Release v3.8.20 (#3547)

* chore(release): open v3.8.20 development cycle

* fix(images): prefer bare combos over image aliases (#3527)

Integrated into release/v3.8.20

* fix(translator): map Codex local_shell tool (#3534)

Integrated into release/v3.8.20

* fix(usage): make opencode-go quota fetcher fail-open instead of throwing 500 (#3522)

Integrated into release/v3.8.20

* Fix Runtime page breaker state rendering (#3533)

Integrated into release/v3.8.20

* Expose provider breaker degradation threshold setting (#3535)

Integrated into release/v3.8.20

* fix(executor): strip provider prefix from versioned built-in tool model field (#3532)

Integrated into release/v3.8.20

* feat(providers): add Claude Fable 5 support (#3524)

Integrated into release/v3.8.20

* feat(resilience): add global provider cooldown tracking to prevent combo re-walking (#3556)

Integrated into release/v3.8.20 (default OFF, opt-in)

* fix(translator): scope thoughtSignature bypass to Antigravity/CLI only (#3560)

Integrated into release/v3.8.20. Co-authored-by: Six7Day <six7day@gmail.com>

* fix(routing): normalize thinking:disabled for combo-substituted models that reject it (#3554) (#3563)

Integrated into release/v3.8.20

* fix(usage): accept 0/empty budget limits so the dashboard can save and clear (#3537) (#3564)

Integrated into release/v3.8.20

* docs(changelog): credit @Six7Day for #3560 thoughtSignature fix (#3414)

The #3560 squash co-author trailer landed inline (unparsed by GitHub), so add
an explicit CHANGELOG credit ensuring @Six7Day (original #3414) and @oyi77 are
on the public record for the Gemini thoughtSignature fix.

* fix(gamification): dedup badge unlock via user_badges so events don't re-fire every request (#3472) (#3565)

Integrated into release/v3.8.20

* fix(routing): pass through 'auto' keyword on codex /v1/responses instead of rewriting to codex/auto (#3509) (#3566)

Integrated into release/v3.8.20

* fix(cli-tools): normalize apiKey null in guide-settings schema so cloud-mode config saves (#3552) (#3567)

Integrated into release/v3.8.20

* fix(catalog): reclassify PublicAI from keyless to one-time-initial (requires API key) (#3558) (#3568)

Integrated into release/v3.8.20

* fix(gemini-web): surface missing Playwright browser as actionable 503 + cooldown hint, not a retryable 500 loop (#3516) (#3570)

Integrated into release/v3.8.20

* fix(security): sanitize raw err.message in web executors + embeddings/search response bodies (Rule #12) (#3494, #3495) (#3573)

Integrated into release/v3.8.20

* fix(dashboard): point CustomHostsManager + FeatureFlagsGrid at real routes (#3486, #3487) (#3574)

Integrated into release/v3.8.20

* chore(providers): remove dead krutrim entry (#3483) + docs(api): fix agent-bridge per-agent state route (#3489) (#3575)

Integrated into release/v3.8.20

* docs(api): correct API_REFERENCE.md paths for skills/plugins/admin/cache/acp/system-info (#3497) (#3577)

Integrated into release/v3.8.20

* fix(proxy): drive SOCKS5 UI option from runtime ENABLE_SOCKS5_PROXY, not build-time NEXT_PUBLIC (#3508) (#3579)

Integrated into release/v3.8.20

* fix(playground): filter playground models by node prefix so custom-endpoint models appear (#3505) (#3581)

Integrated into release/v3.8.20

* fix(usage): show an informative message instead of a blank Kiro quota card when no usage breakdown (#3506) (#3582)

Integrated into release/v3.8.20

* docs(changelog): add the #3506 Kiro quota entry (missed in #3582 due to a stale-base CHANGELOG anchor) (#3583)

Integrated into release/v3.8.20

* fix(auto-update): use stable PROJECT_ROOT walker, not frozen process.cwd() (#3561)

Integrated into release/v3.8.20. Auto-update PROJECT_ROOT now uses a stable __dirname-anchored upward walker instead of the no-op process.cwd() resolver.

* fix: address PR #3518 review comments (lifecycle hooks, regex, indentation, route params) (#3562)

Integrated into release/v3.8.20. Addresses #3518 review: regex literals, logs/[id] route params (Next 16), indentation, and wires plugin lifecycle hooks (onInstall/onActivate/onDeactivate/onUninstall) in the loader so manager.ts can register them. Adds Rule #18 regression test.

