- a/docs/i18n/sv/CHANGELOG.md +++ b/docs/i18n/sv/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/sw/CHANGELOG.md b/docs/i18n/sw/CHANGELOG.md index e7bfece0ee..f2eef9160f 100644 --- a/docs/i18n/sw/CHANGELOG.md +++ b/docs/i18n/sw/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/ta/CHANGELOG.md b/docs/i18n/ta/CHANGELOG.md index 35cf14667e..5dfe873399 100644 --- a/docs/i18n/ta/CHANGELOG.md +++ b/docs/i18n/ta/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/te/CHANGELOG.md b/docs/i18n/te/CHANGELOG.md index 9902934dd6..8e9c9408c3 100644 --- a/docs/i18n/te/CHANGELOG.md +++ b/docs/i18n/te/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/th/CHANGELOG.md b/docs/i18n/th/CHANGELOG.md index 46993fa45c..965007625c 100644 --- a/docs/i18n/th/CHANGELOG.md +++ b/docs/i18n/th/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/tr/CHANGELOG.md b/docs/i18n/tr/CHANGELOG.md index 437002e85c..21908ff8fb 100644 --- a/docs/i18n/tr/CHANGELOG.md +++ b/docs/i18n/tr/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/uk-UA/CHANGELOG.md b/docs/i18n/uk-UA/CHANGELOG.md index 40729bcd3e..586e94d074 100644 --- a/docs/i18n/uk-UA/CHANGELOG.md +++ b/docs/i18n/uk-UA/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/ur/CHANGELOG.md b/docs/i18n/ur/CHANGELOG.md index e2dc3e3c72..9ddf43bce2 100644 --- a/docs/i18n/ur/CHANGELOG.md +++ b/docs/i18n/ur/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/vi/CHANGELOG.md b/docs/i18n/vi/CHANGELOG.md index c002f6fa28..6f180e4ba3 100644 --- a/docs/i18n/vi/CHANGELOG.md +++ b/docs/i18n/vi/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/zh-CN/CHANGELOG.md b/docs/i18n/zh-CN/CHANGELOG.md index 76c9a89da1..a74bd1792f 100644 --- a/docs/i18n/zh-CN/CHANGELOG.md +++ b/docs/i18n/zh-CN/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer | diff --git a/docs/i18n/zh-TW/CHANGELOG.md b/docs/i18n/zh-TW/CHANGELOG.md index d5c593e089..978032903a 100644 --- a/docs/i18n/zh-TW/CHANGELOG.md +++ b/docs/i18n/zh-TW/CHANGELOG.md @@ -971,7 +971,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(electron):** keep the desktop window usable on Windows by binding the embedded Next.js server to loopback instead of the machine hostname ([#10717](https://github.com/diegosouzapw/OmniRoute/pull/10717)) — thanks @echoriver89 - fix(proxy): keep password-only proxy credentials instead of dropping them when no username is set (#10720) - **fix(oauth):** keep the Kiro profileArn on IAM Identity Center logins ([#10725](https://github.com/diegosouzapw/OmniRoute/pull/10725)) — thanks @MichaelYcJo -- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone (#10727). +- **fix(executors):** the Meta AI (muse-spark-web) WebSocket send-message timeout now reports the socket's `readyState` at the moment it fires, so a "Meta AI WS timed out" failure can be told apart as either the connection never opening (`readyState=0`) or opening successfully and then going silent (`readyState=1`) — the exact ambiguity that made #10727 undiagnosable from logs alone ([#10916](https://github.com/diegosouzapw/OmniRoute/pull/10916)); reported in ([#10727](https://github.com/diegosouzapw/OmniRoute/issues/10727) — thanks @wray-lee) - **fix(providers):** copilot-m365-web chat turns no longer surface as `(empty response)` — the type:4 invocation is aligned with the 2026-08 wire shape and now carries its type:1 Metrics follow-up in the same socket write, and the access token pre-flight-refreshes from a stored refresh_token instead of requiring a DevTools re-capture every ~75 minutes ([#10732](https://github.com/diegosouzapw/OmniRoute/pull/10732) — thanks @acc0mplish) - **fix(sensenova):** clamp max reasoning effort to xhigh ([#10733](https://github.com/diegosouzapw/OmniRoute/pull/10733)) — thanks @InkshadeWoods - **fix(catalog):** stop counting `getTokenLimit()`'s generic 128k catch-all as a known combo window, so `/v1/models` advertises the min of sourced member contexts instead of collapsing a 500k combo to 128k ([#10734](https://github.com/diegosouzapw/OmniRoute/issues/10734)) @@ -1028,8 +1028,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(security):** clear new CodeQL code-scanning alerts (round 2) ([#10888](https://github.com/diegosouzapw/OmniRoute/pull/10888)) - **fix(settings):** add customSystemPrompt fields to updateSettingsSchema (#10865) ([#10890](https://github.com/diegosouzapw/OmniRoute/pull/10890)) — thanks @rqzbeh - **fix(model):** return model_not_found for unrecognized prefix models when provider is inactive (#10856) ([#10894](https://github.com/diegosouzapw/OmniRoute/pull/10894)) — thanks @rqzbeh -- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models (#10871) ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898)) — thanks @rqzbeh -- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution (#10892) ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899)) — thanks @rqzbeh +- **fix(models):** persist apiFormat, targetFormat, and