fix(providers): remove invalid CodeBuddy CN glm-4.7 and add hy3 (0.0x… (#10356)

* fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190)

Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13
(with monaco-editor scoped override). Closes Dependabot #189, #190.

Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge —
awaiting Dependabot re-scan.

npm audit → 0 vulnerabilities.

* fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks)

_tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing
slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential
_tasks symlink can slip in via git add -A and, once pulled, checkout materializes
it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks
ignores the symlink too, preventing re-capture.

* Hide health-check excluded models from /v1/models catalog (#10026)

Mirror the request-time exclusion rule (provider_specific_data.excludedModels)
in the unified catalog builder: a model is hidden when its provider has
connections but none of them is eligible for it. Applied across the
PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops
so ghost models no longer appear as available.

Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com>

* fix(models): memoize getModelsDevPricing (event loop / healthz) (#10055)

* fix(models): memoize getModelsDevPricing for /v1/models catalog

resolveCatalogPricing called getModelsDevPricing once per model while
building GET /v1/models. Each call re-scanned models_dev_pricing and
JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging
the event loop so even /healthz timed out (#9685, #10052).

Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing
and add a unit test for invalidation.

Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>

* fix(db): invalidate modelsDevPricing cache on DB reset (#10055)

Copilot review fixes:
1. Register invalidateModelsDevPricingCache() with DB state reset system
   so resetDbInstance() clears the process-local memo, preventing stale
   pricing data from surviving across DB reset/restore operations.
2. Add test assertion verifying DB reset bypasses the memo (Copilot #10055).

The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing()
results until saveModelsDevPricing()/clearModelsDevPricing() to avoid
re-scanning all pricing rows on every /v1/models request. Without this hook,
backup restore and test DB resets would serve stale cached data from the
previous connection.

Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts

---------

Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>

* fix(providers): remove invalid CodeBuddy CN glm-4.7 and add hy3 (0.0x credit)

Swap the GLM-4.7 model for the Hunyuan hy3 model in the codebuddy-cn
registry, keep the catalog at 15 models, and update the matching provider
test expectations. Regenerated the auto-generated provider reference doc.

---------

Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com>
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca>
Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

open-sse/config/providers/registry/codebuddy-cn/index.ts

@@ -67,13 +67,6 @@ export const codebuddy_cnProvider: RegistryEntry = {
       supportsReasoning: true,
       supportsVision: true,
     },
-    {
-      id: "glm-4.7",
-      name: "GLM-4.7",
-      contextLength: 200000,
-      maxOutputTokens: 48000,
-      supportsReasoning: true,
-    },
     {
       id: "minimax-m3",
       name: "MiniMax-M3",
@@ -122,6 +115,14 @@ export const codebuddy_cnProvider: RegistryEntry = {
       supportsReasoning: true,
       supportsVision: true,
     },
+    {
+      id: "hy3",
+      name: "Hy3",
+      contextLength: 192000,
+      maxOutputTokens: 64000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
     {
       id: "deepseek-v4-pro",
       name: "DeepSeek-V4-Pro",

tests/unit/codebuddy-cn-provider.test.ts

@@ -151,13 +151,13 @@ test("codebuddy-cn registry entry has expected shape", () => {
     "glm-5.0",
     "glm-5.0-turbo",
     "glm-5v-turbo",
-    "glm-4.7",
     "minimax-m3",
     "minimax-m2.7",
     "kimi-k2.7",
     "kimi-k2.6",
     "kimi-k2.5",
     "hy3-preview",
+    "hy3",
     "deepseek-v4-pro",
     "deepseek-v4-flash",
     "deepseek-v3-2-volc",