* docs(changelog): credit @ViFigueiredo (#3423) for PROJECT_ROOT + log #3561/#3562 (v3.8.20)

* fix: openai to gemini incorrectly translates historical tool calls into text (#3569)

Integrated into release/v3.8.20. Standard Gemini direct path now maps historical tool calls to native functionCall/functionResponse parts (signaturelessToolCallMode: native) instead of inert text — validated against the real Gemini API (gemini-2.5-flash returns 200 for signatureless native functionCall, even with tools+thinking; Hard Rule #18). Eliminates the text-serialization leak. Antigravity/CLI sentinel path (#3560) untouched.

* docs(changelog)+test: reconcile standard-Gemini native mode (#3569) — update round-2 rationale comment + log VPS validation

* docs(changelog): reconcile v3.8.20 — add 9 missing bullets + move [Unreleased] to versioned section

* docs(changelog): complete v3.8.20 reconciliation — 27 bullets, 11 contributors

---------

Co-authored-by: Alexander Averyanov <alex@averyan.ru>
Co-authored-by: Hakan Kurşun <bykamaka@gmail.com>
Co-authored-by: Wilson <pedbookmed@gmail.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Giorgos Giakoumettis <giorgos@yiakoumettis.gr>
Co-authored-by: PizzaV <103120356+pizzav-xyz@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Markus Hartung <mail@hartmark.se>
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-06-10 13:49:08 -03:00
committed by GitHub
parent 630680067c
commit bf8b56b29f
188 changed files with 3603 additions and 542 deletions

View File

@@ -50,38 +50,21 @@ function isFileRef(p) {
// o path na doc, ou remover a menção. NÃO adicione novas aqui sem justificativa — esse
// é o ponto do gate. Issues de tracking devem ser abertas para cada cluster.
export const KNOWN_STALE_DOC_REFS = new Set([
// docs/reference/API_REFERENCE.md — tabela de endpoints com várias rotas obsoletas:
"/api/acp/agents/[id]", // só existe /api/acp/agents (sem [id])
"/api/acp/agents/refresh", // sem rota /refresh
"/api/admin/circuit-breaker", // admin só tem /concurrency
"/api/admin/circuit-breaker/reset", // idem
"/api/admin/rate-limits", // idem
"/api/cache/clear", // cache usa DELETE em /api/cache, não /clear
"/api/cache/reasoning/clear", // /api/cache/reasoning existe; /clear não
"/api/guardrails", // sem dir de API guardrails (feature server-side, sem rota REST)
// docs/reference/API_REFERENCE.md — guardrails/shadow entries fixed in separate issues:
"/api/guardrails", // sem dir de API guardrails (feature server-side, sem rota REST) — #3496
"/api/guardrails/[id]/disable",
"/api/guardrails/[id]/enable",
"/api/guardrails/logs",
"/api/guardrails/test",
"/api/plugins/[id]/disable", // rota real usa [name] + activate/deactivate
"/api/plugins/[id]/enable", // idem
"/api/shadow", // sem dir de API shadow (shadow routing não tem rota REST)
"/api/shadow", // sem dir de API shadow (shadow routing não tem rota REST) — #3498
"/api/shadow/[id]",
"/api/shadow/[id]/results",
"/api/shadow/metrics",
"/api/skills/[id]/disable", // skills tem [id] e /executions (base), não estas sub-ações
"/api/skills/[id]/enable",
"/api/skills/[id]/execute",
"/api/skills/[id]/executions",
"/api/system-info", // sem rota /system-info
// docs/research/DISCOVERY_TOOL_DESIGN.md — design doc de feature NÃO implementada:
// docs/research/DISCOVERY_TOOL_DESIGN.md — design doc de feature NÃO implementada: — #3498
"/api/discovery/results",
"/api/discovery/results/:id",
"/api/discovery/scan",
"/api/discovery/verify/:id",
// docs/frameworks/AGENTBRIDGE.md — state POR-AGENTE; rota real é o /state GLOBAL
// (mesmo drift congelado em check-openapi-routes.mjs::KNOWN_STALE_SPEC):
"/api/tools/agent-bridge/agents/{id}/state",
// docs/reference/ENVIRONMENT.md — endpoint UPSTREAM do provedor Blackbox Web,
// citado na descrição de env var (não é rota do OmniRoute):
"/api/chat",

