pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-19 21:52:21 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: Phase 1 & 2 implementation plan — T1-T10, T12

Browse Source 
T1 (openai-to-claude.ts): response_format injection for json_schema/json_object
T2 (base.ts): intra-URL retry for 429 errors (2x, 2s delay)
T3 (gemini-cli.ts): CLI fingerprint headers (User-Agent, X-Goog-Api-Client)
T5 (modelFamilyFallback.ts + chatCore.ts): intra-family model fallback on 400/404
T9 (pricing.ts): deepseek-3.1, deepseek-3.2, qwen3-coder-next pricing
T10 (scoring.ts + modePacks.ts): tierPriority as 7th scoring factor (Ultra>Pro>Free)
T12 (cliRuntime.ts): isSafePath() guard for CLI_*_BIN env var paths
This commit is contained in:
diegosouzapw
2026-03-12 18:06:53 -03:00
parent 02b19e63e8
commit a87d64372f
10 changed files with 353 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/shared/constants/pricing.ts
View File

@@ -138,6 +138,14 @@ export const DEFAULT_PRICING = {
reasoning: 6.0,
cache_creation: 1.0,
},
// Next-generation Qwen Coder tier (added Mar 2026 from decolua/9router catalog)
"qwen3-coder-next": {
input: 2.0,
output: 8.0,
cached: 1.0,
reasoning: 12.0,
cache_creation: 2.0,
},
"qwen3-coder-flash": {
input: 0.5,
output: 2.0,
@@ -198,6 +206,21 @@ export const DEFAULT_PRICING = {
reasoning: 4.5,
cache_creation: 0.75,
},
// Short-form aliases used by decolua/9router catalog (Mar 2026)
"deepseek-3.1": {
input: 0.27,
output: 1.1,
cached: 0.07,
reasoning: 2.2,
cache_creation: 0.27,
},
"deepseek-3.2": {
input: 0.27,
output: 1.1,
cached: 0.07,
reasoning: 2.2,
cache_creation: 0.27,
},
"minimax-m2": {
input: 0.5,
output: 2.0,

19
src/shared/services/cliRuntime.ts
View File

@@ -198,7 +198,26 @@ const resolveToolCommands = (toolId: string): string[] => {
return tool.defaultCommand ? [tool.defaultCommand] : [];
};
/**
* T12: Validate a CLI executable path to prevent shell injection.
* Enforces: absolute path, no dangerous shell metacharacters, must exist and be a file.
* Inspired by Antigravity Manager commit 96732c2 (Mar 11, 2026).
*/
const DANGEROUS_PATH_CHARS = ["&", "|", ";", "<", ">", "(", ")", "`", "$", "^", "%", "!"];
const isSafePath = (execPath: string): boolean => {
if (!execPath || !path.isAbsolute(execPath)) return false;
if (DANGEROUS_PATH_CHARS.some((c) => execPath.includes(c))) return false;
// Allow path.sep and path.delimiter — no further character filtering needed
return true;
};
const checkExplicitPath = async (commandPath: string) => {
// Reject paths that look like injection attempts
if (!isSafePath(commandPath)) {
return { installed: false, commandPath: null, reason: "unsafe_path" };
}
try {
await fs.access(commandPath, fs.constants.F_OK);
} catch {