supportsVision overrides for catalog models ([#10898](https://github.com/diegosouzapw/OmniRoute/pull/10898) — thanks @rqzbeh); reported in ([#10871](https://github.com/diegosouzapw/OmniRoute/issues/10871) — thanks @zoser69) +- **fix(auth):** add opencode/opencode-zen to search pairs for credential resolution ([#10899](https://github.com/diegosouzapw/OmniRoute/pull/10899) — thanks @rqzbeh); reported in ([#10892](https://github.com/diegosouzapw/OmniRoute/issues/10892) — thanks @Tanguille) - **fix(search):** enforce blockedProviders setting on search endpoint (#10863) ([#10901](https://github.com/diegosouzapw/OmniRoute/pull/10901)) — thanks @rqzbeh - **fix(perplexity-web):** make the built-in-search hint appended to every system message opt-in via `OMNIROUTE_PPLX_SEARCH_HINT` (off by default) — Perplexity's answer engine searches anyway, and the hint leaked into replies as meta-commentary for coding clients ([#10902](https://github.com/diegosouzapw/OmniRoute/pull/10902), extracted from [#8634](https://github.com/diegosouzapw/OmniRoute/pull/8634)) — thanks @danscMax - **fix(providers):** the loopback readiness gate no longer memorizes a failed probe — the next caller after 30s starts a fresh probe, and a readiness failure is logged once per probe instead of once per caller ([#10903](https://github.com/diegosouzapw/OmniRoute/pull/10903)) @@ -1225,6 +1225,11 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed - **fix(cli):** validate OpenRouter keys against its authenticated key-info endpoint instead of the public models endpoint, and register `omniroute auth export` as a real nested command so its arguments are wired correctly ([#11264](https://github.com/diegosouzapw/OmniRoute/pull/11264) — thanks @backryun) (reported in [#11226](https://github.com/diegosouzapw/OmniRoute/issues/11226) — thanks @AdityaMali16) - **fix(build):** make the publish and boot gates agree on dependency-based `sql.js` packaging, align the lazy `better-sqlite3` install with the declared optional dependency, and stop requiring a tarball path that the artifact gate forbids ([#11266](https://github.com/diegosouzapw/OmniRoute/pull/11266) — thanks @backryun) (reported in [#11242](https://github.com/diegosouzapw/OmniRoute/issues/11242) — thanks @tchopra91) (related [#10296](https://github.com/diegosouzapw/OmniRoute/issues/10296) — thanks @RaviTharuma) - **fix(resilience):** let OpenCode Go quota preflight use fresh dashboard snapshots when its live quota endpoint has no data, map the three quota windows consistently, ignore expired or unknown windows, and honor the sibling-selection preflight flag without changing the default-off behavior ([#11267](https://github.com/diegosouzapw/OmniRoute/pull/11267) — thanks @backryun) (reported in [#11234](https://github.com/diegosouzapw/OmniRoute/issues/11234) — thanks @mravathar) +- **fix(build):** keep the native `better-sqlite3` addon out of Next.js build workers with one shared `OMNIROUTE_BUILDING` guard and a build-only stub; raise the default build heap, cap worker pools, enforce LF shell scripts and disable Next.js telemetry across local, CI and Docker builds without downgrading Node or changing runtime database selection ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10060](https://github.com/diegosouzapw/OmniRoute/pull/10060) — thanks @davenamovich) +- **fix(copilot):** match GitHub Copilot CLI `1.0.81-6` request identity, use the raw GitHub token for entitled-model discovery, filter live catalogs by chat capability instead of a hardcoded allowlist, add the newly entitled Claude/Gemini/GPT/Grok/MAI models, and route every Claude-named GitHub or GHE model through native `/v1/messages` ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton); builds on the native Copilot messages foundation (thanks @yidecode) +- **fix(provider compatibility):** reject models-listing for Claude-Code-compatible connections before cached fallbacks can turn the unsupported request into an empty HTTP 200, and preserve raw no-auth model-override keys while resolving their sibling aliases so hidden-model and protocol overrides both survive ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952) — thanks @arminanton), re-derived from the closed ([#10795](https://github.com/diegosouzapw/OmniRoute/pull/10795) — thanks @rqzbeh) and reported in ([#7620](https://github.com/diegosouzapw/OmniRoute/issues/7620) — thanks @ahbeeahkao) +- **fix(codex-app-server):** default Codex-owned command/file execution to the `workspace-write` sandbox and deny its approval prompts unless the operator opts in; bind env-sourced capability tokens only to the matching env URL or an operator-local host; and stop the authenticated `/readyz` probe from following redirects ([#11281](https://github.com/diegosouzapw/OmniRoute/pull/11281)) — thanks @hartmark +- **fix(security):** refuse verbatim upstream-error passthrough when the body echoes a credential, redact