View File

@@ -31,35 +31,7 @@ const SCAN_DIRS = [
// with no utils/error import) and should become a tracked cleanup issue: route the
// message through sanitizeErrorMessage()/buildErrorBody()/makeExecutorErrorResult().
// Do NOT add new entries without a justification — that defeats the gate.
export const KNOWN_MISSING_ERROR_HELPER = new Set([
// adapta-web: local makeErrorResponse() + `Adapta auth failed: ${msg}` where
// msg = err.message — raw auth/upstream error string in the JSON error body,
// no open-sse/utils/error import. Fix: sanitizeErrorMessage(msg) before forwarding.
"open-sse/executors/adapta-web.ts",
// deepseek-web: local errorResponse() shadow that puts `message` raw into the body,
// fed `DeepSeek error: ${msg}` where msg = err.message — bypasses the canonical
// sanitizer. Fix: route through buildErrorBody()/sanitizeErrorMessage().
"open-sse/executors/deepseek-web.ts",
// perplexity-web: `new Response({ error: { message: `Perplexity connection failed:
// ${err.message}` }})` (multi-line envelope) for TLS/connection failures — raw
// err.message in the client error body, no sanitizer import.
"open-sse/executors/perplexity-web.ts",
// qoder: `response: new Response({ error: { message: `Qoder fetch error:
// ${error.message}` }})` — raw error.message in the returned response body,
// no sanitizer import.
"open-sse/executors/qoder.ts",
// veoaifree-web: local errResp(msg) on nonce-fetch failure where msg = err.message —
// raw error string in the response body, no sanitizer import.
"open-sse/executors/veoaifree-web.ts",
// embeddings handler: `return { success: false, status: 502, error: `Embedding
// provider error: ${err.message}` }` — raw err.message in the result error field,
// no sanitizer import. (The saveCallLog `error: err.message` rows are internal and
// correctly NOT what is frozen here.)
"open-sse/handlers/embeddings.ts",
// search handler: `return { …, error: `Search provider …: ${err.message}` }` — raw
// err.message in the result error field, no sanitizer import.
"open-sse/handlers/search.ts",
]);
export const KNOWN_MISSING_ERROR_HELPER = new Set([]);
// Import specifiers that count as "uses the error helper" (path ends in utils/error).
const ERROR_HELPER_IMPORT =

View File

@@ -28,8 +28,6 @@ const KNOWN_MISSING = new Set([
"/api/gamification/badges", // profile/page.tsx — idem
"/api/gamification/badges/earned", // profile/page.tsx — idem
"/api/settings/obsidian/webdav", // ObsidianSourceCard.tsx — só existe /api/settings/obsidian
"/api/tools/traffic-inspector/custom-hosts", // CustomHostsManager.tsx — provável typo de /hosts
"/api/health", // FeatureFlagsGrid.tsx — health real é /api/monitoring/health
"/api/tools/agent-bridge/upstream-ca/test", // UpstreamCaField.tsx — rota inexistente
]);

View File

@@ -17,8 +17,6 @@ const OPENAPI_PATH = path.join(ROOT, "docs", "reference", "openapi.yaml");
const KNOWN_STALE_SPEC = new Set([
// openapi.yaml documenta um state por-agente, mas a rota real é o state GLOBAL
// (/api/tools/agent-bridge/state); por-agente só há /{id}, /{id}/detect, /mappings, /dns.
// Triagem: corrigir a spec para /state ou criar a rota. (pré-existente)
"/api/tools/agent-bridge/agents/{agentId}/state",
]);
/** Normaliza qualquer {param} para {} para casar independente do nome do parâmetro. */

View File

@@ -11,10 +11,7 @@ import { REGISTRY } from "@omniroute/open-sse/config/providerRegistry.ts";
// Entradas registry-only conhecidas (meia-registro pré-existente). Cada uma com
// justificativa. Remover daqui ao registrar o provider em providers.ts.
export const KNOWN_REGISTRY_ONLY: Record<string, string> = {
krutrim:
"Registry-only (baseUrl + krutrim-2-7b-instruct presentes) mas ausente de providers.ts — meia-registro pré-existente; triar em follow-up (registrar em APIKEY_PROVIDERS ou remover a entrada).",
};
export const KNOWN_REGISTRY_ONLY: Record<string, string> = {};
/** Ids do REGISTRY que não são providers canônicos e não estão na allowlist. */
export function findOrphanRegistryIds(