relayed OCR and moderation errors, and cover the concrete `cookie`, `storageState` and `runtimeKey` call-log fields without hiding ordinary capability metadata ([#10952](https://github.com/diegosouzapw/OmniRoute/pull/10952)) — thanks @arminanton ### 📝 Maintenance @@ -1508,6 +1513,9 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed + + + ### 🙌 Contributors Thanks to everyone whose work landed in v3.8.50: @@ -1523,6 +1531,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@adrianojiu](https://github.com/adrianojiu) | #8438 | | [@agisota](https://github.com/agisota) | #9837 | | [@AgnesRiber](https://github.com/AgnesRiber) | #9718, #9976 | +| [@ahbeeahkao](https://github.com/ahbeeahkao) | #7620 | | [@ahmet-cetinkaya](https://github.com/ahmet-cetinkaya) | #8878 | | [@AIB1TAL0S](https://github.com/AIB1TAL0S) | #9284 | | [@AlanSyue](https://github.com/AlanSyue) | direct commit / report | @@ -1537,7 +1546,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@apoapostolov](https://github.com/apoapostolov) | #8916 | | [@arafatkatze](https://github.com/arafatkatze) | #10279, #10706 | | [@ARC345](https://github.com/ARC345) | #9628, #10050, #10051 | -| [@arminanton](https://github.com/arminanton) | #10933, #11166, #11205 | +| [@arminanton](https://github.com/arminanton) | #10933, #10952, #11166, #11205 | | [@aron-intframe](https://github.com/aron-intframe) | #10459 | | [@artickc](https://github.com/artickc) | #8571, #8578, #8791, #8843, #8870, #8927, #8974, #9097, #9255, #9549 | | [@Arul-](https://github.com/Arul-) | #9761 | @@ -1566,6 +1575,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@DaDecky](https://github.com/DaDecky) | direct commit / report | | [@danscMax](https://github.com/danscMax) | #8634 | | [@DarkEsteves](https://github.com/DarkEsteves) | #10250 | +| [@davenamovich](https://github.com/davenamovich) | #10060 | | [@dcox79](https://github.com/dcox79) | #10543 | | [@ddarkr](https://github.com/ddarkr) | #9035, #9036, #10177 | | [@Dingding-leo](https://github.com/Dingding-leo) | #7987, #8640, #8678, #8704, #8774, #8790, #8808, #8817 | @@ -1594,7 +1604,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report | | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 | | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 | -| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739 | +| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 | | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 | | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report | | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 | @@ -1700,7 +1710,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@rizxfrog](https://github.com/rizxfrog) | #10356, #10546 | | [@RobertsXML](https://github.com/RobertsXML) | direct commit / report | | [@royanrosyad85](https://github.com/royanrosyad85) | direct commit / report | -| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | +| [@rqzbeh](https://github.com/rqzbeh) | #10415, #10420, #10424, #10430, #10465, #10470, #10795, #10890, #10894, #10898, #10899, #10901, #11039, #11054, #11055, #11056, #11067, #11078, #11079, #11117, #11123, #11125, #11132, #11155, #11156, #11157, #11161, #11163, #11168, #11173, #11175, #11177, #11182, #11188, #11189 | | [@rushsinging](https://github.com/rushsinging) | #8947 | | [@ryan-brosas](https://github.com/ryan-brosas) | #9693 | | [@ryanngit](https://github.com/ryanngit) | direct commit / report | @@ -1724,6 +1734,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@szzhoujiarui](https://github.com/szzhoujiarui) | #9218 | | [@tald26](https://github.com/tald26) | #9959 | | [@taltas](https://github.com/taltas) | direct commit / report | +| [@Tanguille](https://github.com/Tanguille) | #10892 | | [@tchopra91](https://github.com/tchopra91) | #11242 | | [@TechNickAI](https://github.com/TechNickAI) | #9251, #10558 | | [@TengSivtean](https://github.com/TengSivtean) | #10000, #10002, #10086 | @@ -1742,6 +1753,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@Witroch4](https://github.com/Witroch4) | #8713 | | [@witt3rd](https://github.com/witt3rd) | #9962, #9963 | | [@wpec](https://github.com/wpec) | #10839 | +| [@wray-lee](https://github.com/wray-lee) | #10727 | | [@XDayonline](https://github.com/XDayonline) | #10053 | | [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8757, #8869, #8876, #8883, #8906, #8931, #9021, #9027, #9042, #9316, #9452, #10468, #11225 | | [@xyzs996](https://github.com/xyzs996) | #11210 | @@ -1760,7 +1772,7 @@ Thanks to everyone whose work landed in v3.8.50: | [@zhiru](https://github.com/zhiru) | #9099, #9101 | | [@ziuus](https://github.com/ziuus) | #8912 | | [@zmf963](https://github.com/zmf963) | #10738 | -| [@zoser69](https://github.com/zoser69) | #10874 | +| [@zoser69](https://github.com/zoser69) | #10871, #10874 | | [@zuckdorsey](https://github.com/zuckdorsey) | #9723 | | [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |