mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-02 21:32:10 +03:00
Release v3.8.49 (#7076)
* fix(api): accept a missing status query-param on GET /api/plugins instead of rejecting null with Invalid status value (#8374) (#8399) * fix(backend): stop prompt-cache affinity from silently reordering an explicit priority combo across models (#8370) (#8400) * fix(api): estimate inline base64 image tokens instead of counting the data URL as text so it does not falsely exceed the context window (#8368) (#8401) * fix(resilience): treat an unreachable-proxy ECONNREFUSED as a circuit-breaker event so combo fails over instead of hitting the 503 max-retry limit (#8376) (#8403) * fix(dashboard): persist compression engine detail settings (Headroom / session dedup / CCR) instead of dropping them on save (#8388) (#8404) * feat(db): persist caller session tag into call_logs for per-session cost attribution (#8249) (#8334) * feat(api): quota-aware fallback routing for web-fetch providers (#8297) (#8335) Mirror the search/route.ts pattern for /v1/web/fetch: skip rate-limited stubs instead of letting them short-circuit auto-select, walk the fixed-priority pool (fill-first) with a request-time fallback on retryable/quota upstream statuses (429 always; 402/403 for Firecrawl/Tavily/TinyFish quota-style tiers), and return a proper 429 (with Retry-After) when the whole pool is exhausted instead of a generic 400. Explicit-provider requests never silently fall back. * feat(cli): replace ANTHROPIC_SMALL_FAST_MODEL with Fable default (#8343) Claude Code retired ANTHROPIC_SMALL_FAST_MODEL; expose ANTHROPIC_DEFAULT_FABLE_MODEL from the claude registry instead. * Clicking a provider card hitting back loses scroll position (#8349) * clicking a provider card hitting back loses scroll position * clean up code * Rename some funcitons * minor UX updates * add null-guard in highlight() * Add providerCardHandle tests * add highlight tests. refactored code into separate utility functions * Minor change to skip a firstElementChild call - use a ref to access the Link inside ProviderCard. * fix(i18n): restore brand proper nouns and unify terminology in zh-CN and zh-TW (#8355) * chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168) * fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179) * fix(ci): migrate Mergify auto-enqueue to merge_protections_settings.auto_merge_conditions (rules-based path is EOL 2026-07-16) (#7216) * fix(ci): drop Mergify batch settings (batching is a paid-tier feature; free plan queue is serial) (#7220) * fix(ci): merge queue tolerates the advisory dast-smoke failure (its GH-hosted build hang dequeued every attempt) (#7225) * test(ci): make the #6634 selfref guard hermetic — main's copy hard-fails every PR (#7341) main's copy of this test still does git I/O inside a unit test: const baseSrc = git(['show', 'origin/main:' + FILE]); Runners check out a shallow single ref, so origin/main does not resolve and the test dies with 'fatal: invalid object name origin/main'. Every PR into main fails Unit Tests (7/8) on it — today that is #7313, #7315, #7316, #7334, #7336 and #7337, six PRs red on a defect none of them introduced. #7313 has no other red at all. release/v3.8.49 already carries a fix (2e42b8efc, #7174: try/catch, fetch origin/main on demand, t.skip() when unreachable), but it only reaches main at release time — so main stays broken for the whole cycle. Cherry-picking it would also import a new problem: PR Test Policy classifies t.skip() as a silenced assertion, which we watched it correctly catch on #7300 today. This is the hermetic version instead (ported from #7327, which does the same for the release branch): read the file straight off disk, compare against an empty base so baseTaut/baseExtTaut are 0 — the strictest possible comparison point — and call evaluateMasking() directly. No git ref, no fetch, no skip, nothing the runner's checkout depth can break. The #6634 regression stays covered: the guard's logic lives in SELF_TEST_FIXTURE_RE (check-test-masking.mjs:337), not in the test. Proven both ways on main before committing — neutralise SELF_TEST_FIXTURE_RE to /$^/ and the test FAILS; restore it and it passes 2/2, with check-test-masking.mjs left byte-identical. Co-authored-by: growab <nekron@icloud.com> * chore(quality): tighten main's coverage baseline to the CI's real numbers (#7347) main's ratchet had been failing --require-tighten on every PR: 11 metrics improved but the baseline was never tightened. Same class as the #6634 selfref guard — an infra fix that lands only on the release branch leaves main red for the whole cycle, and every PR into main pays for it. Values are the merged-coverage numbers from a run on main itself (a local run measures ~68% vs CI's ~80%; the baseline's own note warns about that gap). Only the 11 coverage values change — gitleaks and semgrepFindings keep main's own state. No changelog fragment: #7326 carries it on release/v3.8.49, and a second one here would double the entry at release time. * Add cliproxy provider exposure controls and manifest injection (#7329) * feat(fusion): let judge use its own knowledge and override the panel (#6804) The judge prompt said to write an answer 'grounded in that analysis', implicitly capping output at the panel's union. When all panel members miss or are collectively wrong on something, the judge should apply its own reasoning as a full participant and override consensus, while keeping an honesty guard against fabrication. Adds a regression test. Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com> * fix(api): raise provider apiKey cap for cookie-based web providers (#6715) (#6759) * fix(cli): fall back to settings.json when Claude Code binary is unresolvable (#6701) (#6734) getCliRuntimeStatus() only ever answered `installed` from binary resolution (known install paths + where/which PATH search), so a stale PATH, moved binary, or uncatalogued install method reported "not found" even when ~/.claude/settings.json proved the CLI was installed and used before — regressing behind upstream 9router's checkClaudeInstalled(), which already falls back to the settings file when where/which fails. withSettingsFallback() (new src/shared/services/cliInstallFallback.ts, kept out of the frozen cliRuntime.ts to respect its file-size ceiling) restores that parity: only when the binary lookup's own reason is "not_found" (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk. * fix(providers): honor explicit thinking.budget_tokens 0 in openai->gemini transform (#6813) (#6821) The transform forwarded the Claude-style thinking.budget_tokens into generationConfig.thinkingConfig.thinkingBudget, but the presence check was truthy (&& thinking.budget_tokens). An explicit budget_tokens: 0 — the natural way to disable thinking — is falsy, so it was dropped and the request fell through to the default thinkingConfig injection, making the model think despite an explicit request for zero. Use an explicit numeric check so 0 is honored as thinkingBudget 0; includeThoughts is only set for a non-zero budget. * fix(compression): reconcile outer vs per-engine token counts (#6488) (#6741) * fix(compression): reconcile outer vs per-engine token counts on degenerate output (#6488) Outer originalTokens/compressedTokens (real tiktoken counter over extracted message text) diverged from engineBreakdown[0]'s counts (a crude JSON.stringify(requestBody).length/4 estimate), worst on small/degenerate inputs where JSON structural overhead dominates. A single-engine breakdown entry represents the exact same before/after transformation as the overall response, so reconcileSingleEngineTokens() now overwrites that one entry's counts with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched. * chore(6741): resolve release sync — CHANGELOG.md restored to release tip, entry moved to changelog.d fragment (fragments-first) * fix(api): accept enableRenderers in RTK compression config schema (#6703) (#6757) * fix(db): break probe-failed/restore loop on large storage.sqlite (#6632) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(cursor): add Opus 4.8, Fable 5, and Sonnet 5 model families (#6779) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's cursor registry + test changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(translator): read PDF/video file attachments for Gemini/Antigravity and Claude (#6790) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's translator + test changes. Co-authored-by: Wital <witalorocha216@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(codex): strip include from compact responses requests (#6805) * fix(codex): strip include from compact responses requests Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(6805): move include-strip assertion to standalone test file to keep executor-codex.test.ts under frozen size cap Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6769) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(bootstrap): filter empty process.env values to prevent Docker env crash loop (#6828) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first); keeps only the author's bootstrap change. Co-authored-by: Andrian B. <andrewbalanesq@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(providers): update SenseNova Token Plan support (#6330) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); the author's constants/registry/snapshot deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(providers): classify 404 as MODEL_NOT_FOUND to stop retry storm (#6829) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first); the author's chatCore/errorClassifier deltas were re-applied cleanly onto the release tip. Co-authored-by: Andrian B. <andrewbalanesq@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(api): accept all catalog engines on compression PUT schema (#6792) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR). Resolved the release's OmniGlyph engine addition additively (types.ts/compression.ts kept both 'relevance' and 'omniglyph') and extended stackedPipelineStepSchema + STACKED_PIPELINE_ENGINE_INTENSITIES with the omniglyph branch so the ENGINE_CATALOG-parity test passes. Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(api): point CLI health command at /api/monitoring/health (#6677) (#6717) * fix(api): point CLI health command at /api/monitoring/health (#6677) bin/cli/commands/health.mjs called GET /api/health, a route that was moved to /api/monitoring/health without updating the CLI; the top-level /api/health handler never existed on disk (only degradation/ and ping/ sub-routes). Point runHealthCommand()/runHealthComponentsCommand() at /api/monitoring/health and read its real payload shape (activeConnections, circuitBreakers: {open,halfOpen,closed}, memoryUsage) instead of the old nonexistent requests/breakers/cache/memory fields. * chore(6717): re-sync onto release tip; move CHANGELOG entry to changelog.d fragment (fragments-first) * chore(cursor): add Grok 4.5 effort/fast model IDs (#6774) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED (#6791) * fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(deepseek): extract done-terminator helper to keep frozen file under cap Extracts the FINISHED-drain scheduler and finish-once guard added for the [DONE] terminator fix (#6777) into a new deepseek-web-done-terminator.ts module, so deepseek-web.ts stays under its frozen line cap (1148). Behavior is unchanged. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(models): add capability override UI (#6727) * feat(models): add capability override UI Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); renumbered the migration 118 -> 119 to resolve the collision with 118_provider_param_filters.sql already on release/v3.8.47; the author's i18n/localDb deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(6727): import model-capability-overrides DB fns directly (not via localDb barrel) to keep localDb under file-size cap; aligns with anti-barrel convention * chore(db): satisfy known-symbols contract for modelCapabilityOverrides Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(cursor): use Agent CLI build id for x-cursor-client-version (#6795) * fix(cursor): use Agent CLI build id for x-cursor-client-version Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); the author's .env.example/docs deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): re-sync CHANGELOG.md to release tip (restore #6701 bullet) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(startup): rename reasoningControls.ts to avoid webpack casing collision (#6584) (#6718) * fix(startup): rename reasoningControls.ts to avoid webpack casing collision (#6584) * chore(6718): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(build): suppress Turbopack over-bundling warning from agentSkills generator (#6582) (#6720) * fix(build): suppress Turbopack over-bundling warning from agentSkills generator (#6582) generator.ts builds outputBase from a non-literal outputDir parameter, so Turbopack's file-tracing analyzer can't narrow it and emits an "Overly broad patterns" warning per entry point that imports the module (603 warnings on v3.8.46, up from 379). The fs access is legitimate and bounded, so next.config.mjs now suppresses this specific diagnostic via turbopack.ignoreIssue, mirroring the existing webpack.ignoreWarnings precedent in the same file. * chore(6720): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(providers): drop image_generation for Codex Spark models regardless of plan (#6651) (#6721) * fix(providers): drop image_generation for Codex Spark models regardless of plan (#6651) * chore(6721): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(providers): stop quota card re-sorting Codex/GLM bars by remaining % (#6687) (#6722) * fix(providers): stop quota card re-sorting Codex/GLM bars by remaining % (#6687) QuotaCardExpanded.tsx unconditionally re-sorted quotas by remaining percentage via sortQuotasByRemaining(), discarding the deterministic CODEX_QUOTA_ORDER/GLM_QUOTA_ORDER window order quotaParsing.ts's sortCodexOrder()/sortGlmOrder() had already established. A new hasFixedQuotaOrder() + resolveQuotaDisplayOrder() skip the re-sort for providers with a fixed window order (codex, glm family), threading providerId from QuotaCard.tsx through to the display layer. Regression guard: tests/unit/quota-card-expanded-fixed-order-6687.test.ts * chore(6722): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(startup): lazy-import ioredis in rateLimiter to fix MCP ERR_MODULE_NOT_FOUND (#6559) (#6725) * fix(startup): lazy-import ioredis in rateLimiter to fix MCP ERR_MODULE_NOT_FOUND (#6559) * chore(6725): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(resilience): resolve fp-pinned combo account back to real connection id (#6696) (#6732) * fix(resilience): resolve fp-pinned combo account back to real connection id (#6696) * chore(6732): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(api): Responses passthrough emits event-only SSE frames after filtering commentary output (#6561) (#6735) * fix(api): Responses passthrough emits event-only SSE frames after filtering commentary output (#6561) The #6199 commentary-drop `continue;` branches in stream.ts skipped the data: line for a dropped commentary event but never cleared the already-buffered event: line for the same frame, so the next blank line flushed the stale event: line alone -- an event-only SSE frame that crashes the OpenAI Python SDK's json.loads(). Both drop sites now call clearPendingPassthroughEvent() before continue. The commentary-drop decision was extracted into a new responsesCommentaryDrop.ts module so the fix does not grow the frozen stream.ts. * chore(6735): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(api): emit reasoning_content on claude-web + v0-vercel-web SSE (#6662) (#6743) * fix(api): emit reasoning_content on claude-web + v0-vercel-web /v1/chat/completions SSE (#6662) * chore(6743): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(sse): unwrap bare {function:{…}} tools in openai→claude translation (#6704) * fix(sse): unwrap bare {function:{…}} tools in openai→claude translation Some OpenAI-shape clients send a tool as a bare `{ function: {...} }` object, omitting the spec-required `type: "function"` parent wrapper. The tools-mapping in openai-to-claude.ts (~line 366) only unwrapped `tool.function` when `tool.type === "function"` was ALSO true, so a bare-function tool fell through to `toolData = tool` (the wrapper itself, with no `.name`), producing an empty `originalName` and silently dropping the tool from the translated request — worse than a 400, since the caller has no signal the tool never made it upstream. Unwrap `tool.function` whenever present, independent of the parent `type` field. Regression guard: tests/unit/openai-to-claude-bare-tool.test.ts. Co-authored-by: Samir Abis <me@samirabis.com> Inspired-by: https://github.com/decolua/9router/pull/2473 * chore(6704): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: Samir Abis <me@samirabis.com> * fix(oauth): avoid bare-email dedup of Codex OAuth logins (#6706) * fix(oauth): avoid bare-email dedup of Codex OAuth logins When an incoming Codex OAuth connection has no verifiable workspace/account id, do not merge it into an existing row on email match alone — that silently overwrote the other account's token pair. Require a matching chatgptUserId (a stable per-account JWT id) before merging; otherwise insert a distinct connection row. Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com> Inspired-by: https://github.com/decolua/9router/pull/2477 * chore(6706): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com> * fix(sse): skip thinkingConfig for gemma models in openai→gemini translation (#6708) open-sse/translator/request/claude-to-gemini.ts already guards against sending thinkingConfig for gemma-4-* models (Gemma doesn't support it — Vertex returns 400: "Thinking budget is not supported for this model"), but the OpenAI-shape path (openai-to-gemini.ts) lacked the same guard, so OpenAI-shape clients hitting a vertex gemma-4-* model still got a 400. Mirrors the existing claude-to-gemini.ts guard: wrap the reasoning_effort and Claude-shape thinking.budget_tokens branches with a model.startsWith ("gemma-4") check. Branch 3 (default includeThoughts for modern Gemini models) already excludes non-"gemini" model ids and needed no change. Inspired-by: https://github.com/decolua/9router/pull/2480 Co-authored-by: chy1211 <31048289+chy1211@users.noreply.github.com> * fix(codex): surface capacity errors embedded in 200-OK SSE streams (#6710) * fix(codex): surface capacity errors embedded in 200-OK SSE streams Codex sometimes answers with HTTP 200 and a text/event-stream body whose payload carries a transient error mid-stream (e.g. "Selected model is at capacity...", server_is_overloaded, service_unavailable_error). Because the outer HTTP status was 200, this looked like a successful response to every caller — no retry, no circuit breaker, and no combo/account fallback ever engaged, so a healthy account sat idle while the request silently failed or truncated. Add peekCodexSseTransientError() to open-sse/executors/codex.ts: it peeks the first bytes of a text/event-stream Codex response, pattern-matches the known transient-error signatures, and converts a match into a real 503 Response via errorResponse() (Hard Rule #12 — sanitized, never raw upstream text). A 503 is already a recognized provider-failure status in accountFallback.ts, so combo routing and connection cooldown pick it up automatically. When no error signature is found, the peeked prefix is prepended back onto the remaining upstream body so the passthrough stays byte-identical to the unmodified response. Regression guard: tests/unit/codex-sse-capacity-fallback.test.ts — a model-at-capacity payload and a server_is_overloaded/service_unavailable_error payload both convert to 503; a normal single-chunk SSE stream and one split across multiple network chunks both reassemble byte-for-byte unchanged. Inspired-by: https://github.com/decolua/9router/pull/2452 (sub-bug #3 only — OmniRoute already covers PR #2452's other two sub-bugs: service_tier "fast" normalization and reasoning_effort "max" normalization). Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * chore(6710): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * fix(volcengine): clamp Kimi max_tokens to Ark endpoint cap (#6712) * fix(volcengine): clamp Kimi max_tokens to Ark endpoint cap VolcEngine Ark's Kimi coding-plan endpoint (ark.cn-beijing.volces.com) enforces max_tokens <= 32768 server-side and returns 400 "integer above maximum value, expected a value <= 32768" for anything over that ceiling. OmniRoute's StripRule only supported dropping params outright, with no numeric clamp mechanism, so a client sending a larger max_tokens (common default, e.g. 65536) 400s outright against volcengine's kimi-k2-5-260127. The 32768 cap is independently confirmed against two live-endpoint bug reports hitting this exact Ark endpoint for both kimi-k2.5 and kimi-k2.7-code (NousResearch/hermes-agent#51773, MoonshotAI/kimi-cli#1124), not just upstream's own value — same cap upstream 9router#2460 uses. StripRule gains two optional fields: `clampToModelMaxOutput` (clamp to the model's own catalog maxOutputTokens ceiling, when set) and `maxOutputCap` (a fixed endpoint-imposed ceiling); when both apply, the lower wins. The new rule is scoped to the literal id `kimi-k2-5-260127` (OmniRoute's real volcengine Kimi model, not upstream's `Kimi-K2.7-Code`), not a broad /kimi/i regex, so it can never clamp an unrelated future Kimi listing whose Ark cap may differ. glm-4-7-251222 (the other volcengine model) is unaffected. Inspired-by: https://github.com/decolua/9router/pull/2460 Co-authored-by: whale9820 <whale9820@users.noreply.github.com> * chore(6712): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: whale9820 <whale9820@users.noreply.github.com> * fix(antigravity): surface aborted Gemini tool calls off end_turn (#6713) * fix(antigravity): surface aborted Gemini tool calls off end_turn Gemini/Antigravity aborts a turn with finishReason MALFORMED_FUNCTION_CALL (or a sibling like UNEXPECTED_TOOL_CALL) instead of completing cleanly. Both Claude-facing translators collapsed these to a clean end_turn, hiding the aborted tool call as a successful completion: - the OpenAI hub path (openai-to-claude.ts convertFinishReason default), and - the DIRECT Gemini->Claude path (gemini-to-claude.ts), which is the one Claude Code actually hits through an antigravity/Gemini-routed model. Add isAbortFinishReason() to finishReason.ts and map these reasons to tool_use on both paths; genuinely unknown reasons still fall back to end_turn. Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com> Inspired-by: https://github.com/decolua/9router/pull/2462 * chore(6713): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com> * fix(translator): strip empty cloud_base_branch from Cursor Subagent tool call (#6729) * fix(translator): strip empty cloud_base_branch from Cursor Subagent tool call (port from 9router#2446) The Responses->Chat tool-arg cleanup (stripEmptyOptionalToolArgs) only stripped empty-string/empty-array optional args for Claude Code's Read tool. Cursor's local Subagent tool call therefore passed through with the cloud-only field cloud_base_branch: "", which Cursor rejects ("cloud_base_branch may only be specified when environment equals cloud") before starting the subagent. Extend the cleanup to an allowlist of Read + Subagent; arbitrary tools stay untouched. Reported-by: like3213934360-lab (https://github.com/decolua/9router/issues/2446) * chore(6729): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * fix(translator): defer content_block_start until GLM streams the tool name (#6730) * fix(translator): defer content_block_start until GLM streams the tool name (port from 9router#2077) GLM 5.2 (and similar OpenAI-compatible upstreams) stream a tool call's id and function.name across separate SSE delta chunks. The openai-to-claude streaming translator emitted content_block_start immediately on the id-only chunk with an empty name; the Claude SSE protocol cannot patch a block after emission, so the later name-only chunk was dropped and Claude Code rejected the tool_use with an empty tool name / "No such tool available:". Defer content_block_start until the name arrives (start on args if they arrive first), and emit a start for any orphaned id-only tool call at finish so content_block_stop is never orphaned. Reported-by: itiwant (https://github.com/decolua/9router/issues/2077) * chore(6730): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * feat(dashboard): add search to Playground model picker dropdown (#4086) (#6811) * feat(dashboard): add search to Playground model picker dropdown (#4086) The shared ModelSelectModal (combo builder + CLI-code cards) already had search, but the Playground's raw model <select> in StudioConfigPane stayed a flat unsearchable list - unusable once a provider like OpenRouter contributed 50+ models. Adds a search input above the dropdown that filters options via filterModelsByQuery() (Turkish-safe accent/case-insensitive match, reusing matchesSearch()). The currently selected model always stays pinned in the list even when it doesn't match the query, so typing never silently swaps the active selection. Reuses the existing common.search i18n key already translated in all 42 locales - no new key needed. * chore(6811): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * feat: request count log per provider, per date (#4009) (#6812) * feat(dashboard): request count log per provider, per date (#4009) Some providers bill by request rather than by token, so operators need a plain per-provider, per-date request count breakdown, not just token aggregates. Adds a new getProviderDailyUsageRows() aggregation query (src/lib/db/usageAnalytics.ts), a dedicated GET /api/usage/requests-by-provider-date route (kept separate from the frozen /api/usage/analytics route to respect the file-size baseline), and a sortable, single-date-filterable table on Dashboard -> Analytics. Closes #4009 * chore(6812): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * feat(xai): route xAI clients to Grok native /v1/responses endpoint (#6709) * feat(xai): route xAI clients to Grok native /v1/responses endpoint xAI ships a native /v1/responses endpoint (https://api.x.ai/v1/responses) alongside /v1/chat/completions, but XaiExecutor extended BaseExecutor without overriding buildUrl(), so every request always resolved to the static chat-completions baseUrl regardless of target format — the last genuinely-missing slice of decolua/9router#2439 (grok-build-0.1, the reasoning-effort suffix routing, and bare grok-* routing were already ported in prior cycles). Add responsesBaseUrl to the xai registry entry and tag grok-4.20-multi-agent-0309 (upstream's own Responses-only id) with targetFormat: "openai-responses", mirroring the existing model-tag-driven routing pattern already used by the gh executor (9router#102) and the "openai" -pro heuristic in open-sse/executors/default.ts — the per-model registry tag is the single source of truth that also drives chatCore's body translation, so URL and body stay in lockstep. XaiExecutor.buildUrl now checks getModelTargetFormat("xai", model) and resolves to the native Responses endpoint only for tagged models, leaving every other grok-* model on the existing chat-completions bridge. TDD: tests/unit/executor-xai.test.ts adds a RED-then-GREEN case asserting grok-4.20-multi-agent-0309 resolves to https://api.x.ai/v1/responses and a control case asserting grok-4.3 still resolves to https://api.x.ai/v1/chat/completions. Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> Inspired-by: https://github.com/decolua/9router/pull/2439 * chore(6709): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * fix(resilience): route remaining credential-selection call sites through quota preflight (#6686) (#6742) * fix(resilience): route remaining credential-selection call sites through quota preflight (#6686) * chore(6742): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(resilience): apikey-provider 429s honor explicit quota-exhausted text (#6638) (#6731) * fix(resilience): apikey-provider 429s honor explicit quota-exhausted text (#6638) Ollama Cloud (and any other apikey-category provider) 429s skipped body-text quota classification entirely; a genuine multi-day quota exhaustion was misclassified as a plain rate_limit_exceeded with a few seconds of cooldown, so combo routing retried the account immediately. shouldPreserveQuotaSignals() now lets an explicit quota-exhausted signal (looksLikeQuotaExhausted) override the apikey-category default, and parseDayGranularityResetMs() adds day- granularity reset-hint parsing ("...reset in 3 days.") alongside the existing Xh/Ym/Zs parsing. Regression guard: tests/unit/issue-6638-ollama-quota.test.ts (RED before the fix, GREEN after). Aligned two tests/unit/account-fallback-service.test.ts cases that had codified the old buggy behavior for apikey-provider quota text. * chore(6731): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * feat(resilience): weekly-429 cooldown for fetcher-less providers (#3709) (#6817) * feat(resilience): weekly-429 cooldown for fetcher-less providers (#3709) Ollama Cloud free-tier accounts have a hard WEEKLY request cap. On cap the upstream returns 429 "you (<account>) have reached your weekly usage limit", but ollama-cloud is an apikey-category provider, so the existing oauth-only shouldUseQuotaSignal gate in checkFallbackError skips the subscription-quota-text classifier (Issue #2321) for its 429s -- the account fell through to the generic exponential backoff (~1s, capped at 2min) and got retried every few minutes for the rest of the week (one account took 285x429 in 48h). Adds a new, ungated weekly-usage-limit text classifier that applies a 24h QUOTA_EXHAUSTED cooldown regardless of provider category. Extracted the new classifier -- together with the existing #2321 subscription-quota logic -- into a new open-sse/services/quotaTextCooldowns.ts module so the frozen accountFallback.ts (file-size-baseline cap) didn't have to grow; net effect shrinks accountFallback.ts by 20 lines. This is Phase A of the plan (open-sse/services/accountFallback.ts:1038-1045 "weekly-429 cooldown"); Phase B (generic local request-counter preflight for manual provider_plans dimensions) is a separate, larger follow-up per the plan's own phasing. * chore(6817): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(providers): Kiro adaptive-thinking allowlist excludes sonnet-4.5/haiku-4.5 (#6576) (#6726) * fix(providers): Kiro adaptive-thinking allowlist excludes sonnet-4.5/haiku-4.5 (#6576) * chore(6726): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * test(kiro): migrate selector-strip test to claude-sonnet-5 (only Kiro adaptive-thinking model, #6576) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(quality): rebaseline complexity 2053->2054 (merge-burst drift, v3.8.47) Inherited drift from today's /implement-prs merge burst (~36 PRs). check:complexity does not run on the PR->release fast-path, so the branch accrued +1 unmeasured. No orphan/feature PR introduces a NEW violation (complexity-net-zero); the only flagged function is the pre-existing getResolvedModelCapabilities. Owner-approved rebaseline to unblock the FQG of ~7 green-except-complexity orphans. * chore(stryker): register ollama-quota covering tests (merge-burst drift, v3.8.47) The 3 covering unit tests from #6731/#6817/#6742 (issue-6638-ollama-quota, ollama-cloud-weekly-quota-cooldown-3709, issue-6686-quota-preflight-coverage) exist on release but were never added to tap.testFiles when those PRs merged. Completes the registration so mutant kills count; unblocks every PR touching a mutated module. Part of the owner-approved merge-burst drift cleanup. * fix: auto-start WS server in-process and change default port to 20132 (#6072) * feat: change default LIVE_WS_PORT from 20129 to 20132 Update the default WebSocket port for the live dashboard server from 20129 to 20132 across all configuration files, documentation, code comments, and tests. Also consolidate OMNIROUTE_DISABLE_LIVE_WS and OMNIROUTE_ENABLE_LIVE_WS into a single OMNIROUTE_ENABLE_LIVE_WS flag. Wire the live WebSocket server to start in-process via instrumentation-node.ts. * feat: clarify NEXT_PUBLIC_LIVE_WS_PUBLIC_URL path usage and derive upgrade path from URL Update .env.example and ENVIRONMENT.md to document that the pathname portion of NEXT_PUBLIC_LIVE_WS_PUBLIC_URL (e.g. /live-ws) is used as the WebSocket upgrade path by the dev proxy, handshake response, and client connection logic. Extract deriveLiveWsPath() into shared/utils/wsPath.ts and wire it through: - src/app/api/v1/ws/route.ts — handshake response path field - src/hooks/useLiveDashboard.ts — build * fix: use the standard URL API to safely parse and update the effectiveWsUrl * build(docker): expose live WebSocket server port and configure CORS origins Add LIVE_WS_PORT (20132), LIVE_WS_HOST (0.0.0.0), and LIVE_WS_ALLOWED_ORIGINS environment variables to all Docker Compose profiles and expose the WebSocket port mapping. Prevent infinite self-loop in standalone-server-ws.mjs by skipping proxy when the server itself is running on the LiveWS port. * docs(env): fix comment formatting for HOST and HOSTNAME variables --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(logs): prevent stale detail refresh reopening modal (#6323) * fix(logs): prevent stale detail refresh reopening modal * chore(stryker): register ollama-quota covering tests (release drift from merge burst) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * \ feat: operator-configurable account rotation\ (#6763) * feat(resilience): operator-configurable account rotation Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); the author's accountFallback/.env deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * docs(env): document configurable account-rotation env vars in ENVIRONMENT.md Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(rotation): extract rotation gate/context helpers to keep accountFallback.ts under frozen cap Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): re-sync CHANGELOG.md to release tip (restore lost base bullet) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(stryker): register rotation-config test in tap.testFiles for mutation coverage Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(stryker): register ollama-quota covering tests (drift from #6731/#6817/#6742) + re-sync Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(lmarena): modernize Arena web provider + static Direct-chat catalog (#6280) * fix(lmarena): modernize Arena web provider + static Direct-chat catalog Update the lmarena provider for arena.ai (product rebranded from LMArena): - Route chat via arena.ai create-evaluation with Chrome TLS impersonation (tls-client-node) and optional browser-minted recaptchaV3Token. - Seed Text+Search (48) into the chat registry; seed Image (27) only into IMAGE_PROVIDERS. Disable live HTML model discovery; resolve public names to Arena UUIDs from the static TypeScript allowlist (no scrape JSON in-repo). - Soft-exclude 404/502 model ids; slow/stop bulk test-all probes for this provider. - Do not fold IMAGE_PROVIDERS/video specialty into the chat provider catalog when a chat registry already exists (lmarena/openai/xai). - Display name Arena (Free); keep wire id `lmarena` / alias `lma` for back-compat. - Theme-aware provider icons: arena-light.svg / arena-dark.svg. - Preserve split Supabase SSR cookie reconstruction for arena-auth-prod-v1.*. * fix(providers): align provider-models-route test fixture + regen provider reference Fold the topaz image-only catalog entry's apiFormat/supportedEndpoints into the local-catalog test fixture (route now tags media-only providers per the lmarena PR's staticModels.ts change), regenerate PROVIDER_REFERENCE.md against the merged release providers.ts, and add the changelog fragment for #6280. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test: align web-cookie fallback suite — lmarena now has a registry entry (probe path) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * docs(changelog): reconcile 3-day merge burst — 16 fragments, 4 promised credits, contributors hall 32→63 - changelog.d fragments for the 20 merged PRs that landed without a bullet (#6072 #6308 #6323 #6538 #6556 #6586 #6611 #6647 #6675 #6698 #6757 #6759 #6804 #6821 + ci rollup #6781/#6691/#6693 + docs rollup #6643/#6644/#6646/#6663; omniglyph bump #6661 folded into the #6556 bullet) - deliver the 4 credits promised in close comments but never written: @alltomatos (#6819 dup of #6721), @samimozcan (#6762/#6753 subsumed by #6790), @chirag127 (#6756 dup of #6757), @Squawk7777 (#6565 dup of #6564 — appended to the existing #6564 bullet; changelog-integrity flags that edit as a removal, intentional: ALLOW_CHANGELOG_REMOVALS justification) - rebuild the v3.8.47 Contributors hall from merged-PR authors + thanks credits + prior hall: 32 → 63 contributors * Clamp reasoning token buffer to model output cap (#6714) * fix(combo): clamp reasoning buffer to model output cap * fix(routing): preserve near-cap reasoning max tokens * fix(routing): getExplicitModelOutputCap falls through to registry cap on non-numeric synced limit_output getExplicitModelOutputCap short-circuited to null whenever a synced capability row existed, even if that row's limit_output was not a number (models.dev commonly omits it). That silently disabled the reasoning-token buffer clamp for any model with a synced row lacking an output limit. Now only return the synced value when it IS a number; otherwise fall through to registryModel.maxOutputTokens / spec.maxOutputTokens, matching the ??-chain precedence already used by getResolvedModelCapabilities(). Adds a standalone regression test (proves the fallthrough returns the real registry cap, not null) and hardens the #6274 fixture id so its no-output-cap case does not prefix-match the real glm-5.2 static spec. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(stryker): register ollama-quota covering tests (release drift from merge burst) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(i18n): add Traditional Chinese (zh-TW) localization for frontend and CLI (#6320) * feat(i18n): add Traditional Chinese (zh-TW) localization for frontend and CLI - Add src/i18n/messages/zh-TW.json translating frontend web UI - Add bin/cli/locales/zh-TW.json translating CLI commands and descriptors - Register zh-TW in config/i18n.json and docs/guides/I18N.md - Update scripts/i18n/generate-multilang.mjs matching the new locale setup * fix: update i18n locale count from 42 to 43 after adding zh-TW The docs strict checker (check-docs-counts-sync.mjs) validates that README.md and I18N.md reflect the real locale count. Adding zh-TW bumped the count from 42 → 43. * fix(i18n): translate providers free-filter labels in zh-TW (#6694 guard) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: lunkerchen <lunkerchen@users.noreply.github.com> * feat(proxy): implement latency-optimized proxy rotation strategy (#6798) * feat(proxy): implement latency-optimized proxy rotation strategy Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first); the author's env/docs/i18n deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(proxy): add latency-rotation env var to .env.example PROXY_LATENCY_WINDOW_HOURS was referenced in src/lib/db/proxies.ts and documented in docs/reference/ENVIRONMENT.md, but missing from .env.example, tripping the env/docs sync gate. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): re-sync CHANGELOG.md to release tip Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(proxy): extract latency-strategy helpers to keep frozen files under cap Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(db-rules): expect 35 audited modules (proxyLatency joins INTENTIONALLY_INTERNAL) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * docs(readme): fix stale strategy/tool/scoring counts (#6853) README still claimed 17 routing strategies (the table was missing pipeline), 95 MCP tools, and 9-factor Auto-Combo scoring. Align with the source (ROUTING_STRATEGY_VALUES has 18 entries) and the canonical docs (MCP-SERVER.md: 94 tools; AUTO-COMBO.md: 12-factor). * fix(antigravity): sanitize Cloud Code safety settings (#6839) Co-authored-by: kfiramar <83420275+kfiramar@users.noreply.github.com> * fix(kiro): probe IdC region during profileArn discovery, cross-region (recovers #6099) (#6840) * fix(kiro): route Amazon Q runtime by profileArn region for cross-region IdC Enterprise AWS IAM Identity Center accounts whose IdC instance lives outside the two Amazon Q Developer profile regions (us-east-1 / eu-central-1) - e.g. eu-north-1 (Stockholm), start URL https://d-XXXX.awsapps.com/start - showed no limits and returned 502 on every request. Root cause: the backend used the IdC/OIDC token region (providerSpecificData.region, e.g. eu-north-1) for every CodeWhisperer runtime call, hitting q.eu-north-1.amazonaws.com - a host that does not exist as a Q Developer runtime endpoint. Per AWS docs ("Supported Regions for the Q Developer console and Q Developer profile"), the Q Developer *profile* (which produces the profileArn and hosts generateAssistantResponse / GetUsageLimits / ListAvailableModels / ListAvailableProfiles) is only hosted in us-east-1 and eu-central-1, regardless of the IdC region; "data is stored in the Region where you create the Amazon Q Developer profile." Fix (new open-sse/services/kiroRegion.ts) decouples the two regions: - providerSpecificData.region stays the IdC/OIDC region, used ONLY for oidc.{region}.amazonaws.com token mint/refresh. - The runtime region is derived from the profileArn (resolveKiroRuntimeRegion): profileArn region -> a valid stored profile region -> us-east-1. A stored IdC region that is not a Q profile region (eu-north-1) is ignored for runtime. - Profile discovery (discoverKiroProfileArnAcrossRegions) probes the Q profile regions (EU IdC -> eu-central-1 first) with the cross-region SSO token instead of q.{idcRegion}. Wired into: executors/kiro.ts (generateAssistantResponse targets the profile region), services/usage/kiro.ts (getKiroUsage multi-region discovery + profileArn runtime region so Limits resolves), services/kiroModels.ts (ListAvailableModels), and src/lib/oauth/providers/kiro.ts (login-time postExchange profile discovery). Adds tests/unit/kiro-idc-cross-region.test.ts (15 cases). All Kiro suites pass (60 tests). * fix(kiro): probe the IdC region too during profileArn discovery (any IdC region) Make profile discovery general for an IdC in ANY of the ~30 IdC-supported AWS regions (us-west-2, ap-southeast-2, me-central-1, af-south-1, ...), not just eu-north-1. buildKiroProfileDiscoveryRegions now probes the two documented Q Developer profile regions FIRST (us-east-1 / eu-central-1, EU-first for EMEA IdC regions to cut latency), then appends the IdC/stored region itself as a forward-compatible fallback: if AWS ever co-locates the profile with the IdC or expands the profile-region list, a same-region probe still finds it. Probing a region with no profile simply returns nothing and we fall through. The profileArn's own region remains authoritative for every runtime call (resolveKiroRuntimeRegion), so a newly-issued ARN in any region is honored automatically. Adds ap-southeast-2 (APAC) cross-region coverage and updates the discovery-order tests. --------- Co-authored-by: artickc <artur1992123@mail.ru> * feat(providers): manual context-window override for custom models (#4125) (#6822) Add a manual per-model "Context Window Override" so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model getting silently dropped from combo routing once the wrong value lands in the catalog. Reuses the existing Feature-5004 model_context_overrides table (source="manual") — already the priority-0 source getModelContextLimit() (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: - PUT /api/provider-models now accepts an optional contextWindowOverride (number to set, null to clear), persisted via setModelContextOverride/ removeModelContextOverride. - GET /api/provider-models surfaces the current override value + source back on each custom-model row. - CustomModelsSection.tsx: edit form gained a Context Window Override input + a badge on the model row when an override is set. Regression guard: tests/unit/provider-models-context-window-override-4125.test.ts (manual override wins over a misreported catalog value, GET round-trip, clearing via null, default-unchanged behavior). * feat(dashboard): improve Provider Quota page horizontal density (#3520) (#6815) QuotaCardGrid stacked every provider group vertically in a single flex flex-col container, and each group's own card grid didn't go multi-column until the md breakpoint. Provider groups now flow into a 2-column CSS multi-column layout on very wide (2xl) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately, filling horizontal whitespace sooner on narrower-but-not-mobile viewports. Regression guard: tests/unit/quota-card-grid-horizontal-layout.test.ts * refactor(usage): type saveRequestUsage with UsageEntry interface + any-budget ratchet (#3512) (#6809) Replace saveRequestUsage(entry: any) with a typed UsageEntry interface mirroring the usage_history columns 1:1. Fields stay optional/nullable since different writers (chatCore success/failure, rejected-request accounting, Codex Responses WS) populate the row incrementally; tokens stays unknown since callers pass either raw provider-shaped usage or the normalized {input,output,cacheRead,...} shape. Also cleaned the file's other any usages (getUsageHistory filter, getUsageDb next-cursor cast, appendRequestLog tokens param, getRecentLogs catch) so it now sits at zero any and can be added to the check:any-budget:t11 zero-any allowlist. Documents the DB-entity <-> TS-interface convention in docs/architecture/CODEBASE_DOCUMENTATION.md Sec 11. * feat(combo): strict budget-cap fallback policy for auto/* combos (#3470) (#6816) Auto-combo transparency + budget controls: the engine's budgetCap enforcement always degraded to the globally cheapest candidate when every candidate exceeded the cap - silently overspending instead of respecting the cap. - engine.ts: budgetFallback "cheapest" (default, legacy) | "strict" (BudgetExceededError when no candidate fits budgetCap) - requestControls.ts: X-OmniRoute-Budget-Fallback header + resolveRequestAutoControls() consolidating mode/budget/fallback parsing - resolveAutoStrategy.ts / autoConfig.ts: thread combo-level config.budgetFallback and catch BudgetExceededError into an HTTP 402 - chat.ts: switch to the consolidated resolveRequestAutoControls() helper (net line reduction, stays under the frozen file-size baseline) Regression guard: tests/unit/auto-combo-budget-fallback-3470.test.ts * fix(usage): honor xAI provider-reported exact cost (#6711) OmniRoute's calculateCost() always estimated request cost from token counts x static pricing, discarding xAI's exact provider-reported cost when present. xAI's chat-completions usage object reports the precise billed cost via cost_in_usd_ticks (docs.x.ai/developers/cost-tracking and the API reference's usage schema: "TICKS_IN_USD_CENT: i64 = 100_000_000" => 1e10 ticks/USD, e.g. 37756000 ticks ~= $0.0038). calculateCost()/computeCostFromPricing() now short-circuit to this exact figure when present -- before any pricing DB lookup, so it also works for models without a local pricing row -- and still fall back to the token-based estimate when it is absent. The field is threaded through both the streaming (extractUsage/normalizeUsage) and non-streaming (extractUsageFromResponse) usage-extraction paths. Corrected divisor vs upstream: the upstream PR used /1e12 (a 100x under-report, e.g. reporting $0.00123 as the doc's $0.123 example); this port uses the doc-verified /1e10 instead, confirmed against both the cost-tracking guide and the API reference's usage-object schema. Inspired-by: https://github.com/decolua/9router/pull/2453 Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * docs: rename /implement-prs → /merge-prs in Hard Rule #21 (skill renamed 2026-07-11) (#6847) * docs: refresh stale llm.txt facts + relocate design.md to docs/architecture/DESIGN_SYSTEM.md (#6849) * docs: refresh stale llm.txt facts + move design.md to docs/architecture/DESIGN_SYSTEM.md llm.txt was frozen at the v3.8.8 era (177 providers, 37 MCP tools, 14 strategies, 9-factor scoring, 75% coverage gate). Update every factual claim to the current state (248 providers, 94 tools / 30 scopes, 18 strategies, 12-factor scoring, ratchet + 60% floor, TS 6, current docs/ layout) and re-sync the 42 exact-copy i18n mirrors. design.md at the root was a standardization plan whose phases 1-6 all shipped; rewrite its header as a permanent reference and relocate it to docs/architecture/DESIGN_SYSTEM.md per the root-hygiene policy (root = configs + canonical docs only). * docs: add MDX frontmatter to DESIGN_SYSTEM.md (in-app docs pipeline requires it) * feat: per-model web-search interception rule (#3384) (#6814) * feat(routing): per-model web-search interception rule (#3384) Adds a per-provider/per-model interceptSearch rule (src/lib/db/interceptionRules.ts, key_value namespace interception_rules) that overrides the existing native web-search bypass defaults (Codex/Gemini/Claude->Claude passthrough) in webSearchFallback.ts. Wired at the existing prepareWebSearchFallbackBody() call site in chatCore.ts. Resolution precedence: per-model rule > provider-level rule > existing native-bypass defaults. This lands Phase 1-2 of the plan (rule store + search interception). Web-fetch interception and the dashboard UI toggle are tracked as follow-up phases. * fix(db): register interceptionRules in localDb re-export layer (db-rules gate) * fix(db): renumber interception_rules migration 119→120 (collision with model_capability_overrides) * feat: sidebar search/filter input (#4013) (#6810) * feat(dashboard): add search/filter input to the dashboard sidebar (#4013) Adds a search box at the top of the expanded sidebar that filters nav sections/groups/items client-side by label, so users don't have to hunt through the growing nav tree. Reuses the existing common.search / common.noResults i18n keys (no new locale edits needed) and the shared Input icon="search" pattern. Matching sections auto-expand while searching and the accordion/pin state is restored once the query is cleared. Filtering logic is extracted into a pure filterSidebarSectionsByQuery() helper (src/shared/utils/sidebarSearch.ts) so it is trivially unit testable independent of React/next-intl/next-navigation. * fix(test): move Sidebar.search test to a runner-collected path (test-discovery gate) * fix(i18n): backfill 194 missing pt-BR keys (#6695) (#6723) * fix(i18n): backfill 194 missing pt-BR keys and add key-parity regression test (#6695) * Merge branch 'release/v3.8.47' into fix/6695-i18n-drift Resolve i18n key-parity and CHANGELOG-fragment conflicts: - Convert the #6695 CHANGELOG.md bullet to a changelog.d/ fragment (the fragment convention landed on release/v3.8.47 after this PR branched, per changelog.d/README.md). - Backfill 61 additional pt-BR keys that entered en.json on release/v3.8.47 after this PR's original 194-key backfill, so the PR's own key-parity regression test (tests/unit/i18n-pt-br.test.ts) stays green against the moving release baseline. * Discover live Codex models (#6776) * Add live model discovery for provider catalog * Fix model discovery request headers * fix(codex): sync live model limits with local catalog * test(codex): split live model discovery coverage into dedicated route tests * fix(codex): use chatgpt account id for live model sync * Add GitHub-backed Codex model discovery fallback * fix(providers): tighten oauth config tests and provider model display comments * test: align client version expectations with release default * fix(codex): keep discovery complexity within baseline * fix: rebase live Codex model discovery onto release/v3.8.47, preserving kimi-web buildHeaders (#6308) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(codex): echo requested effort-suffixed model id in Responses payloads (#3697) (#6820) * feat(codex): echo requested effort-suffixed model id in Responses payloads (#3697) Codex CLI compatibility shim: the Responses API response.created/ response.in_progress/response.completed payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested effort-suffixed model id (e.g. gpt-5.5-xhigh) instead of the bare upstream id (gpt-5.5), so the Codex CLI status line/model button shows the active reasoning effort. - openai-responses.ts translator threads the upstream model into the Responses event objects (additive, omitted when unknown). - New isCodexOriginatedHeaders() (codexIdentity.ts) reuses PR #3481's originator/User-Agent detection, header-based so it still fires when a combo routes codex/gpt-5.5-xhigh to a non-codex upstream. - chatCore's existing opt-in #1311 echoModel pipeline now also fires automatically for Codex clients on the Responses API, regardless of the echoRequestedModelName setting. - responseModelEcho.ts now also rewrites the nested response.model field the Responses API uses (previously only top-level model). - /v1/models keeps returning models: [] for Codex (unchanged, #3481). Regression guard: tests/unit/codex-effort-model-echo-3697.test.ts. Closes #3697 * chore(merge): re-sync with release/v3.8.47 (restore CHANGELOG, keep own bullet) * chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof) * feat(usage): surface Antigravity weekly quota alongside the 5-hour window (#4017) (#6818) * feat(usage): surface Antigravity weekly quota alongside the 5-hour window (#4017) Antigravity enforces both a 5-hour and a weekly usage limit, but the agy/antigravity quota widget only exposed the 5-hour window. The weekly limit isn't in the per-model retrieveUserQuota response already fetched — it lives in a separate, undocumented retrieveUserQuotaSummary RPC that groups models into families (Gemini Models, Claude and GPT models) with one weekly bucket per family. Adds a self-contained usage/antigravityWeeklyQuota.ts leaf: a cached, best-effort fetch of that RPC + a pure parser that extracts the weekly-labeled bucket per group (window inferred from bucketId/displayName text, matching the reverse-engineered shape documented by third-party Antigravity clients) into gemini_weekly/ claude_gpt_weekly quota entries, merged into the existing quotas map the widget already renders generically. A failed/unavailable RPC never affects the existing per-model quotas. Live VPS validation attempt (192.168.0.15, real antigravity account): both retrieveUserQuota and retrieveUserQuotaSummary currently return 429 RESOURCE_EXHAUSTED for that account, so the live response shape could not be captured directly. The parser was instead validated via TDD against the bucket shape documented by CodexBar (steipete/CodexBar), a third-party Antigravity client that reverse-engineered the same RPC, and is defensive against both response envelopes it has observed (top-level groups[] and nested quotaSummary.groups[]). * chore(merge): re-sync with release/v3.8.47 (restore CHANGELOG, keep own bullet) * chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof) * feat: add Z.ai Web free web-cookie provider (#4056) (#6823) * feat(providers): add Z.ai Web free web-cookie provider (#4056) New zai-web web-session provider drives the free chat.z.ai consumer chat UI via a pasted browser cookie, distinct from the existing API-key zai/glm/glm-cn/glmt providers (api.z.ai). ZaiWebExecutor posts to chat.z.ai/api/chat/completions with the cookie forwarded both as Cookie and Authorization: Bearer <token>, and normalizes both z.ai's internal delta_content/phase SSE envelope and a pass-through OpenAI-shaped choices[].delta frame into standard chat-completion chunks. Registered in WEB_COOKIE_PROVIDERS, WEB_SESSION_CREDENTIAL_REQUIREMENTS, the provider registry (GLM-4.6/4.5/4.5V models), the executor factory, and tokenExtractionConfig.ts for in-app cookie capture. * fix(providers): regenerate translate-path golden for zai-web + reduce cognitive complexity * fix(providers): rename ZaiWebExecutor.buildHeaders to avoid incompatible BaseExecutor override * chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof) * fix(codex): bump default client version to 0.144.0 (#6780) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(usage): extract per-group parsing in antigravityWeeklyQuota (cognitive-complexity gate 886→885, release-level drift from #6818 merge) * ci(quality): cut PR gate wall time without dropping protection (#6716) Collapse duplicate CI spend while keeping each gate's existence reason: - quality.yml: TIA __RUN_ALL__ defers full unit to fast-unit 4-shard (#6781); path filters via classify-pr-changes; docs-gates split; draft skip - ci.yml: wire docs/i18n/code path filters; ESLint JSON artifact for quality-gate; drop advisory typecheck:noimplicit; float actions/cache@v6 - TIA parity: memory/usage/combo/serial; **/*.test.mjs any depth; electron/bin no longer force unit __RUN_ALL__ - check:complexity-ratchets: one ESLint walk, ruleId-isolated baselines + cache - check:api-docs-refs + lib/apiRoutes: shared API route inventory - husky pre-push: intentionally light (gates live in pre-commit); CLAUDE.md + QUALITY_GATES.md docs synced - collect-metrics / lint:json: path.resolve cache path; Windows-safe eslint bin - env-doc allowlist for ESLINT_RESULTS_JSON / COMPLEXITY_ESLINT_REPORT - release-green --full-ci expects check:api-docs-refs (not docs-symbols alone) Tests: select-impacted, classify-pr-changes, api-routes lib, complexity-rule-count, validate-release-green. Reconciled after #6781 (fast-unit 2→4 shards) per maintainer request on #6716. Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(docs): document Turbopack build memory tradeoff for RAM-constrained machines (#6409) (#6885) * fix(routing): recognize Kimi token-limit 400 as context overflow for combo fallback (#6637) (#6893) combo.ts's isContextOverflow400() guard required the literal word 'context' in the 400 error body before letting a combo fall through to the next target. Kimi's exact wording ('Your request exceeded model token limit: 262144 (requested: 308458)') never says 'context', so the guard misclassified it as a body-specific error and halted the whole combo instead of trying the next (larger-context) target. accountFallback.ts's CONTEXT_OVERFLOW_PATTERNS already recognized this wording one layer below (via checkFallbackError -> shouldFallback), so the two independently-maintained classifiers disagreed and the stricter one won. Export CONTEXT_OVERFLOW_PATTERNS from accountFallback.ts and reuse it inside combo.ts's isContextOverflow400() so both layers share a single source of truth. Regression test: tests/unit/repro-6637-kimi-token-limit.test.ts (RED on unfixed code -> GREEN after the fix). Existing #4519 guard tests (tests/unit/combo-param-validation-fallback-4519.test.ts) still pass, including the negative case that a genuinely body-specific 400 is NOT misclassified as overflow. * fix(providers): honor a provider-level proxy assigned to no-auth providers (#6272) (#6895) No-auth providers (mimocode, opencode, ...) are always dispatched with a single hardcoded connectionId ("noauth" — SYNTHETIC_NOAUTH_CONNECTION_ID in src/sse/services/auth.ts). No provider_connections row ever has id="noauth", so resolveProxyForConnection() in src/lib/db/settings.ts could never populate connectionRecord for them, and its provider-level proxy lookup (Steps 6/8) only runs when connectionRecord is present. A proxy assigned via Settings -> Providers -> mimocode was therefore silently ignored, reproducing the reporter's "same thing happen when i set the proxy directly in the provider menu" symptom. Adds a best-effort fall… * feat(providers): map upstream reasoning-level metadata in openai-compatible discovery (#8347) (#8363) * docs(claude-code): document unprefixed model IDs and the Ambiguous model error (#8410) Claude Code always sends bare (unprefixed) model IDs such as claude-opus-4-8. When both the Claude Code (cc) and Claude (claude) providers are connected, that bare id resolves to two routes and the gateway returns a 400 'Ambiguous model' error, which the guide never mentioned. Add a Troubleshooting entry covering both fixes: pinning a prefixed ANTHROPIC_MODEL, or enabling the 'Prefer Claude Code for unprefixed Claude models' setting (dashboard toggle / OMNIROUTE_PREFER_CLAUDE_CODE_FOR_UNPREFIXED_CLAUDE_MODELS), linking to the environment reference where the flag is documented. Closes #8311 * i18n(zh-TW): translate missing Reasoning Routing strings (#8423) * fix(auth): exclude local CLI providers from tokenHealthCheck expiration (Fixes #8407) (#8426) * fix(providers): prevent health sweep from expiring devin-cli local credentials * fix(auth): drop devin-cli from supportsTokenRefresh explicit set (#8407) Root cause: listing "devin-cli" as refresh-capable made tokenHealthCheck force-expire local CLI connections that never have a refresh token. Remove it from the explicit set (keep windsurf) and drop the health-check provider hardcode — the existing supportsTokenRefresh=false guard is enough. * fix(oauth): add devin-cli and agy entries to OAUTH_TEST_CONFIG (#8427) * fix(dashboard): preserve connection health visual on last routed topology node (#8428) * feat(providers): add missing opencode-go reasoning effort variants (#8441) Register OpenCode Go registry effort aliases and EFFORT_TIERS rewrites so clients can select declared reasoning levels through OmniRoute. Closes #8353 * test(e2e): contract test for the full provider journey (#8330) (#8444) Add an end-to-end contract test that walks the whole provider journey as one gate: create provider (node) -> add connection -> sync models -> select in Combo -> Playground -> /v1/models exposure -> call via API key -> visible in Topology. Every step asserts against the same derived contract identity (published model id / configured prefix / raw node id), so a divergence on any surface fails the suite. Directly guards the bugs tracked from Discussion #8273: compatible-provider model regex drift, /v1/models namespace/UUID incoherence (#8327), and Topology blind to custom providers (#8328/#3198). The primary journey drives the real App Router route handlers + DB layer in-process against an isolated DATA_DIR, so it runs in CI under test:integration (collected by the top-level tests/integration/*.test.ts glob) as a blocking gate with no live server. A second, opt-in block runs the same journey over HTTP and self-skips unless RUN_CONTRACT_INT=1 (same convention as the RUN_SERVICES_INT suites). Refs #8273. Reported-by: @nguyenha935 * chore(deps): bump codecov/codecov-action from 5.5.5 to 7.0.0 (#8452) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.5 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](0fb7174895...fb8b3582c8) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.3 (#8453) Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.1 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](7188fc3636...e4fba868fa) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#8454) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.3 (#8455) Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.1 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](7188fc3636...e4fba868fa) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 6 to 7 (#8456) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(sse): record tool calls into shared state for openai->openai-responses call-log summary (#8462) The openai-responses translator tracked tool calls in its own funcCallIds/ funcNames/funcArgsBuf bookkeeping without ever writing to the shared state.toolCalls Map that stream.ts's completion-log summary builder reads. Every openai->openai-responses translated stream with a tool call was persisted with finish_reason "stop" and no tool_calls, even though the actual SSE events sent to the client were correct. * feat: add Claude Opus 5 support (#8464) * chore(sse): drop deprecated baseUrl from open-sse tsconfig for TS 7.0 (#8473) TypeScript 6.x raises TS5101 on `open-sse/tsconfig.json`: `baseUrl` is deprecated and stops functioning in TypeScript 7.0. It was paired with `ignoreDeprecations: "5.0"`, which no longer silences it under TS 6 (the compiler now demands "6.0"). Remove `baseUrl: ".."` and rewrite the `paths` mappings relative to the tsconfig's own directory, which is how TypeScript resolves them with no baseUrl set: "@/*" ./src/* -> ../src/* "@omniroute/open-sse" ./open-sse -> ../open-sse "@omniroute/open-sse/*" ./open-sse/* -> ../open-sse/* `ignoreDeprecations` goes with it — baseUrl was the only deprecated option it was suppressing. Verified by diffing the full tsc error set against the previous config (the base run used `ignoreDeprecations: "6.0"` so compilation proceeds past the config error, which otherwise aborts type-checking and masks everything): zero new errors, 28 fewer. All 28 were in `electron/*.js`, which `baseUrl: ".."` had been dragging into the open-sse program via root-relative resolution. Scoping the program back to open-sse also moves `check:type-coverage` from 92.17% to 94.01%; the ratchet direction is up so the gate passes, and the baseline is deliberately left alone because the gain is a measurement-scope change rather than new typing work. The guard test asserts no tsconfig reintroduces `baseUrl` or `ignoreDeprecations`, and that every `paths` target still resolves to a real directory — the second half is the part that matters, since dropping baseUrl silently changes what those mappings point at. * refactor(sse): resolve open-sse utils/translator type diagnostics for TS 7 (#8483) First slice of the TypeScript 7 migration split requested on #7697: resolve the type diagnostics under `open-sse/tsconfig.json` in the lowest-risk modules, with no toolchain change. 12 diagnostics across 8 files, all outside the hot path — `chatCore.ts` and `stream.ts` are deliberately left for a later, standalone slice. Fixes, by cause: * `Transformer.cancel` (progressTracker, sseHeartbeat, and stream.ts's existing handler) — the WHATWG Streams standard defines `transformer.cancel(reason)` and Node implements it (verified on v24: cancelling the readable side invokes it), but `lib.dom.d.ts` still omits it from `Transformer`, so every such handler was TS2353. These handlers clear the heartbeat/progress intervals when an SSE client disconnects, so deleting them to satisfy the checker would leak a timer per abandoned stream. The interface is patched in `open-sse/types.d.ts` instead. * `earlyStreamKeepalive` — `SettledHandler` was discriminated by `ok: true | false`. This workspace compiles with `strictNullChecks: false`, where a boolean-literal discriminant narrows the positive branch but not the negative one, so reading `.error` off the rejected arm did not type-check (the two `.response` reads elsewhere in the file did, which is why only one site errored). Retagged with a string discriminant, which narrows both branches under the same settings. * `toolCallShim` / `openai-responses` — assigning back to a property declared `unknown` resets the `typeof` narrowing, so the following comparison no longer saw a number/array. Both now read through a local. The `Read` limit clamp is behavior-identical: its two branches are mutually exclusive at READ_MAX_LIMIT 2000. * `sanitizeToolResultId` — takes `unknown` but forwards to a `string` parameter; a non-string id previously reached `.replace()` and threw. Coerced instead. * `openaiHelper` — `opts = {}` inferred `{}`; typed as `FilterToOpenAIFormatOptions`. * `cursorAgentProtobuf` — `Buffer.alloc(0)` infers `Buffer<ArrayBuffer>` under @types/node 26 while the decoded field is `Buffer<ArrayBufferLike>`; the locals now use bare `Buffer`, matching `requestMetadata` a few lines above. Validation: 335 -> 321 diagnostics with zero new errors (full tsc error-set diff against the base config). typecheck:core clean, lint clean, check:type-coverage 92.17% -> 94.17%. All 114 existing test files that import a touched module pass; `plan3-p0.test.ts` fails identically with and without this change (it reads the developer's real ~/.omniroute DB instead of a test-scoped DATA_DIR). The new test covers the three behavioral surfaces rather than the refactors the existing keepalive/heartbeat suites already hold: that `transformer.cancel()` really fires and can clear an interval, the id coercion, and the limit-clamp bounds. * fix(sse): call the real abort-signal helper in the Gemini Business executor (#8485) `gemini-business.ts` built its upstream fetch options with `combineAbortSignals(...)`, which is defined nowhere in the repository. The module imports `mergeAbortSignals` from `./base.ts` on line 31 and never used it — a rename that was only half applied. Because the call sits inside the fetch options object literal, the ReferenceError was thrown while *constructing* the arguments, before `fetch()` ran, and the surrounding try/catch turned it into `makeErrorResult(502, "Gemini Business network error: ...")`. So every Gemini Business request failed with what reads like an upstream outage. The provider is registered and reachable (`open-sse/executors/index.ts`), so this affects the whole provider, not an edge case. `mergeAbortSignals(primary, secondary)` requires two real signals while `ExecuteInput.signal` is `AbortSignal | null | undefined`, so the call is guarded and falls back to the timeout alone — the same shape huggingchat, grok-web, claude-web, and ninerouter already use. Why it went unnoticed: this file is only type-checked by `open-sse/tsconfig.json`, whose runs abort at `TS5101` (the deprecated `baseUrl`) before any file is checked, and `typecheck:core` covers a curated 26-file allowlist that excludes every executor. Removing that config error is #8473; this bug is what the first full run surfaced. TDD: the two new tests fail on the parent commit — `execute()` never reaches the stubbed `fetch` — and pass with the fix. They also cover the null-signal path, since that is where an unguarded `mergeAbortSignals` would throw next. * refactor(sse): declare the executor execute() result contract (#8489) `normalizeExecutorResult()` has always accepted `Response | { response, url, headers, transformedBody }` — the bare arm is what the web/scraping executors return from their error and passthrough paths, and `chatcore-upstream-timeouts.test.ts` already covers that both shapes are handled. But `BaseExecutor.execute` has no explicit return type, so TypeScript inferred it from the method's single `return` — the object shape alone. Every override returning a bare `Response` was therefore reported as incompatible: * 14 × TS2739 in `duckduckgo-web.ts`, whose `execute()` additionally pinned its own signature to just the object shape while returning `errorResponse()` / `processResponse()` (both `Response`) from 14 valid paths * TS2416 in `felo-web.ts` and `gitlab.ts`, which declare `Promise<Response>` Fix the declaration rather than the call sites: export `ExecutorExecuteResult` from `base.ts` — the same union `normalizeExecutorResult()` accepts — and annotate `BaseExecutor.execute` with it. `duckduckgo-web.ts` then drops its over-narrow annotation, matching BaseExecutor and the ~38 other executors that let the return type be inferred. Two subclasses read `.response` straight off `super.execute()` and now narrow first: * `github.ts` — the existing `!result.response` guard already meant "bare Response, nothing to materialize"; it is now expressed as `result instanceof Response`, which is the same branch for every input (bare / object / nullish) * `pollinations.ts` — reads the status through both arms for its pool bookkeeping Wrapping DuckDuckGo's 14 returns would have been the wrong fix: the values are already correct, and `normalizeExecutorResult()` produces exactly `{ response, url: "", headers: {}, transformedBody: null }` for them. Validation: full tsc error-set diff against the base config — 335 -> 319, **zero new errors** (line-number-agnostic diff is empty; the two `duckduckgo-web.ts` TS2345s that appear to move are the same two pre-existing errors renumbered by added comments, and are left for a later slice). `typecheck:core` clean, `check:type-coverage` 92.17% -> 94.17%, and 49 of the 50 existing test files importing a touched executor pass — `plan3-p0.test.ts` fails identically with and without this change (it reads the developer's real ~/.omniroute DB rather than a test-scoped DATA_DIR). The new test pins the runtime behavior of the narrowing so a later simplification cannot quietly drop the bare-Response arm. * test(sse): repair two base-red gates on release/v3.8.49 (#8490) * test(sse): repair two base-red gates on release/v3.8.49 `release/v3.8.49` is red at its own HEAD (36f8fd10) — `Quality Gates` and `Release-Green (continuous)` both fail — so every PR opened against it inherits four failing checks regardless of content. Two of those causes had no owner: #8480/#8481/#8482 cover the compression ladder, the antigravity catalog, and the resilience/translator regressions respectively, none of them these. 1. `chatcore-client-usage-buffer.test.ts` — 5/5 failing. #8331/#8356 (e8719783e) inserted an `options` parameter between `clientResponseFormat` and `deps` on `applyClientUsageBuffer()`. The five call sites here still passed `deps` in the fourth position, so the injected spies landed in the `options` slot and the real implementations ran — every `calls.*.length` assertion saw 0. The `Parameters<typeof applyClientUsageBuffer>[3]` cast in `makeDeps()` masked the type error, which is why it reached the branch. Call sites updated to `(resp, body, format, {}, deps)` and the cast repointed to `[4]`. Two cases added for the parameter that caused this, since nothing at this layer exercised it: `preserveContextBudgetInVisibleUsage` re-folds `context_budget_*` into the visible fields for the Claude-Code path, and the default path keeps the real unbuffered #8331 numbers. 2. `claude-to-openai-think-close-5123.test.ts` — 4 unsuppressed `@typescript-eslint/no-explicit-any` errors, failing `npm run lint`. Its suppression entry allows `count: 2` but the file had grown to four `(chunk: any)` callbacks. Rather than raise the frozen count, the cause is fixed: `collectChunks()` returns `StreamChunk[]` instead of `unknown[]`, narrowing once at the boundary so all four callbacks need no annotation. The suppression entry is then stale and removed, which ratchets the file to zero. Test-only plus one allowlist deletion; no production code. Verified on a clean worktree of the base commit: `npm run lint` clean (was 4 errors), `chatcore-client-usage-buffer` 7/7 (was 0/5), `claude-to-openai-think-close-5123` 3/3. * chore(ci): rebaseline five inherited file-size overages on release/v3.8.49 `check:file-size` fails on release/v3.8.49 at its own HEAD (36f8fd10), which is what turns `Fast Quality Gates` red for every PR against this base: tokenHealthCheck.ts 832 -> 841 chat.ts 1865 -> 1866 auth.ts 2475 -> 2486 accountFallback.ts 1941 -> 1960 combo.ts 3630 -> 3642 None of these files is touched by this PR. The growth was inherited from already merged PRs that did not bump their entries, so there is no offending branch left to fix — the same situation the baseline already records under `_rebaseline_2026_07_02_5798_release_green`, and the procedure it documents is to raise the frozen values with a justification note. Raised to the current base values only. The files stay frozen and cannot grow further; an in-flight PR that adds lines to them bumps its own entry as usual (#8482 touches accountFallback.ts and combo.ts and will need that). * chore(ci): register 11 covering unit tests in stryker tap.testFiles `check:mutation-test-coverage --strict` fails on release/v3.8.49 at its own HEAD: 11 unit tests that cover mutated modules are absent from `stryker.conf.json` `tap.testFiles`, so their mutant kills do not count. The gate does not self-heal — it names the exact files to add. open-sse/services/accountFallback.ts + 8247-accountfallback-model-unhealthy, 8248-accountfallback-nvidia-degraded, model-lockout-exact-cooldown-cap, repro-antigravity-404-family-cooldown-hijack src/sse/services/auth.ts + 7993-noauth-proxy-routing, 8200-perplexity-web-401-cooldown, sse-auth-antigravity-credits src/server/authz/routeGuard.ts + authz/route-guard-vnc-session-local-only open-sse/utils/error.ts + error-sensitive-redaction open-sse/utils/publicCreds.ts + adobe-firefly src/shared/utils/circuitBreaker.ts + 8332-combo-vision-fallback None is a file this PR touches, and the gate reports the identical 11 on a worktree carrying none of these base-red fixes. Additions only (11 insertions, 0 deletions); the array stays sorted. This widens what the mutation run accounts for rather than relaxing anything. * chore(ci): re-measure accountFallback.ts file-size cap against the current base tip The entry frozen in this PR (1960) was the value at 36f8fd10; the base has since advanced to1cafd328cand the file is 1966 there, so check:file-size would still have been red on the merge commit. Re-measured to 1966. Same inherited drift the note already documents: check:file-size does not run on the PR->release fast path, so growth accrues unmeasured between release rebaselines. The other four entries still match the current tip (tokenHealthCheck 841, chat 1866, auth 2486, combo frozen 3642 >= 3640). --------- Co-authored-by: backryun <busan011@ormbiz.co.kr> * fix(translator): set status:completed on Responses input items to satisfy strict upstream validators (#8083) (#8507) Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(providers): expose base-URL override for Kimi/Moonshot CN-region keys (#7447) (#8500) CN-region Moonshot/Kimi API keys (issued on the domestic platform.kimi.com/moonshot.cn account) belong to a completely separate keyspace than the international platform.kimi.ai/api.moonshot.ai account, so OmniRoute's hard-coded international base URL rejects them with a generic "Invalid API key" 401. Neither "kimi" (legacy id) nor "moonshot" (current user-facing id) was in CONFIGURABLE_BASE_URL_PROVIDERS, so the Add-connection modal never rendered a base-URL field for them and there was no supported way to point a new connection at api.moonshot.cn. The underlying resolveBaseUrl()/buildUrl() primitives already honor a providerSpecificData.baseUrl override generically (same mechanism used by siliconflow, xiaomi-mimo, etc.) -- this only exposes that existing affordance for kimi/moonshot, defaulting to the unchanged international host so existing users see no behavior change. Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(providers): repoint zai-web executor to chat.z.ai v2 chat-completions endpoint (#8014) (#8503) Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(cli): fall back to node:sqlite when better-sqlite3 is unavailable in omniroute doctor (#7586) (#8501) bin/cli/sqlite.mjs::loadSqlite() had no fallback beyond better-sqlite3, unlike the real server's driver cascade (src/lib/db/adapters/driverFactory.ts::tryOpenSync, which tries bun:sqlite -> better-sqlite3 -> node:sqlite). On machines without a working better-sqlite3 native binary, every `omniroute doctor` DB check reported a false FAIL even when the actual server was healthy via its own driver cascade. openSqliteDatabase() now falls back to tryOpenSync() when better-sqlite3 fails to import, reusing the same already-tested cascade the real server uses instead of re-deriving a second one. Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(backend): compute AgentBridge diagnose DNS check per-agent instead of hard-coded Antigravity (#8466) (#8502) getMitmStatus() hard-wired dnsConfigured to a single Antigravity hostname regex regardless of which agent was being diagnosed, and the diagnose route never accepted an agentId to check against. Add checkDNSEntryForAgent() reusing resolveHostsForAgent()'s existing per-target host resolution, thread an optional agentId through getMitmStatus(), and have the diagnose route parse ?agentId= and pass it through. Callers that omit agentId keep the legacy Antigravity-only behavior unchanged. Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(api): probe provider alias in models.dev reverse capability lookup (#8429) (#8506) reverseModelsDevProviders() only matched MODELS_DEV_PROVIDER_MAP entries by the canonical OmniRoute provider id, but the map's RHS for the OAuth CLI providers (codex/claude) only lists their alias (cx/cc), never the canonical id itself. Since the models.dev sync job writes model_capabilities rows under openai/cx and anthropic/cc (never codex/claude), and the auto-combo gate canonicalizes a codex/... or claude/... target's provider to "codex"/"claude" before the lookup, the synced capability row was unreachable for those two providers. Also probe the provider's alias (via the already-imported PROVIDER_ID_TO_ALIAS) when scanning the map, so a canonical id like "codex"/"claude" still matches entries keyed only by their alias. Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(sse): stop stream readiness from treating a choices-less error frame as success (#7503) (#8504) Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(sse): stop combo's aggregated failure response from mixing fields across targets (#8486) (#8508) handleComboChat/handleRoundRobinCombo tracked lastStatus (first-write-wins), lastError (last-write-wins), and earliestRetryAfter (global MIN across all targets) independently, so the final unavailableResponse() could surface a status/message pair from two different failing targets and decorate a config-class error (e.g. Antigravity's 422 missing_project_id, which carries no retryAfter of its own) with an unrelated target's long reset window. - lastStatus now overwrites on every failure (last-write-wins), matching lastError, so status and message always come from the same target. - the "(reset after ...)" decoration is only applied when the surfaced status is itself rate-limit-class (429/503) — see the new open-sse/services/combo/unavailableRetryGate.ts leaf module (both combo.ts and chat.ts are already over their file-size baseline, so the gate logic lives in a new module and combo.ts only wires it in). Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * chore(deps): patch js-yaml + postcss for 2 high Dependabot alerts (#8572) js-yaml 5.2.1 -> 5.2.2 (GHSA-pm4m-ph32-ghv5, CWE-407: exponential parsing time in flow collections — a <200-byte payload hangs load()). postcss 8.5.14 -> 8.5.23 (GHSA-r28c-9q8g-f849, CWE-22: path traversal via auto-loaded sourceMappingURL discloses arbitrary .map files). Scoped override keeps promptfoo off its exact js-yaml@5.2.1 pin while holding @apidevtools/json-schema-ref-parser on js-yaml ^4.2.0, so the nested override does not major that subtree. Lockfile diff is exactly three versions (plus postcss's own nanoid); nothing added or removed. check:lockfile passes. Closes Dependabot #146 and #148. * chore(ci): resync stale no-explicit-any suppression count for proxy-registry.test.ts (#8544) * chore(ci): resync stale no-explicit-any suppression count for proxy-registry.test.ts tests/unit/proxy-registry.test.ts is frozen at 55 no-explicit-any violations but only has 54 since #8447 (d7f947586) removed one. ESLint fails the run with "There are suppressions left that do not occur anymore", making `npm run lint` exit 2 on release/v3.8.49 for every PR that branches off it. Same class as #8007 / #8490, different file: no code to fix here — the count simply drifted down, so this resyncs it via --prune-suppressions. Base-red inherited from release/v3.8.49; both the suppressions file and proxy-registry.test.ts are byte-identical to that branch. * docs(changelog): add fragment for this PR * test(sse): update three backoff assertions stale since the #8396 cooldown cap (#8539) These three cases assert that a transient-error cooldown keeps doubling to baseCooldownMs * 2^maxLevel — roughly 45.5h at the default constants. That is precisely the blackout #8396 removed: capScaledCooldownMs (open-sse/services/accountFallback/cooldownCap.ts) now bounds every scaled cooldown by profile.maxCooldownMs, falling back to BACKOFF_CONFIG.max when the profile does not configure one. All three call checkFallbackError with a null provider, so the fallback ceiling applies and the observed value is BACKOFF_CONFIG.max. The backoff-level clamping each case was written to guard is unchanged and still asserted; only the expected duration moved. The expressions keep the original formula wrapped in the cap so the relationship stays readable, and the first case gains a precondition assertion so it cannot silently become vacuous if the constants change. Fixes the error-classification (x2) and thundering-herd (x1) failures that are red on release/v3.8.49 at its own HEAD. * fix(db): classify compressionDetailNormalizers as db-internal in check-db-rules (#8534) * fix(db): classify compressionDetailNormalizers as db-internal in check-db-rules check:db-rules fails on release/v3.8.49 at its own HEAD: the module added by #8404 is neither re-exported from localDb.ts nor listed in INTENTIONALLY_INTERNAL, so the gate blocks every PR->release run and tests/unit/check-db-rules.test.ts fails its live-repo case. Its only importer is its sibling src/lib/db/compression.ts, via a relative import inside src/lib/db/ — the db-internal classification the list already uses for apiKeyColumnFallbacks and caseMapping. Re-exporting it from localDb.ts would instead advertise pure normalizer helpers as part of the compat surface, which Hard Rule #2 discourages. * test(db): mirror compressionDetailNormalizers in the INTENTIONALLY_INTERNAL audit The classification guard asserts the exact audited set. Adding the module to check-db-rules.mjs without the mirror left the exact-list/exact-size assertion red; both assertions stay exact (37 entries). Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * test(sse): register #8396 and #8376 unit tests in stryker tap.testFiles (#8538) * test(sse): register #8396 and #8376 unit tests in stryker tap.testFiles check:mutation-test-coverage fails on release/v3.8.49 at its own HEAD: two unit tests cover mutated modules but are absent from tap.testFiles, so their mutant kills do not count and the drift gate blocks every PR->release run. - tests/unit/8396-cooldown-429-cap.test.ts covers open-sse/services/accountFallback.ts (imports checkFallbackError) - tests/unit/8376-econnrefused-breaker.test.ts covers open-sse/services/combo/comboPredicates.ts (imports shouldRecordProviderBreakerFailure) Both inserted in the array's existing sorted position; no other key touched. * test(sse): register repro-7503-no-choices in stryker tap.testFiles * chore(quality): rebaseline file-size for inherited base growth (#8561) check:file-size fails on the pristine release/v3.8.49 tip (30709255), which takes the whole Fast Quality Gates job down for every PR against the branch. Both offenders grew after the last rebaseline (_rebaseline_2026_07_25_v3849_basered_filesize, measured at36f8fd10) and both came from already-merged PRs, so there is no offending branch left to fix: src/lib/tokenHealthCheck.ts 841 -> 843 (#8426,4528fc455) src/app/(dashboard)/dashboard/providers/page.tsx 1927 -> 1990 (#8349,58ab8b1d2) Trust-but-verify: both values measured on the pristine tip with an empty working tree. Same situation and remedy as the entry cited above and as _rebaseline_2026_07_02_5798_release_green. This commit is deliberately last and self-contained: drop it if the captain would rather move the frozen values separately. Structural reduction of the 1990-line providers page is not attempted here. Co-authored-by: alexey.nazarov@softmg.ru <alexey.nazarov@softmg.ru> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * chore(quality): rebaseline complexity/cognitive to v3.8.49 tip drift * chore(quality): rebaseline complexity/cognitive for v3.8.49 merge-train own-growth * fix(resilience): honor comboCooldownWait for every combo strategy (#8541) (#8559) * fix(resilience): honor comboCooldownWait for every combo strategy The cooldown-wait path claimed all strategies, but isComboCooldownWaitEligible still gated on quota-share/auto. Widen the gate, raise the per-target timeout floor with it, and consult the allow-list from earliestRetryAfter so a later 403 cannot skip the decision. Fixes #8541. * test(combo): fold cooldown-wait strategy assertions into a loop Keep combo-config.test.ts under the file-size ceiling while covering every routing strategy (including internal quota-share) for the #8541 gate fix. * chore(combo): trim cooldown-wait comment under file-size ceiling After rebase onto tip the net +2 in combo.ts sat one line over the frozen check:file-size count (split-based); fold the SECURITY note into the block. * refactor(sse): stop three executors shadowing BaseExecutor.buildHeaders (#8498) `BaseExecutor.buildHeaders(credentials, stream?, clientHeaders?, model?, health?)` was shadowed in three executors by same-named helpers with unrelated signatures: hailuo-web private buildHeaders(token: string, yy: string) lmarena protected buildHeaders(_model: string, credentials: unknown, _body: unknown) qwen-web private buildHeaders(token: string, cookieHeader: string, chatId?: string) Name collisions, not overrides — each reported TS2416. They are renamed to `buildStreamHeaders` / `buildRequestHeaders` / `buildApiHeaders`; the two lmarena test files that called the helper directly are updated with them. Worth stating precisely, because the shadow sat on a live dispatch path without being a live bug: `BaseExecutor.countTokens()` calls `this.buildHeaders(credentials, false)`, and all three inherit `countTokens()`. It is unreachable today only because `buildCountTokensUrl()` returns null unless `config.format === "claude"` and the URL carries `/messages` — hailuo-web and qwen-web set no format, lmarena sets `"openai"` — so `countTokens()` returns at the guard above. Latent, not live; one `format` change away from passing a credentials object where a token string is expected. Two more, surfaced by clearing the above: * `lmarena` declared `buildUrl` and `transformRequest` `protected` while both are public on BaseExecutor (TS2415 — a subclass may widen visibility, never narrow it). Both were masked behind the buildHeaders TS2416 and appeared one at a time as it cleared. Runtime is unaffected; JavaScript has no member visibility. * `GithubExecutor.refreshCredentials` had no declared return type, so TypeScript inferred the union of its four literal returns. `GheCopilotExecutor` legitimately overrides it with a wider `providerSpecificData` (it also records the enterprise proxy URL) and no `expiresIn`, which is not assignable to that inferred union. Declared as `RefreshedCopilotCredentials | null` — same shape of fix as #8489, on a different method. Validation: full tsc error-set diff against the base config — 335 -> 331, zero new errors (line-number-agnostic). `typecheck:core` clean; the 15 existing test files importing a touched executor pass, including lmarena's 44 across the two updated files. `plan3-p0.test.ts` fails identically with and without this change (it reads the developer's real ~/.omniroute DB rather than a test-scoped DATA_DIR). The new test pins that the inherited method is no longer shadowed — verified to fail on the base, where all three prototypes still carry their own `buildHeaders` — and that the `countTokens()` early return which kept it harmless still holds. * refactor(sse): narrow three result unions via type predicates (#8499) * refactor(sse): narrow three result unions via type predicates Eight diagnostics across three executors, all the same root cause already recorded in #8483: this workspace compiles with `strictNullChecks: false`, where a boolean-literal discriminant narrows the positive branch but not the negative one. Reading a failure-only field after `!result.ok` therefore leaves the full union. auggie.ts 2 .error on AuggieModelResolution muse-spark-web 4 .error on GraphqlResult notion-web 2 .retryable / .errorResult on the runOnce union #8483 retagged its union with a string discriminant. That is the better shape when the union is module-private and small, but it does not fit here: `resolveAuggieModel` is exported and its tests deep-equal the literal `{ ok: true, model }` object, so retagging would churn public API and assertions to fix a checker limitation. Each union instead gets an explicit type predicate, which narrows correctly under these compiler settings while leaving the shape, every call site, and the tests untouched. notion-web's inline union is named `NotionAttempt` first so it has something to `Extract` from. Validation: full tsc error-set diff against the base config — 335 -> 327, zero new errors (line-number-agnostic). `typecheck:core` clean; the 6 existing test files importing a touched executor pass. Coverage: each predicate is a one-liner whose control flow inverts on a stray `!`, and all three failure branches already have behavioral guards — `auggie-executor.test.ts` (400 + /Unknown Auggie model/), `muse-spark-web-continuation.test.ts` ("Warmup failed: …"), and `executor-notion-web.test.ts` (nested temporarily-unavailable → retried). The two assertions added here pin the arm that the predicate unlocks on the one union that is exported and directly reachable. * chore(quality): rebaseline muse-spark-web.ts for #8499 own growth The new isGraphqlFailure() type-predicate helper (TS7 strictNullChecks:false narrowing fix) grows the frozen file 1396->1405 (+9), irreducible per the justification recorded in config/quality/file-size-baseline.json. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * refactor(sse): restore three executor types the runtime already relied on (#8520) Three independent root causes in the TS 7 executor slice (#8484), each a declaration that had drifted behind the code using it. All type-only — no behavior change, verified by running the new tests against the parent commit's sources (7/7 pass there too). mimocode — AccountState was missing `proxy`, but syncAccountsFromCredentials() writes it on every account and getProxyDispatcher() reads it. The #3837/#5521 contract ("always present, null when unconfigured") lived only in a comment. Declared as AccountProxyConfig["proxy"] so the two stay in lockstep. (4) opencode — the tools-truncation block narrowed `modifiedBody` with `typeof === "object"` but, unlike the client_metadata block directly above it, omitted `!Array.isArray()` and the Record cast, so `.tools` was unreachable on `object`. Adopted the neighbouring block's idiom. Behavior is identical: the old code reached `.tools` on arrays too and relied on Array.isArray(undefined) short-circuiting. (4) zed-hosted — enqueueSseObject/finish/processLine were annotated ReadableStreamDefaultController but are driven from a TransformStream, whose controller has no close(). All three only ever enqueue, so they are now typed by that single capability (SseEnqueueTarget). (3) 310 -> 299 diagnostics, zero new, on a line-number-agnostic diff of the full tsc error set. Tests: new tests/unit/ts7-executor-shared-shapes.test.ts pins the tools truncation (previously uncovered) and the proxy-always-present contract. The zed-hosted transform is already covered end-to-end by zed-hosted-think-close-marker.test.ts. 300/300 across the 26 affected files. Co-authored-by: backryun <busan011@ormbiz.co.kr> * refactor(guardrails): narrow the documented void return at the dispatch site (#8525) `BaseGuardrail.preCall`/`postCall` return `GuardrailResult<unknown> | void`, and that `| void` is deliberate: docs/security/GUARDRAILS.md documents returning nothing as one of the three "no change" signals, and CredentialMaskerGuardrail still declares it. So the union stays. The problem is the consumption site. `registry.ts` reads `result?.block`, `result?.message`, `result?.meta`, `result?.modifiedPayload` — but optional chaining does not make `void` inspectable, and neither does a truthiness test. That is all 12 TS2339s in the file: one union, six property reads, two dispatch loops. Fixed by funnelling the return through `unknown` once, in a local `asGuardrailResult()` helper, so the loops work against a plain `GuardrailResult | undefined`. The public contract is untouched — no signature narrowed, no guardrail changed, callers outside this file unaffected. 280 -> 268, zero new, on a line-number-agnostic diff of the full tsc error set. Tests: the `void` arm of the documented contract had NO coverage — guardrails-registry.test.ts exercises guardrails that return a result and one that throws, never one that returns nothing. Added guardrails-void-no-change-contract.test.ts (4 tests): silent preCall/postCall pass through untouched and are recorded as ran-not-skipped-not-errored; returning `{}` produces an identical execution record; a silent guardrail does not stop a later one from modifying. They pass against the parent commit's registry.ts too, which is the evidence for no behavior change. 75/75 across the 13 guardrail suites. Co-authored-by: backryun <busan011@ormbiz.co.kr> * refactor(sse): type the rerank response adapter's options parameter (#8528) `transformResponseFromProvider(providerConfig, data, options = {})` annotated nothing, so TS inferred `options` as `{}` from its default value and rejected every read of it: `top_n` x6, `documents` x4, `return_documents` x2 across the DeepInfra and Voyage adapters. All 12 of the file's diagnostics, one cause. Declared `RerankResponseOptions` from the JSDoc that already documents these fields on handleRerank, with `documents` as `Array<string | { text?: string }>` — the two forms the Cohere-compatible API accepts and the adapters already branch on. `providerConfig` and `data` stay unannotated; only `options` was producing errors and only `options` is touched. 280 -> 268, zero new, on a line-number-agnostic diff of the full tsc error set. Tests: `{ text }` documents were only ever exercised through the *request* adapter (#5332, #7809) — every response-adapter test passed plain strings, so the `typeof doc === "string" ? doc : doc?.text` branch on the response side was uncovered, and that branch is exactly what gives the declared type its union. Added rerank-object-documents-response-path.test.ts (5 tests): object-form documents resolved through both adapters, a mixed string/object array, the `{}`-without-text fallback, and Voyage's index remap across an empty `{ text: "" }` document. They pass against the parent commit's rerank.ts too — no behavior change. 43/43 across the 6 rerank/media-cost suites. Co-authored-by: backryun <busan011@ormbiz.co.kr> * refactor(sse): retag the designer-web result unions with string discriminants (#8531) All 10 diagnostics in this file are the `strictNullChecks: false` narrowing limitation: a boolean-literal discriminant narrows the positive branch but leaves the negative one as the full union, so `if (!resolved.ok)` and the code after `if (outcome.success)` could not see `status`/`error`. Three unions, all module-private and untouched by any test, so per the rule recorded on #8499 these are retagged rather than fixed with predicates — predicates are for exported unions whose shape callers depend on: resolveDesignerWebRequest ok: true|false -> state: "resolved"|"invalid" DesignerWebStepResult done + success -> state: "pending"|"ready"|"failed" The step union collapsed two booleans into one discriminant; `done`/`success` encoded three states across two flags, which is also why the pending arm had no `success` property for `outcome.success` to read. Also narrowed runDesignerWebPollLoop's declared return from `DesignerWebStepResult | {…504…}` to a new DesignerWebOutcome (ready | failed). The loop returns a step only after confirming it is terminal, and otherwise synthesizes a 504 — it can never return a pending step, and the old signature claiming it could is what made `.success` unreadable on the union at all. 280 -> 270, zero new, on a line-number-agnostic diff of the full tsc error set. Tests: unlike the previous slices this rewrote real control flow (three conditionals), so the existing suite is doing actual work here — microsoft-designer-web-6672.test.ts drives the handler end-to-end through 400, 401, immediate-ready, poll-then-ready, non-OK upstream and 504-timeout, i.e. every arm but one. The "empty" arm (unrecognized 200 body -> terminal 502) was tested only at the parser level, never through the handler, so the 502 itself was unasserted. Added designer-web-empty-response-502.test.ts (2 tests) pinning that it is terminal (exactly one fetch, no polling) and distinct from the 504 deadline path. Both suites pass against the parent commit too — the tests are black-box through the exported handler, so they are agnostic to the discriminant rename and prove the retag is behavior-preserving. 61/61 across the 3 suites. Co-authored-by: backryun <busan011@ormbiz.co.kr> * refactor(sse): declare the multipart/gRPC frame bodies as ArrayBuffer-backed (#8533) * refactor(sse): declare the multipart/gRPC frame bodies as ArrayBuffer-backed Seven TS2769 across three files, one root cause: a bare `Uint8Array` widens to `Uint8Array<ArrayBufferLike>`, which admits `SharedArrayBuffer` and so is not assignable to `BodyInit`. Every one of the seven is a `fetch({ body })` call rejecting an otherwise-valid payload. They flow from exactly two producers: buildMultipartBody() audioTranscription.ts -> 5 sites here + 1 in audioTranslation.ts grpcWebFrame() windsurf.ts -> 1 site Both allocate with `new Uint8Array(length)`, which is always ArrayBuffer-backed, so declaring `Uint8Array<ArrayBuffer>` states what the code already guarantees. This is a narrowing of the declaration to match reality, not a cast at the call sites — no `as BodyInit` anywhere, and the seven call sites are untouched. 280 -> 273, zero new, on a line-number-agnostic diff of the full tsc error set. The runtime diff is two return-type annotations; nothing executable changed. Tests: buildMultipartBody already has four direct tests, but they assert the payload's *contents* (boundary, filename sanitization, MIME fallback) — none assert the backing, which is precisely what the new type guarantees and what a plausible switch to a pooled `Buffer.concat` would break. Added multipart-body-arraybuffer-backing.test.ts (3 tests): the buffer is a plain ArrayBuffer, the view spans it entirely at offset 0 (no pool remainder), and both hold for a 64 KiB payload past Node's Buffer-pool threshold. 258/258 across the 17 affected audio/windsurf suites. Not included: the 3 remaining TS2339 in audioTranscription.ts (`data?.data?.…` on an untyped poll result). Different root cause — grouped by kind, not by file, per #8484. * chore(quality): trim the buildMultipartBody doc so audioTranscription.ts stays under the 800 cap My doc comment on buildMultipartBody added 9 lines to a file with 8 to spare (792 -> 801 as check:file-size counts, cap 800), so this PR was failing the gate on growth I introduced. Condensed the comment to 4 lines; the file lands at 796. Rebuilt on top of the /green-prs sync merge (9973bf3bf) rather than force-pushing my own rebase over it — the release-tip sync there is @ikelvingo's work and had already been validated against this branch. Delta unchanged: 280 -> 273, 7 fixed, zero new. 68/68 on the audio/windsurf suites; typecheck:core and eslint clean; check:file-size now OK. --------- Co-authored-by: backryun <busan011@ormbiz.co.kr> Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * refactor(sse): stop isClaudeEventPayload claiming a narrowing it never performs (#8557) Eight TS2339s in stream.ts read properties off `never`. `never` here did not mean unreachable code — it meant a type predicate was lying. function isClaudeEventPayload(payload: unknown): payload is JsonRecord ... const flushedParsed = bufferedPayload as JsonRecord; const isClaude = isClaudeEventPayload(flushedParsed); } else if (!isClaude) { // JsonRecord minus JsonRecord = never The predicate answers "does this payload carry a Claude event type?" — a question about contents, not type. A Claude event and a non-Claude one are both JsonRecord, so `payload is JsonRecord` narrows nothing; applied to an argument already typed JsonRecord it collapsed the negative branch to `never`, taking `.id` and `.choices` with it. Changed the return type to `boolean`. No call site depended on the narrowing: both other callers pass the value to updateClaudeEmptyResponseLifecycle(), whose parameter is `unknown`, and passthroughTailProcessor.ts already declares this function as `(payload: unknown) => boolean` — so this aligns the definition with how the codebase already consumes it. 280 -> 272, zero new, on a line-number-agnostic diff of the full tsc error set. The diff is one line, and a type predicate has no runtime representation, so the emitted JavaScript is unchanged. No test added, and no gap to fill: the `never`-typed branch is real, reachable and already covered from both sides — stream-numeric-ids.test.ts exercises "normalizes numeric id in final chunk without trailing newline" (the flush path with a non-Claude payload, i.e. the branch TS believed impossible) and "Claude passthrough does not normalize numeric ids" (the other arm). 338/338 across the 48 SSE/passthrough suites. No explanatory comment either: stream.ts sits exactly at its frozen file-size cap (2887), so a single added line fails check:file-size. The reasoning lives here and in the PR rather than costing a baseline bump on a frozen file. Co-authored-by: backryun <busan011@ormbiz.co.kr> * fix(devin-cli): update ACP JSON-RPC protocol for Devin CLI 3000.2.x (Fixes #8406) (#8425) * fix(executors): fix ACP protocol wire format for devin cli * test(sse): replace no-explicit-any with AcpFrame type in devin-cli ACP test no-explicit-any is a hard error in tests/; type the parsed JSON-RPC frames with a local AcpFrame shape instead of (f: any) callbacks, and apply prettier formatting to the same file. --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(dashboard): clear file-size base-red by extracting provider-card highlight wiring (#8524) * chore(auth): condense #8407 note in tokenHealthCheck to fit frozen file-size baseline The 3-line comment added by #8426 pushed tokenHealthCheck.ts to 843 LOC, 2 over its frozen baseline of 841 (base-red on release/v3.8.49). Fold the devin-cli rationale into one line — same meaning, gate green again. * refactor(dashboard): extract provider card highlight into HighlightableProviderCard #8349 left the back-navigation highlight concern inline in providers/page.tsx (state + two callbacks + onCardClick/ref props repeated at 18 card call sites), pushing the page to 1990 LOC over its frozen baseline of 1927. Move the concern into a HighlightableProviderCard wrapper: each card instance keeps its own copy of the highlighted id and only the card whose provider id matches scrolls into view and highlights — same semantics as the single page-level state, since resolveHighlightedCard already gates on the id match. page.tsx drops to 1917 LOC (under the frozen baseline, no rebaseline needed). * test(dashboard): cover HighlightableProviderCard wiring Direct coverage for the wrapper extracted in the previous refactor: mount-time scroll+highlight only when history.state.providerId matches, no reaction on mismatch/null state, isolation across multiple card instances, and click-time navigation recording via history.replaceState. Note: the jsdom scrollIntoView shim is a plain no-op rather than a vi.fn() — vi.restoreAllMocks() would otherwise restore the shared mock and let the next test's spy inherit its accumulated call count. * chore(usage): decompose services/usage.ts into per-provider usage/* leaves (999 → 253) (#8545) * chore(usage): extract crof, nanogpt, qoder, opencode, deepseek, bailian, vertex, xiaomi-mimo, xai, github usage fetchers into usage/* leaves Decompose services/usage.ts (god-file phase 1): move the remaining per-provider usage fetcher/parser logic into co-located leaves under open-sse/services/usage/ so usage.ts becomes a thin dispatcher (imports + USAGE_FETCHER_PROVIDERS + getUsageForProvider switch + __testing re-exports). New leaves (each a pure data transform or independent fetcher, no orchestration): - usage/github.ts getGitHubUsage, formatGitHubQuotaSnapshot, inferGitHubPlanName, shouldDisplayGitHubQuota - usage/crof.ts getCrofUsage - usage/nanogpt.ts getNanoGptUsage - usage/qoder.ts getQoderUsage, parseQoderUserStatusUsage - usage/opencode.ts getOpencodeUsage - usage/deepseek.ts getDeepseekUsage - usage/bailian.ts getBailianCodingPlanUsage - usage/vertex.ts getVertexUsage - usage/xiaomi-mimo.ts getXiaomiMimoUsage - usage/xai.ts getXaiUsage usage.ts re-exports parseQoderUserStatusUsage (named) and threads every helper the existing __testing contract exposes (usage-utils / usage-service-hardening / qoder-usage-quota / xiaomi-mimo-selftrack / xai-usage / vertex-spend suites read them from services/usage). External importers unchanged. open-sse/services/usage.ts: 1065 -> 256 lines (cap 800). npm run check:file-size: OK. typecheck:core: OK. eslint: clean. check:cycles: OK. Added characterization tests (tests/unit/usage-<provider>-split.test.ts) that import each leaf directly and pin its export surface + key edges, mirroring the existing usage-quota-core-split / usage-scalars-split pattern. * docs(changelog): add fragment for this PR * chore(validation): decompose providers/validation.ts into validation/* leaves (→ 442) (#8546) * chore(validation): extract web-cookie, kiro, specialty-inline validators into validation/* leaves * docs(changelog): add fragment for this PR * chore(token-refresh): decompose services/tokenRefresh.ts into tokenRefresh/* leaves (999 → 724) (#8547) * chore(token-refresh): extract rotation/cas/circuit-breaker refresh logic into tokenRefresh/* leaves * test(oauth): follow isUnrecoverableRefreshError to tokenRefresh/shared.ts cad2c7285 moved isUnrecoverableRefreshError out of tokenRefresh.ts into tokenRefresh/shared.ts. This suite asserts on source *text* (it regex-matches the function body to prove the unrecoverable sentinel is returned), so the move made it fail to find the definition — the only red test across the 23 tokenRefresh-related suites. Repoint the read() at the file that now defines the body. The public surface is unchanged: tokenRefresh.ts still re-exports the symbol, verified by import. * docs(changelog): add fragment for this PR * docs(auth): correct the #7338 attribution wording in the tokenRefresh header The header claimed credit for KooshaPari's #7338 was "preserved via co-authorship on the extraction commits", but none of the commits carries a Co-authored-by trailer -- and adding one would be inaccurate, since this is an independent implementation against the current tip rather than a reuse of that diff. The by-name credit for proposing the split stays; only the false claim about the mechanism is removed. * chore(combo): extract pure error predicates and quota status helpers to comboPredicates (#8548) * fix(sse): shallow per-target copy for the combo attempt body (#7847) (#8553) * fix(sse): shallow per-target copy for the combo attempt body (#7847) combo.ts deep-cloned the request body for every target. On a 3.05 MiB agent request that is 9.53 MiB at 3 targets, and it scales linearly: 3 targets 9.53 MiB (3.12x wire) -> ~0.001 MiB 5 targets 15.89 MiB (5.19x wire) -> ~0.000 MiB 10 targets 31.78 MiB (10.39x wire) -> ~0.001 MiB The isolation it bought only ever needed to contain TOP-LEVEL SCALAR writes. The full mutation surface on this path is two assignments: combo.ts bodyRecord.max_tokens = ... (reasoning buffer) chatCore.ts body.model = model (Background Task Redirection T41) Nothing mutates the nested payload; applyCompression and injectUniversalHandoffBody both return new objects (verified empirically -- neither touches its input, and both tolerate a frozen one). So a fresh top-level object per target gives identical isolation while sharing the expensive messages/tools arrays. Also fixes a REAL cross-target leak in handleRoundRobinCombo. It already used a shallow copy, but took it only when the reasoning buffer actually changed max_tokens -- every other attempt shared the caller's object outright. The new test reproduces it on the unmodified code: target 2 received model "mutated-by-openai/gpt-4o-mini". In production that is a Background Task Redirection on one round-robin target rewriting body.model for the next. The copy is now unconditional. The invariant is pinned by tests rather than by a comment listing mutation sites, so the clone strategy can change again without anyone re-deriving them by hand: - a target's in-place write must not leak into the next (priority / fill-first / round-robin; the stub reproduces chatCore's body.model write) - the caller's body is never mutated - the per-target copy stays shallow (targets share one messages array) - freeze probe: combo's own body handling performs no in-place writes * test(sse): register the combo attempt-body isolation test in stryker tap.testFiles The new test resets the circuit breaker in beforeEach, so it counts as a covering test for src/shared/utils/circuitBreaker.ts. Without registering it, check:mutation-test-coverage --strict reported a 4th drift entry that was not there on the pristine tip -- new drift introduced by this PR. Registered in sorted position; the gate is back to the 3 pre-existing entries (accountFallback.ts, error.ts, comboPredicates.ts) that #8538 addresses. * fix(sse): estimate tokens from the object and count JSON length without building it (#7847) (#8558) Two changes with one root cause: several hot paths built a full JSON string only to read its .length, and one of them silently changed the answer. 1. CORRECTNESS -- combo's fallback-compression trigger estimateTokens(JSON.stringify(attemptBody)) took the STRING branch of estimateTokens, which is ceil(length / CHARS_PER_TOKEN) over the raw JSON. An inline base64 image is then charged as if every character of the data URL were prose. Measured on a 200 KB inline image: via string (before) 50,039 tokens via object (after) 1,231 tokens a 40x over-count, tripping fallback compression on requests nowhere near the context window. This is the same class #8368/#8401 fixed on the request path; the combo call site was missed. Passing the object routes through extractImageTokens, which charges images structurally. Text-only bodies are unaffected -- verified identical, and pinned by a test. 2. ALLOCATION -- jsonLength() Adds an exact serialized-length walker: same O(n) scan, no string. Used by estimateTokens' object branch and by streamReadinessPolicy (which runs on every streaming request and only ever used .length). Exactness matters because every consumer feeds a threshold, so this is property-tested against JSON.stringify over 4000 generated structures covering escaping, lone surrogates, omitted values, non-finite numbers, toJSON, Date, Map, cycles and BigInt. Anything outside the plain-JSON subset falls back to JSON.stringify for THAT SUBTREE only, so an exotic leaf never forces the message history back onto the allocating path. Honest scoping of the memory win: the string was always transient, and V8 collects it efficiently, so this is not 3 MiB of retained heap. Measured allocation churn over 20 calls on a 3.06 MiB body: 3.1 MiB -> 0.5 MiB, about 6x less. The #8549 benchmark row for this mechanism measures a HELD string and therefore overstates it; the correctness fix above is the larger deliverable here. * chore(perf): add deterministic request-body heap benchmark (#7847) (#8549) #7847 reports a 3.05 MiB request (729 messages / 86 tools) reaching ~12,282 MiB of V8 heap, and asks for "a regression benchmark that records peak heap for representative 500-800-message, tool-rich requests" before any fix lands. There is currently no memory baseline in the repo at all (bench:compression is the only benchmark), so a clone-reduction change could neither be justified nor regression-guarded. npm run bench:heap-body attributes retained heap to each copy the chat path makes: | mechanism | call site | retained | x wire | | cloneLogPayload (unbounded) | chat.ts buildClientRawRequest | 3.18 MiB | 1.04x | | cloneBoundedForLog (bounded) | requestLogger.logClientRawRequest | 0.04 MiB | 0.01x | | structuredClone x3 (combo targets) | combo.ts attemptBody | 9.53 MiB | 3.12x | | JSON.stringify (token estimate) | combo.ts estimateTokens | 3.06 MiB | 1.00x | | per request (sum) | |15.81 MiB | 5.17x | It measures the real production helpers rather than reimplementations, so a change to the log bounds or the clone strategy is reflected directly. Design notes: - Deterministic: fixed-seed LCG, no Math.random(). Verified byte-identical across three consecutive runs — without that, a before/after delta measures noise, not the change. - Corpus lives in its own side-effect-free module so the unit test can import it without booting SQLite (requestLogger transitively opens the DB at import time). - Hermetic: DATA_DIR is redirected to a temp dir before importing, so the benchmark never touches the operator's real ~/.omniroute store. - Node, not bun: --expose-gc and V8 heap accounting are the measurement; another engine's heap number would not describe the production runtime. - --max-retained-mib exits non-zero, so this can become a CI gate once a target is agreed. Reports only; wires nothing into CI and changes no production code. * fix(backend): bound the client raw request snapshot instead of deep-cloning the body (#7847) (#8550) buildClientRawRequest deep-cloned the ENTIRE request body on every chat request, unbounded. On the #7847 incident payload (3.05 MiB, 729 messages, 86 tools) that retains 3.19 MiB per request, and it is pure waste: every consumer of clientRawRequest.body is observability and none of them keeps the full payload. chatCore.ts -> reqLogger.logClientRawRequest no-op when the logger is disabled, otherwise re-clones via cloneBoundedForLog (0.08 MiB) chatCore.ts -> trackPendingRequest clientRequest, surfaced by /api/logs/[id] chat.ts -> recordRejectedRequestUsage requestBody None feeds dispatch, translation or the upstream request, so the snapshot is now taken with cloneBoundedForLog: 3.19 MiB -> 0.08 MiB, a 41x reduction, and retention no longer scales with history length. It stays a clone rather than an alias because body is rewritten downstream (plugin onRequest hook, compression) and the log must show what the client actually sent. Bounding at the entry means the logger re-bounds an already-bounded value, which exposed that cloneBoundedForLog was NOT idempotent -- each container exceeded its own bound once the marker was added, so a second pass truncated again: arrays [marker, ...24 items] is 25 entries > 24, so the marker and one real item were dropped and originalLength was rewritten as 25 instead of the true 729 objects 80 keys + _omniroute_truncated_keys is 81 > 80, so a real key was evicted to make room for the marker and the dropped count was reported as 1 instead of 20 strings the marker was appended AFTER slicing to maxLength, so the bounded string was longer than the bound Without this the persisted log payload would have changed shape versus before the fix. All three now keep the marker inside the budget and treat an already-bounded value as final; verified end to end -- the marker still reports originalLength 729. TDD: tests/unit/repro-7847-bound-client-raw-request.test.ts was written first and failed on three assertions (unbounded retention, retention scaling with history, and the idempotence precondition) before either change. * chore(i18n): normalize zh-TW terminology and sync stale README figures (#8554) The zh-TW catalog was machine-translated with mainland-habit vocabulary and simplified->traditional conversions that picked the wrong homophone, and its README still advertised the v3.7-era figures. Terminology (docs/i18n/zh-TW/ + src/i18n/messages/zh-TW.json): - wrong-character conversions: 上遊->上游, 後臺->後台, 儀錶板->儀表板 - mainland habits: 默認->預設, 緩存->快取, 模塊->模組, 調用->呼叫, 字符串->字串, 全局->全域, 文檔->文件, 響應->回應 - consistency: 供應商/提供商->提供者 (提供者 was already 71% dominant), 型別->類型 for UI labels, 不活躍->未啟用 README figures synced to the English source: 231->290 providers, 17->19 routing strategies, 1.6B->1.53B free tokens, 50+->90+ free tiers, 11->40+ free forever, 87->104 MCP tools, 30->31 scopes. Root cause — the generator's post-translation pass was a hardcoded list that duplicated the glossary and was wired only into the deprecated generate-multilang.mjs, so the active run-translation.mjs pipeline applied nothing. Worse, its blanket /代碼/g -> 程式碼 rule would corrupt 控制代碼 (handle), 語系代碼 (locale code) and 錯誤代碼 (error code) on the next regeneration. Both scripts and the drift gate now share scripts/i18n/glossary-normalize.mjs, driven by scripts/i18n/glossary/<locale>.json as the single source of truth. Ambiguous terms carry blockedPrefixes so 型別->類型 can stay enforced without mangling 模型別名 (model alias) or 基本型別 (a programming data type); terms whose synonym is also a legitimate rendering elsewhere (代碼, 項目) are seeded with no synonyms and documented instead of blanket-rewritten. CI now runs the glossary gate for zh-TW alongside zh-CN. * fix(providers): persist runtime-discovered Antigravity projectId to the connection (#8491) (#8562) Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(api): warn (never reject) when a combo name shadows a real model id (#8530) (#8563) POST /api/combos and PUT /api/combos/[id] had zero validation or observability when a combo name collided with a real model id, and sseModelService.getComboForModel() always resolves the combo first. That combo-first precedence is not a bug: #6940 documents a combo named after a bare model id (e.g. `gpt-5.5`) as the supported mechanism for per-model provider fallback, reusing the #3227/#3233 machinery and covered by tests/unit/responses-combo-resolution-3227.test.ts and tests/unit/combo-name-codex-responses-rewrite.test.ts. Hard-rejecting a colliding name (as #8530's literal acceptance criteria requested) would regress that documented workflow. Instead, both routes now attach a non-blocking `warning` field (`COMBO_NAME_SHADOWS_MODEL`) to the create/rename response when the name collides with a real model id, and a new boot-time scan (scanComboModelNameCollisionsAtBoot in src/instrumentation-node.ts) logs a startup warning enumerating existing collisions — so an operator who hits this by accident has a signal, while the #6940-sanctioned pattern keeps working exactly as before. New tests/unit/combo-model-name-collision-8530.test.ts proves both: the sanctioned shapes (create/rename to a colliding name) still return 201/200 with the warning attached, and non-colliding names get no warning field at all. Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(api): expose responses-format models on all VS Code Ollama listing routes (#7587) (#8564) isUsableChatModel() was copy-pasted into 5 vscode listing routes. PR #7012 widened only models/route.ts to accept api_format "responses"/"openai-responses" alongside "chat-completions"; the other 4 copies (token+raw api/tags and api/show) still rejected anything that wasn't literally "chat-completions", silently dropping Codex-discovery-synced GPT models (apiFormat "responses") from the Ollama-compatible /api/tags endpoint VS Code's "Ollama" provider import flow actually calls. Extracted the predicate into a single shared module (vscode/[token]/usableChatModel.ts) imported by all 5 routes so this one-fixed-four-left-behind drift cannot recur. Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(hyperagent): default 1M context for fable/opus/sonnet (#8496) * fix(hyperagent): default 1M context for fable/opus/sonnet HyperAgent Claude-family models (fable, opus, sonnet) were falling through getTokenLimit to the generic 128k default. Agentic tool-loop prompts with large catalogs then failed with context_length_exceeded (~137k tokens). - defaultContextLength + per-model contextLength = 1_000_000 on hyperagent registry - DEFAULT_LIMITS.hyperagent / ha = 1M - Resolve hyperagent/ha (and fable/opus wire ids) before models.dev DB fallback Verified: getTokenLimit('hyperagent','fable-latest') === 1000000; context-manager tests 30/30. * fix(sse): scope hyperagent 1M context fix to the registry, drop unscoped model-name match The step-1b branch in resolveTokenLimit() matched fable/opus/sonnet model name substrings for ANY provider, before the models.dev DB lookup. That collided with anthropic/claude, kiro, windsurf and bluesminds registries, which serve the same Claude model ids (e.g. claude-opus-4.7-max, claude-sonnet-5) with their own accurate per-model contextLength — those were being clobbered to 1M instead of their real (often 200k) limit. The registry-level defaultContextLength added on the hyperagent provider entry already fixes the reported bug (getTokenLimit('hyperagent', ...) === 1_000_000) on its own, scoped correctly by provider. Remove the redundant, unscoped substring branch and add regression coverage for every hyperagent fallback model id plus the cross-provider collision. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up #8006) (#8510) * feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up #8006) Upload source images to Firefly storage (POST /v2/storage/image) and attach them as referenceBlobs on generate-async, matching live firefly.adobe.com captures (usage:general for nano multi-ref; usage:subject for gpt-image). Also wire built-in adobe-firefly through OpenAI-compatible POST /v1/images/edits (multipart or JSON data URLs, up to 4 refs) so Media edit-with-references and Open WebUI image-edit hit the same path as image2image generate. Unit suite: tests/unit/adobe-firefly.test.ts 41/41. * test(api): add route-level coverage for Adobe Firefly /v1/images/edits + fix typecheck/file-size drift Covers the referenceBlobs upload path, the 4-reference cap error, and the credentials/rate-limit branches added to the /v1/images/edits route for adobe-firefly (#8510). Also fixes a Buffer/BodyInit typecheck mismatch in uploadAdobeFireflyImage and corrects the adobeFireflyClient.ts file-size baseline entry to match the gate's actual LOC count (it counts the trailing newline, so the frozen value is 2317, not 2316), plus a testFrozen entry for adobe-firefly.test.ts's own +159 line growth from this PR. Moves the handleAdobeFireflyImageGeneration re-export out of the middle of the import block in imageGeneration.ts for readability. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(security): restore bounded JWT regex quantifiers dropped by edit-route refactor The edits-route extraction (test commit62785e972f) had accidentally reverted 4 JWT-extraction regexes in adobeFireflyClient.ts from the bounded {1,4096} quantifier back to unbounded +, undoing the ReDoS fix from #8173 (CodeQL #754/#755/#756). Restored the bounded quantifiers; behavior is unchanged (45/45 adobe-firefly tests still pass), only the backtracking bound is back in place. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * fix(notion-web): mint fresh thread for new OpenAI sessions with same opener (#8511) Sticky root keys keyed only on the first user message caused Claude Code "New session" + "hi" to reuse a confirmed prior Notion thread (forking history). Prefer exact conversation-prefix match for multi-turn; keep sticky root for UREW multi-turn and failed-first-request retries; mint createThread:true when the sticky root is already confirmed and the request has no assistant history. * fix(providers): honor Extra API Keys rotation in OpencodeExecutor (#8493) * fix(providers): honor Extra API Keys rotation in OpencodeExecutor OpencodeExecutor.buildHeaders bypassed resolveEffectiveKey, so extraApiKeys never rotated and an empty primary with populated extras sent no auth header. Closes #8467 * fix(executors): gate the Authorization header write on the resolved effective key Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(providers): resolve native vision for path-shaped multimodal model ids (#8495) * fix(providers): resolve native vision for path-shaped multimodal model ids Leaf-id static/registry metadata now wins over synced attachment=false without modalities, so cp/cline-pass/kimi-k3 forwards images natively. Closes #8032 * fix(providers): scope path-shaped leaf lookup to vision only Move leaf MODEL_SPECS fallback out of shared getStaticSpec() so aihorde/deepseek/deepseek-v4-flash no longer inherits DeepSeek tool-calling metadata (#8212). Vision still resolves via getVisionStaticSpec(). Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * fix(cli): backup create/auto enable — remove option-shadowing legacy fallback (#8512) (#8516) Co-authored-by: Max <maxmad64@gmail.com> * feat: read INITIAL_PASSWORD env var during setup (#8439) * feat: read INITIAL_PASSWORD env var during setup Allow users to set the admin password via the INITIAL_PASSWORD environment variable instead of requiring the --password CLI flag or interactive prompt. Falls between --password flag and interactive prompt in resolution priority. * test(cli): cover INITIAL_PASSWORD env var in setup resolvePassword Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: linh.doan <linh.doan@be.com.vn> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix: combo input-bound, Responses->Chat image strip, qwen-web toolCalling, empty-response exhaustion (#8476) * test(tail): retire stale i18n __MISSING__ repro + fix qianfan website URL Base-red slice 6, rebased onto the advanced release/v3.8.49 (91fd5f9). The oauth grok-cli #7610 guard was already fixed on the base by #8027 (it reads the warning from grokCliAuthJson.ts) — dropped from this slice to avoid a conflicting duplicate. Remaining two, still red on the current base: - i18n #7258: the "focused repro" asserted zh-TW.json STILL carries raw __MISSING__: placeholders. That backlog was filled (the "no locale has a raw __MISSING__: leaf" invariant is the durable guard); retired the now-inverted repro. - qianfan: Baidu renamed the product page (product/wenxinworkshop -> product-s/ qianfan_home); updated the expected website URL. Validated (clean env): i18n 4/0, qianfan 5/0; oauth-modal-grok 2/0 already green on base. * fix(resilience): short-circuit combo on input-bound failures (context_length_exceeded) (#8375) isInputBoundRequestFailure() predicate detects deterministic input-bound errors (context_length_exceeded/context_window_exceeded). The combo loop propagates the original 400 immediately instead of burning MAX_GLOBAL_ATTEMPTS retrying identical oversized inputs against every account. Test: combo-input-bound-failure-8375.test.ts (1 test, 2 assertions) * fix(resilience): add early-exit in combo dispatcher for input-bound failures (#8375) When isInputBoundRequestFailure detects context_length_exceeded, the combo loop returns {ok:false, response} immediately instead of re-dispatching the oversized request. Test: node --import tsx/esm --test tests/unit/combo-input-bound-failure-8375.test.ts - 1 test, 2 assertions, 0 fail * fix(translator): strip input_image from tool outputs in Responses->Chat downgrade (#8459) toolOutputContentToString() extracts input_text/output_text parts and replaces input_image with a placeholder instead of JSON.stringify'ing the content-part array (which embedded raw ~52KB base64 as inert text). Applied to both function_call_output and custom_tool_call_output branches. Existing translator tests: 88/88 pass. New tests: 4/4 pass. * fix(providers): set qwen-web toolCalling to false — web-cookie provider has no native function calling (#8437) qwen-web is a web-cookie provider that emulates tools via synthetic system prompt text and <tool> XML parsing, never sending a native tools[] field upstream. The filterTargetsByRequestCompatibility gate filters out non-tool- calling targets when the request carries tools, but qwen-web's registry entry had toolCalling=true, so the filter let it through and a tool-using session failing over to qwen-web would silently degrade to text-only chat with 'Tool X does not exists' errors. Sibling web-cookie providers (chatgpt-web, yuanbao-web, claude-web, etc.) all correctly set toolCalling: false — qwen-web was an outlier introduced in PR #7874. Verification: - LSP diagnostics: clean - Pattern matches chatgpt-web, yuanbao-web, and other web-cookie providers * fix(backend): empty upstream response mislabeled as exhausted_connection (#8397) isEmptyContentFailure guard only matched '/empty content/i' but the actual error text from detectMalformedNonStream is 'returned an empty response (no usable choices/output)' — which lacks the word 'content'. Expanded regex to also match '/empty response/i' so these transient upstream glitches don't get classified as connection-level exhaustion in combo diagnostics. Test: 28 existing combo-target-exhaustion tests pass (no new test needed) * test(#8397): add regression test for empty-response 502 not marking provider/connection exhausted * test(qwen-web): align registry snapshot with toolCalling:false Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(resilience): scope #8375 input-bound short-circuit to homogeneous remainders The isInputBoundFailure short-circuit (context_length_exceeded / context_window_exceeded) fired unconditionally on the first target, aborting the whole combo even when later targets are a different model with a larger context window — regressing the intentional heterogeneous-combo fallback that isContextOverflow400 (#6637) protects. Reproduced with a 2-target combo (small-context model fails, larger-context model would have succeeded): the combo never reached target 2. Scope the short-circuit to remainders where every remaining target shares the same modelStr as the one that just failed — the "retrying will fail identically" premise for context_length_exceeded only holds within a homogeneous same-model pool. Rebaselines open-sse/services/combo.ts's frozen file-size cap (3642->3679) for this PR's own combo.ts growth (config/quality/file-size-baseline.json). Refs #8375 Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: Probe Test <probe@example.com> Co-authored-by: herjarsa <herjarsa@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * feat(cli-tools): add all Hermes Agent auxiliary model roles (#8543) * feat(cli-tools): add all Hermes Agent auxiliary model roles Extend HERMES_AGENT_ROLES from 7 to 18 slots to match the full auxiliary.* set in Hermes Agent config.yaml: - add: mcp, title_generation, memory_query_rewrite, tts_audio_tags, triage_specifier, kanban_decomposer, profile_describer, goal_judge, curator, monitor, background_review - reorder: web_extract before compression (match upstream docs) Backend generator/reader are generic on auxiliary.<role> — only the role catalog, UI card, and i18n (en + pl) needed updating. * fix(i18n): translate the 12 new Hermes auxiliary roles into vi and pt-BR The 22 new en.json keys landed only in pl.json, breaking the vi and pt-BR key-parity guards. Adds the same keys with real translations (no placeholder strings), keeping both parity assertions exact. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * test(cli-helper): guard HERMES role catalog parity between backend and UI Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(kiro): harden auth flows, quota lookup, and model discovery (#8565) * fix(kiro): fetch builder id quota without profile arn * fix(kiro): harden auth imports polling and model discovery * fix(kiro): preserve auth identity and OAuth polling semantics * docs(changelog): add Kiro auth and model discovery fix --------- Co-authored-by: Nguyễn Thanh Hà <nguyenha@Mac-mini-M4.local> Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com> * fix(chatgpt-web): recover async images via conversation-poll fallback (#7357) (#8372) * fix(chatgpt-web): recover async images via conversation-poll fallback (#7357) chatgpt-web generates images upstream but frequently fails to return them: register-websocket is Cloudflare-sensitive and the plain WebSocket used to receive the async image event lacks the browser TLS fingerprint the HTTP client (tlsFetchChatGpt) uses, so pollForAsyncImage errors or times out with no frames — even though the image is already in the conversation. When the websocket yields nothing, poll GET /backend-api/conversation/{id} over the same authenticated HTTP path and read the image_asset_pointer directly (newest message wins, so a reused conversation can't surface a stale image). The existing makeImageResolver then downloads it via the files API. This is the durable fallback suggested in #7357. Verified against a live ChatGPT Plus session: with the websocket capped short, the fallback recovers the image and returns a real PNG. * test(chatgpt-web): cover conversation-poll fallback for async images Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: sadruzzahan <istykhan.ik@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * feat(combos): add select all / unselect all in Browse Catalog (#8526) * feat(combos): add select all / unselect all in Browse Catalog * fix(dashboard): guard combo Select all + test the real batch handlers (#8526) Select all had no cap — with "Show configured only" off, or a large provider catalog, one click could add hundreds of models to a combo. ModelSelectModal now confirms above SELECT_ALL_CONFIRM_THRESHOLD (20) before batch-adding, matching the native confirm() pattern already used for bulk/destructive actions elsewhere in the dashboard. Also extracts ComboFormModal's handleAddModels/handleDeselectModels batching logic into computeBatchAddModelSteps/computeBatchDeselectModelSteps (src/lib/combos/builderDraft.ts) so unit tests exercise the real implementation instead of a hand-maintained mirror that could drift from the component and stay green while production code broke. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(dashboard): include OMNIROUTE_BASE_PATH in displayed API base URL (#8514) * fix(dashboard): include OMNIROUTE_BASE_PATH in displayed API base URL When OmniRoute is served under a reverse-proxy subpath (OMNIROUTE_BASE_PATH), the Endpoints UI built display URLs from window.location.origin alone and appended /v1, producing https://host/v1 instead of https://host/omniroute/v1. - Prefer NEXT_PUBLIC_BASE_URL when it already includes a non-root path - Append NEXT_PUBLIC_OMNIROUTE_BASE_PATH (mirrored from OMNIROUTE_BASE_PATH at build time) when resolving a bare public origin - Document subpath display behavior in .env.example - Add unit coverage for basePath-aware resolution * docs(changelog): add fragment for #8514 display basePath fix --------- Co-authored-by: rqzbeh <rqzbeh@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * feat(jobs): execute the backup-schedule.json cron server-side (#8513) (#8517) Co-authored-by: Max <maxmad64@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * feat(log): Added new visual scrolling log page (#8354) * feat(log): Added new visual scrolling log page * chore(quality): rebaseline sections.ts own-growth for #8354 (logs-timeline sidebar item) * feat(log): direct-link a request from the scrolling timeline Clicking a request bar now sets ?id= on the URL (matching the regular request log page), and the timeline opens the deep-linked request on mount. The open/close handlers arm the same guard so a stale initialSelectedId (router.replace() commits the URL after the render it triggers) can never reopen the modal right after the user closes it. * fix(dashboard): propagate logsTimelineSubtitle across all 43 locales en.json was missing the logsTimelineSubtitle key entirely, breaking the default locale for the new /dashboard/logs/timeline sidebar entry. Add the real English string to en.json, add __MISSING__: placeholders to the 11 locales that lacked the key outright, and convert the 30 locales that had copied the English text literally to the repo's __MISSING__: convention for untranslated strings. Also pause the RequestTimeline 2s poll while the tab is backgrounded (document.visibilityState), matching the existing pattern in RequestLoggerV2 and UsageStats. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(i18n,sidebar): add missing logsTimelineSubtitle + update sidebar tests Address maintainer feedback on #8354: - Add logsTimelineSubtitle key to en.json + 11 locales (ar, az, bg, bn, cs, da, de, es, fa, fi, fr) that were missing it - Add logs-timeline to sidebar-visibility.test.ts expected arrays - Add logs-timeline to sidebar-monitoring-reorg.test.ts logs group - Add compression-exclusions to sidebar-visibility.test.ts (pre-existing) * feat: add touch support for mobile panning and pinch-to-zoom on timeline --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(providers): weekly quota for xAI OAuth (Grok) (#8471) * feat(providers): weekly quota for xAI OAuth (Grok) Live weekly credit pool for xai-oauth (alias xao) via the shared cli-chat-proxy billing API (creditUsagePercent), using the connection OAuth access token. - Export fetchGrokBillingWithToken from grokQuotaFetcher for reuse - xaiOauthQuotaFetcher: 60s cache, fail-open, preflight + monitor - Provider Limits allowlist and weekly window * test(providers): cover xai-oauth usage dispatch + fix changelog Address PR review: - fix changelog file & rename to 8471-xai-oauth-weekly-quota.md - export getXaiOauthUsage via __testing - add xai-oauth-usage.test.ts --------- Co-authored-by: allanvb <allanvb@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(backend): fail closed when capability filters empty the combo pool (#8494) * fix(backend): fail closed when capability filters empty the combo pool Tools/vision/structured_output filters no longer re-admit the full pool when every target is incompatible. Opt-in via combo config compatFilterFailOpen. Closes #8488 * fix(backend): keep tool-emulation providers under fail-closed filters Carve out providers with toolCalling:"emulated" (#5240) from tools capability_mismatch so chatgpt-web combos still reach the prompt shim. Align round-robin compatFilterFailOpen with settings fallback and drop new any-typed params from the #8488 combo-routing tests. * chore(lint): prune stale combo-routing-engine any suppressions Test cleanup in #8488 dropped four no-explicit-any hits; sync the freeze file. * chore(quality): rebaseline combo.ts + freeze new-above-cap comboStructure.ts check:file-size was red for this PR's own growth: combo.ts grew 3640->3693 (+53, the capability-filter fail-closed guard + compatFilterFailOpen escape hatch at both call sites) and combo/comboStructure.ts crossed the 800-line new-file cap at 918 (describeCapabilityFilterExhaustion + providerSupportsEmulatedToolCalling for the #5240 emulated-tool-calling exemption). Both are irreducible orchestration wiring at the existing combo filter chokepoint (same precedent as #7301's cooldown-retry generalization). Companion test tests/unit/combo-routing-engine.test.ts frozen at its own grown size (3409->3449). No logic change; 95/95 tests pass. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: Prudhvivuda <Prudhvivuda@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(oauth): actionable guidance for LAN-origin loopback mismatches (codex + Antigravity) (#8463) * fix(oauth): explain the LAN-IP loopback mismatch with an actionable panel #8046 already stops the doomed login when a PKCE_CALLBACK_SERVER_PROVIDERS provider (codex / xai-oauth / grok-cli) is connected from a LAN IP, but it explained itself as one long English sentence rendered in the generic red "Connection failed" step. Two concrete problems with that: - the operator had to parse prose to work out WHICH ports to forward, and the command shipped with `<port>` / `<omniroute-host>` placeholders to resolve by hand; - it forwarded a single port. Both are required: the dashboard port is what makes the origin true-localhost (a LAN origin never reaches the callback-server branch at all), and the provider's fixed callback port is where the browser is actually sent back to. Forwarding either one alone still fails. buildPkceLoopbackMismatchHint() now returns the diagnosis as structured data with the detected host and both ports already filled in, and a dedicated OAuthLoopbackMismatchPanel renders it as: what happened -> how to fix, in three numbered steps with copy-to-clipboard fields. No "Try again" button — retrying the same origin fails identically. The panel yields to the paste-token tab so grok-cli (which is in both provider sets) never stacks the two views. The flat warning string stays exported for non-UI callers. docs: REMOTE-MODE.md gains a "Connecting Codex / Grok on a remote install" section with the fixed-callback table and the two-port tunnel, mirroring the existing Antigravity section. i18n: 9 new oauthModal keys, hand-written for en + pt-BR and propagated to the remaining 40 locales as `__MISSING__:` sentinels (runtime falls back to the clean English value per #7258). * fix(oauth): correct the Antigravity remote-login guidance and drop the stale i18n copy Same LAN-origin family as the codex fix in this branch, different mechanism and a worse failure mode. Google providers (antigravity / agy) have no fixed foreign port: OAuthModal builds `http://127.0.0.1:<dashboardPort>/callback`. On a LAN origin that 127.0.0.1 is the BROWSER's machine, and Google's firstparty/nativeapp consent only releases the code once the loopback is reachable from the approving browser. When it is not, the consent never redirects at all — it hangs. So unlike an ordinary provider there is no error page and no callback URL in the address bar. That made the existing copy actively wrong. `googleOAuthWarning` was corrected when the login helper shipped (#5203), but a changed English value does not invalidate existing translations and `i18n:sync-ui` only fills keys that are ABSENT, never ones that are STALE — so 39 of 43 locales (pt-BR, pt, es, de, fr, ja, zh-CN, …) kept the original "wait for the redirect, copy the full URL and paste it below", instructing a flow that cannot complete. The drift gate that should have caught this is a no-op: `check-translation-drift.mjs` needs `.i18n-state.json`, which is not in the repo, and it runs `--warn`. Because the key's MEANING changed, it is renamed rather than edited — a new key cannot inherit a stale translation. `googleOAuthWarning` is removed from all 43 locales and replaced by 7 `googleLoopback*` keys, hand-written for en + pt-BR and marked `__MISSING__:` elsewhere so the runtime falls back to correct English (#7258). UI: `OAuthGoogleLoopbackNotice` states what is happening and surfaces both real remedies with the detected host and port filled in — the local login helper (recommended; its blob is what the Step 2 field accepts) and a single-port SSH forward. It also REPLACES `remoteAccessInfo` for this family instead of stacking on top of it: that notice promises an error page whose URL you copy, true for ordinary providers and false here. `agy` deliberately gets no helper command. bin/cli/commands/login.mjs pins PROVIDER = "antigravity" and parsePastedCredentials() rejects a blob whose embedded provider does not match the route provider, so advertising the helper there would send the operator to a blob guaranteed to be refused. It keeps the tunnel path. Refactor: the shared `resolveDashboardPort` / `buildSshLocalForward` helpers move to `loopbackTunnel.ts`, used by both hint builders. The codex builder's behaviour is unchanged (its 11 tests still pass untouched). docs: REMOTE-MODE.md notes that the dashboard now surfaces the remedies, states that one forward is enough for Antigravity (contrasting the two-port codex case), and aligns Option B's command on 127.0.0.1 to match what the UI generates. --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(guardrails): Vision Bridge describe-fallback ignores unreachable candidates (#8433) * fix(guardrails): Vision Bridge describe-fallback ignores unreachable candidates getVisionCapableModels() scanned the entire static PROVIDER_MODELS catalog for a describe-fallback model without checking whether the provider has a usable active connection on this instance. On an instance with no `openai` provider connected, this let the hardcoded default `openai/gpt-4o-mini` win selection every time, the describe call would fail, and replaceImageParts()'s describe-failure fallback (#4012) intentionally preserves the raw image part — which then reaches a non-vision backend and gets rejected with an opaque upstream error (e.g. "unknown variant `image_url`, expected `text`"). Extract the credential-usability check already used by the whole-request reroute path (visionBridge.ts's hasUsableCredentialsForModel / isProviderConnectionUsable) into a shared visionBridgeCredentials.ts module, and apply the same check to the describe-fallback candidate list in visionBridgeRouter.ts. A confirmed-unusable connection (`false`) excludes a candidate; an indeterminate result (`null`, e.g. no DB) fails open to preserve existing behavior. getVisionCapableModels/getBestVisionModel/getFallbackModels become async to support the credential lookup; call sites and the existing unit test suite are updated accordingly, plus new coverage for the exclusion behavior. * fix(guardrails): fix flaky credential-mock race and move Vision Bridge router tests to a CI-blocking runner The two new assertions added in this PR (excludes a candidate with no usable active connection / selects a credentialed candidate over an uncredentialed one) were correct — the failure was a genuine Vitest race: getVisionCapableModels() fans out to hasUsableCredentialsForModel() once per catalog entry via Promise.all, and dozens of concurrent first-load `await import("@/lib/db/providers")` calls for the same specifier under vi.mock() nondeterministically resolved against the real module instead of the mock for some callers. Memoize the dynamic import in visionBridgeCredentials.ts so it resolves exactly once and is reused, which removes the race entirely (and is cheaper at runtime too). Also: tests/unit/guardrails/visionBridgeRouter.test.tsx was never collected by any CI-blocking gate — `test:unit`'s guardrails glob is `*.test.ts` only, and `test:vitest` (vitest.mcp.config.ts) doesn't include this directory; only the advisory `test:vitest:ui` picked it up. Moved the suite to visionBridgeRouter.test.ts under node:test, threading an optional `deps.hasUsableCredentials` injection point through getBestVisionModel()/getFallbackModels() (consistent with the existing deps pattern in visionBridge.ts) since this project's native test runner has no supported ESM module-mocking mechanism. Running the full guardrails suite together also surfaced that this PR's own credential-exclusion feature silently broke the pre-existing vision-bridge-callmodel.test.ts fallback-retry test: with zero seeded provider connections in that test's isolated DATA_DIR, every fallback candidate is now confirmed-unusable and excluded, leaving no fallback to retry. Seeded one credentialed connection there so the fallback-retry mechanics stay independent of the (unrelated) credential filter. Refs #8433 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(sse): label HTTP 499 disconnects as client_disconnected (#8552) * fix(sse): label HTTP 499 disconnects as client_disconnected Preserve caller-supplied error type/code in buildErrorBody so stream abort classification is not overwritten by the status-code table. * docs(security): document buildErrorBody classification arg --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * [BUG] enforceOutputTokenBudget ignores combo-resolved context limit, silently truncates responses (#8378) * fix(chatcore): use combo-resolved context limit in enforceOutputTokenBudget Line 1801 called getTokenLimit() directly, ignoring the contextLimit variable that was already resolved with combo overrides (e.g. user-set 201320 for nvidia/z-ai/glm-5.2). This caused enforceOutputTokenBudget to use the fallback 128K default, capping max_tokens to near-zero and silently truncating responses. Fix: use the existing contextLimit variable instead of re-resolving. * fix(chatcore): hoist combo-resolved contextLimit so the output-token budget honors it contextLimit (including the combo override from resolveComboContextLimit()) was declared inside the proactive-compression `if` block and never survived to the final enforceOutputTokenBudget() call further down in handleChatCore(), which referenced an out-of-scope `contextLimit` — a ReferenceError on every request. Hoist the declaration to function scope so the combo-resolved context limit is what the output-token budget actually enforces. Adds a regression test that drives handleChatCore() end-to-end with a combo whose resolved context limit differs from the plain per-target getTokenLimit() lookup, since output-token-budget.test.ts only exercises enforceOutputTokenBudget() directly and cannot catch this class of bug. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: TonPro <hello@tonpro.fu> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(cursor): bridge native TodoWrite completions (#8432) Co-authored-by: Makcim Ivanov <10184529+makcimbx@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(resilience,translator): three release/v3.8.49 base-red regressions + eslint baseline — conflict resolved (#8254) Co-authored-by: herjarsa <herjarsa@users.noreply.github.com> * test(antigravity): align catalog tests with #8013/#8123 model realignment (base-red slice 3) (#8257) * test(antigravity): align catalog tests with the #8013/#8123 model realignment Base-red slice 3. Two test files referenced antigravity model IDs that models) intentionally renamed/retired — the candidate builder and static catalog are correct; the tests were stale. - auto-combo-credentialed-model-pool: claude-sonnet-5 -> claude-sonnet-4-6 and the gemini-3.5-flash-{low,medium,high} tier -> gemini-3.6-flash-{low,medium,high} (verified against the live createVirtualAutoCombo candidate set); the exclusion wildcard and per-account transparency assertions are unchanged in intent. - T31 static-catalog: gemini-3-pro-preview was retired by #8013, so assert the current client-visible top flash tier (gemini-3.6-flash-high) plus its absence. Test-only. Validated: auto-combo-credentialed-model-pool 4/4, the T31/T33/T34/T38 model-specs file 8/8. * test(model-alias-seed): expect canonical antigravity provider for the agy alias Same #8013 realignment as this PR: `getModelInfo` resolves the stored `agy/…` alias target to its canonical provider id `antigravity` (ALIAS_TO_PROVIDER_ID). The stored alias STRING stays `agy/gemini-pro-agent`; only the resolved `provider` is now `antigravity`, not `agy`. Test updated to match. 6/0. --------- Co-authored-by: Probe Test <probe@example.com> * fix(sse): export PROVIDER_BREAKER_FAILURE_STATUSES — fix ReferenceError in chat.ts (base-red slice 4) (#8258) * fix(sse): export PROVIDER_BREAKER_FAILURE_STATUSES so chat.ts stops throwing ReferenceError Base-red slice 4 (single root cause across the whole handleChat cluster). src/sse/handlers/chat.ts:1273 references PROVIDER_BREAKER_FAILURE_STATUSES to decide whether an all-rate-limited provider result should trip the provider breaker, but the constant was only a FILE-LOCAL const in chatPredicates.ts (a refactor extracted it out of chat.ts and never re-exported it). Every request that reached that branch threw `ReferenceError: PROVIDER_BREAKER_FAILURE_STATUSES is not defined`, so the global fallback and breaker-gate paths blew up — surfacing as "All models failed | PROVIDER_BREAKER_FAILURE_STATUSES is not defined" and breaking the handleChat coverage tests (combo-error passthrough, 503 for cooled-down/open-breaker, budget-error, model cooldown, body-derived retry-after, non-JSON rate-limit bodies). Fix: export the const from chatPredicates.ts and import it in chat.ts (one canonical definition, restoring the pre-refactor behavior). Validated: chat-route-coverage 15/0 (was 12/3), chat-cooldown-aware-retry 6/0, chat-rate-limit-body-lock 2/0; breaker guards (7907, combo-breaker-429, openrouter-6842) unchanged; typecheck:core clean. * test(nvidia): read PROVIDER_BREAKER_FAILURE_STATUSES from chatPredicates.ts Same root cause as the chat.ts import fix in this PR: the const was extracted out of chat.ts into chatPredicates.ts, so the nvidia-quota Phase-1 guard (which greps the source for the `= new Set([...])` declaration to prove 429 was not added to the breaker classification) must read chatPredicates.ts, not chat.ts. Now 13/0. --------- Co-authored-by: Probe Test <probe@example.com> * merge: resolve conflicts for #7904 local corpus context (#8685) Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * docs(env): document NEXT_PUBLIC_OMNIROUTE_BASE_PATH and OMNIROUTE_BACKUP_SCHEDULE_JOB_INTERVAL_MS (#8690) Both vars were introduced in code without a .env.example / ENVIRONMENT.md entry, so `check:env-doc-sync` (docs-sync-strict / docs-gates) went red on release/v3.8.49 with "In code but missing from .env.example: 2": - NEXT_PUBLIC_OMNIROUTE_BASE_PATH — src/shared/hooks/useDisplayBaseUrl.ts (#8514) - OMNIROUTE_BACKUP_SCHEDULE_JOB_INTERVAL_MS — src/lib/jobs/backupScheduleJob.ts (#8517) Documents both in .env.example and docs/reference/ENVIRONMENT.md rather than adding allowlist entries: both are real operator-tunable knobs, so the allowlist would hide a genuine gap. Refs #8540 Co-authored-by: rqzbeh <rqzbeh@users.noreply.github.com> Co-authored-by: maxmad64bis <maxmad64bis@users.noreply.github.com> * fix(quality): register the #8494 covering test in stryker tap.testFiles (#8692) `tests/unit/8488-capability-filter-fail-closed.test.ts` landed with #8494 and covers `open-sse/services/combo/comboStructure.ts`, an instrumented module, but was never added to `tap.testFiles`. The `check:mutation-test-coverage --strict` gate therefore fails on `release/v3.8.49` itself, turning the Fast Quality Gates job red on every PR cut from it. Registering the file restores the gate (verified: "No drift") and makes that test's mutant kills count toward the module's mutation score. * chore(quality): update baselines after v3.8.49 merge-train (#8686) - complexity: 2183→2188 (combined growth from 16 merged PRs) - cognitive: 968→971 (combined growth from 16 merged PRs) - file-size: OAuthModal.tsx 1100→1134, RequestTimeline.tsx NEW 839, chatgpt-web.ts 3206→3241, comboStructure.ts 917→918, combo.ts 3642→3648, combo-routing-engine.test.ts testFrozen 3409→3449 Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix: repair five base-red failures on release/v3.8.49 (#8706) * fix: repair five base-red failures on release/v3.8.49 Every PR cut from this branch fails CI on the branch's own breakage. Five distinct causes, none introduced by the PRs that trip over them: 1. dast-smoke / Turbopack build — src/sse/handlers/chat.ts imported PROVIDER_BREAKER_FAILURE_STATUSES twice in one statement. A duplicate import specifier is an ECMAScript syntax error, so the production build never compiled. Introduced by #8258, whose export fix landed on top of an import that already existed. 2. Unit Tests — the #8393 verified-cooldown bypass was renamed exactCooldownVerified -> exactCooldownIsUpstreamReset during the #8254 conflict resolution, which also dropped the flag at the markAccountUnavailable call site entirely. The rename left the test passing the old key (so the flag was silently ignored and a verified upstream reset got clamped back to maxCooldownMs), and the dropped call site meant no real caller set it at all. Align the test on the surviving name, restore the call site, and restore the doc comment explaining #6863 vs #7940. 3. Unit Tests — #8526 added four common.* keys to en.json only, breaking the strict key-parity tests for pt-BR and vi. Translated into all 42 locales. 4. Unit Tests — vi carried 17 __MISSING__ placeholders from #8354 and #8463, and vi is the one locale with a no-placeholder test. Translated. 5. No new ESLint warnings — four suppressed `any`s in tests/unit/combo-routing-engine.test.ts no longer exist, and ESLint exits 2 on stale suppressions. Pruned (271 -> 267); no other entry moved. Also regenerates skills/cli-backup-sync/SKILL.md, which still documented the `backup status` flags #8512 removed — the merge-integrity gate compares the generated output against the tree. Not fixed here: the env/docs contract (NEXT_PUBLIC_OMNIROUTE_BASE_PATH and OMNIROUTE_BACKUP_SCHEDULE_JOB_INTERVAL_MS missing from .env.example), which #8690 already covers, and the quality baselines, which #8686 covers. * fix(quality): keep prettier off the generated SKILL.md files check:agent-skills-sync diffs the generator's output against the tree byte for byte, but lint-staged runs prettier over any staged *.md — and prettier inserts a blank line after the frontmatter that the generator does not emit. Committing a regenerated skill therefore made the gate fail again on the very file that was just brought back in sync. The 44 untouched skills only escape this because they never pass through lint-staged. The generator is the formatter of record for these files, so ignore them. * fix(i18n,quality): drop the stale zh-TW key; raise the auth.ts frozen cap #8463 renamed `oauthModal.googleOAuthWarning` away but left the old key behind in zh-TW, so the "the stale googleOAuthWarning key is GONE from every locale" guard fails on the branch. Removed it. The auth.ts frozen line cap goes 2486 -> 2492. Restoring the dropped exactCooldownIsUpstreamReset call site costs 7 lines, and staging the file makes lint-staged reformat four pre-existing over-100-column lines to prettier's rule — unavoidable without bypassing the hook, which hard rule #10 forbids. The file still sits 12 lines below where the cap was set relative to its actual size. * feat(sse): relay upstream 4xx error bodies verbatim on the Anthropic request path (#8622) * feat(sse): selective upstream 4xx error passthrough util * feat(sse): relay upstream 4xx error bodies verbatim on the Anthropic request path createErrorResult() gains an opt-in 7th param opts.passthrough; when set and the upstream body is eligible (per shouldPassthroughUpstreamError), the returned response body is the upstream 4xx body verbatim instead of the sanitized wrapper. Internal classification fields (error/rawMessage/ errorType/errorCode) are never affected. Wired into chatCore.ts's 7 upstream-error createErrorResult call sites (model_unavailable / context_overflow / generic upstream-error branches), gated on sourceFormat === FORMATS.CLAUDE so only /v1/messages requests get the verbatim body — OpenAI-format paths are unchanged. * test(quality): register upstream-error-passthrough in stryker tap.testFiles `tests/unit/upstream-error-passthrough.test.ts` covers `open-sse/utils/error.ts`, an instrumented module, so `check:mutation-test-coverage --strict` requires it in `tap.testFiles` — the gate flagged the drift on this PR. * fix(sse): clamp max_tokens to the model output cap on every path (#8698) * fix(sse): clamp max_tokens to the model output cap on every path enforceOutputTokenBudget only capped the three output-token fields against the remaining context window, so a request whose max_tokens exceeded the model's own output ceiling reached the upstream unchanged on the single-model path (the reasoning-token buffer covers only thinking models inside combo routing). Pass the model's explicit output cap into the budget check and use it as an extra upper bound when adjusting the fields. The reject decision stays tied to the context window: an output cap smaller than the default output budget must not turn a valid request into a 400. * fix(sse): key the output-cap lookup by provider + model The bare-string form of getExplicitModelOutputCap resolves to `provider: null`, which skips the registry cap and the operator's `max_token` capability override (#6524) — the documented escape hatch for a wrong synced `limit_output`. Clamping against a stale static spec while the operator had raised the ceiling would silently truncate output. Matches the { provider, model } form already used by the sibling capability lookups in this file (getResolvedModelCapabilities, supportsMaxTokens). * test(sse): cover the output-cap callsite; harden the sub-token cap guard The unit tests drive enforceOutputTokenBudget() directly, so dropping the cap argument at the handleChatCore callsite left every one of them green. Add a wiring test that runs handleChatCore end to end against a stubbed fetch and asserts the body actually dispatched upstream. The cap comes from an operator `max_token` capability override rather than a catalog model: the override table is keyed by provider, so the test also pins the { provider, model } lookup — both the missing argument and the bare-string form fail it (verified by mutating each in turn). Also floor `maxOutputTokenCap` before the positivity test. A fractional cap below 1 previously passed `> 0` and floored to an effective cap of 0, clamping every field to zero; sub-token caps are meaningless and now read as absent. Unreachable through the callsite (toPositiveInteger filters it) but the exported contract was wrong. The adjustment log now states the output ceiling in effect instead of claiming the cap caused the adjustment — a field can also be adjusted by removal of an invalid value, which the cap did not cause. * fix(api): serve /v1/models stale-first and sanitize its error bodies (#8703) * fix(api): serve the model catalog stale-first and sanitize its error body A client with a short discovery timeout (Claude Code allows 3s) hit a full catalog rebuild — 290 providers plus SQLite reads — every time the memoized entry expired, and got an empty model picker with no error. Serve an expired entry immediately and revalidate in the background, bounded by a staleness window so a permanently failing refresh cannot pin an old catalog forever. Only a cached 200 is eligible; a state change still drops the cache outright. The builder's catch block also returned the raw error message in the response body. Route it through the shared sanitizer (hard rule #12). * fix(api): reject a failed catalog refresh instead of resolving it stale catalogInFlight is shared with the cold path, so resolving the background refresh with the stale entry handed it to callers that had already aged past CATALOG_STALE_WHILE_REVALIDATE_MS — a stale 200 they were no longer entitled to, with a build failure disguised as success. The refresh now rejects; the stale path never awaits it (the rejection is pre-handled, so it can never surface as an unhandledRejection) and a cold-path caller that joins it gets the sanitized 500. A failed refresh still leaves the cached entry untouched. Also sanitize the core builder's own catch — that is the realistically reachable 500 for this endpoint, and it still returned the raw error message (hard rule #12); keep the cache-key format private to the module by having the two test hooks take the Request and derive the key themselves. * refactor(api): extract the model-catalog response cache into its own module The stale-while-revalidate work pushed catalog.ts from 1615 to 1745 lines, past its frozen size cap. Raising the cap on a file already flagged as too large is the wrong answer: the caching layer is a self-contained concern (coalescing, TTL memoization, staleness window, background refresh) that only needs a builder callback from the catalog module. catalogCache.ts now owns the maps, the cache key, the state-change invalidation, the header merge, the background refresh and the test hooks; catalog.ts keeps auth, the builder, and the error shape, and re-exports the hooks so the existing tests keep importing them from where they always did. Net effect: catalog.ts 1745 -> 1513, i.e. 102 lines below the cap it was frozen at, and the test-only surface no longer sits in the production catalog module. No behavior change — all 281 tests across every suite importing catalog.ts pass, including the #6408 one-builder-run guard. * feat: Claude Code discovery aliases (surface non-Claude models in the /model picker) (#8666) * feat(db): cc discovery alias gate storage + EXPOSE_CC_DISCOVERY_ALIASES flag Adds the gate for claude/<provider>/<model> discovery-alias mirror ids on the /v1/models catalog: a new runtime feature flag (env forces on and wins over the dashboard DB override), per-provider and per-model "on"/"off"/null overrides stored in key_value under the ccDiscoveryAliases namespace, and a pure precedence resolver (model > provider > global). Catalog wiring is a separate follow-up task; this only lands the gate + storage. * feat(sse): synthesize claude/ discovery aliases for the model catalog * feat(api): advertise cc discovery aliases on /v1/models behind the 3-level gate * feat(sse): resolve claude/ discovery aliases on the request path * fix(sse): import getComboByName from db/combos, not the localDb barrel * fix(sse): cover custom-node prefixes and the Codex WS bridge in cc discovery alias resolution * feat(dashboard): cc discovery alias toggles + flag-screen env warning Adds the operator-facing UI/API layer for the Claude Code discovery-alias gate (claude/<provider>/<model> mirror ids on /v1/models): REST endpoint for provider/model overrides, a provider-detail card with 3-state (inherit/on/off) toggles, an info button on the Claude Code tool card linking to Feature Flags, and an env-source warning on the EXPOSE_CC_DISCOVERY_ALIASES flag card when it's forced on via env. * feat(api): cc discovery usage metrics * fix(api): record cc alias metric in the production wrapper + atomic counter upsert * docs: document cc discovery aliases (Claude Code guide + feature flag catalog) * fix(sse): don't mirror built-in auto/* combos as discovery aliases (advertised-but-unroutable) * i18n(vi): translate the discovery-alias strings instead of shipping placeholders vi is the one locale with a strict "no internal missing markers" test, so the 17 __MISSING__ entries this branch added (the provider ccAlias panel, the info button, the feature-flag description and the env warning) would have turned that test red the moment the base itself was repaired. Translated, keeping every ICU placeholder ({modelId}, {error}) and the literal claude/<provider>/<model> id shape intact. * chore(quality): raise the frozen caps this feature legitimately grows catalog.ts 1615 -> 1639: the alias synthesis is wired into the catalog builder, which is where the per-key-filtered list is assembled — the only place the mirror entries can be appended after model hiding has been applied. localDb.ts 808 -> 810: two re-export lines for the new ccDiscoveryAliases db module, which is exactly what the "Adding a New DB Module" recipe prescribes. * refactor(dashboard,api): keep the complexity ratchets flat The feature added four cyclomatic violations and one cognitive one, which the ratchets reject — the baseline only moves when a metric improves. Split the new code instead: - appendCcDiscoveryAliases: the four skip-guards become isMirrorableId(). - resolveCcDiscoveryAliasStripWith: alias parsing and gate resolution become parseCcAliasTarget() and resolveGateFor(), replacing a chain of ternaries that each re-tested isComboAlias. - FeatureFlagCard: the env-precedence warning becomes its own component instead of a conditional branch inside an already-large render. - ProviderCcAliasSection: the loader moves to useCcAliasData(), and the override list and add-row become ModelOverrideList / AddOverrideRow, bringing both oversized functions back under the 80-line rule. Behavior unchanged — the 74 discovery-alias tests pass untouched. Both ratchets now sit exactly at baseline (2188 / 971). * feat(dashboard): copy-paste settings.json block for Claude Code discovery (#8722) The discovery-alias info button explains the gate and links to the flag, but the operator still had to assemble the Claude Code config by hand from the guide. Render it instead, on the same Claude tool card, from the base URL the card has already resolved (custom override included, normalized — no /v1, no trailing slash), with a copy button. The key slot holds a placeholder, never the real key: this card renders before a key is necessarily selected, and a real key in copyable text is an easy way to leak one into a screenshot or a pasted snippet. buildClaudeDiscoverySettingsSnippet is a pure builder in claudeCliConfig so the shape is unit-tested (7 cases, including that no `sk-` ever reaches the output and that an invalid CLAUDE_CODE_AUTO_COMPACT_WINDOW is dropped rather than emitted). Guide gains the matching section; the five new strings are translated for pt-BR and vi (the locales with strict parity/marker tests) and marked in the rest, per the repo's convention. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * Train 1D: merge via --admin on .113 validation Squash merge from local merge-train (Hard Rule owner-approved). Tip 029cdf4215cf465f0e1716ac9f84a84692b1e881 validated on 192.168.0.113: 26631/26653 pass. * feat(quality): temporary relax of complexity/file-size ratchets for v3.8.50-3.8.54 PREPARE phase (#8767) * feat(quality): temporary relax of complexity/file-size ratchets for v3.8.50-3.8.54 PREPARE phase OWNER-APPROVED TEMPORARY rebaseline covering the v3.8.50 release cut + the entire PREPARE phase (5 minor cycles .50-.54 per docs/ROADMAP.md). Current state (pristine release/v3.8.49 tipcc53f45749): - complexity.count = 2188 - cognitiveComplexity.value = 971 - file-size cap / testCap = 800 / 800 New ceilings (+20% over the original 2x-drift proposal): - complexity.count = 2774 (+586 = +26.8%) - cognitiveComplexity.value = 1223 (+252 = +26.0%) - file-size cap / testCap = 1000 / 1000 (+200 each = +25.0%) Justification: - +20% buffer over the 2x-daily-drift proposal absorbs the v3.8.50 release cut spike (33-PR Train 1D + ~37-PR Train 2 backlog + post-freeze re-home rebase churn) without per-PR rebaseline noise. - Frozen files (>900) remain frozen (only-shrink); cap-relax unblocks the 21 files in the 801-900 cliff for new leaf extraction during PREPARE. - 105 files >1000 still require structural decomposition regardless (debt #3501). RE-TIGHTENING MANDATORY in v3.8.51 (track via roadmap issue to open in this PR): - complexity.count target = 2282 (shrink of 492 via combo.ts/chatCore.ts decomposition scheduled in .51/.52 per ROADMAP.md) - cognitiveComplexity.target = 1009 (shrink of 214 via same decomposition wave) - file-size cap / testCap target = 850 / 850 Window: v3.8.50 (release cut, 2026-07-28 target) -> v3.8.54 close (RE-TIGHTEN executed at v3.8.51 prep merge per ROADMAP.md). This entry is the LAST rebaseline in this file unless a measured regression appears. v1 (2x drift, 2188->2312 / 971->1019 / 800->900) retained below for audit trail. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(skills): regenerate cli-backup-sync SKILL.md (sync with generator) Generated by: node --import tsx/esm scripts/skills/generate-agent-skills.mjs --apply Resolves check:agent-skills-sync failure on PR #8767 (Merge integrity gate). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * feat(db): let the migration runner scan extra namespaced directories (#8770) The runner reads exactly one directory and records the bare numeric prefix as the version, so the numeric slots are a single global namespace. Any distribution that ships its own migrations next to the upstream set has to draw from that same range while upstream keeps appending to it — and when both sides claim a number, the runner records one name for it and treats the other as already applied. That migration then never runs, silently, on every already-provisioned database. OMNIROUTE_EXTRA_MIGRATIONS_DIRS registers additional directories as `namespace=dir` entries separated by the platform path delimiter. Files found there are recorded as `<namespace>-<number>` (e.g. `ee-134`), a version space that cannot collide with the upstream numeric one, and they are applied after the core set. Unset — the default, and the only case for a plain install — nothing changes: no filesystem access, identical behaviour. Misconfiguration throws instead of being skipped. A malformed entry, a namespace outside [a-z][a-z0-9]*, a duplicate namespace, or a directory that does not exist aborts startup, because silently missing schema is the exact failure this exists to prevent. Two files sharing a number inside the SAME namespace still collide and throw, mirroring the runner's own guard. Also fixes an inconsistency the tests surfaced: a missing core directory returned early and took the extra directories down with it. They are an independent set. The version-namespaced strings need no further plumbing — the applied set, the gap reconciliation and the name-mismatch check all key on the version string, and the numeric-only paths (`Number.parseInt`, the "032"/"041"/"042" special cases, `isSchemaAlreadyApplied`) ignore them by construction. 11 new tests; the 7 neighbouring migration suites stay green (62 tests). * fix(db): repair the extra-migration-dirs test and env contract on CI (#8773) Two defects shipped with #8770, both red on release/v3.8.49. 1. `OMNIROUTE_EXTRA_MIGRATIONS_DIRS` was documented in ENVIRONMENT.md but never added to .env.example, so the env/docs contract gate and its two tests (check-env-doc-sync, issue-7793-env-doc-sync-repro) failed. Added, with the same explanation the docs carry. 2. tests/unit/db-migration-runner-extra-dirs.test.ts passed locally and failed on CI, for two reasons that only appear under the CI invocation: - It re-imported migrationRunner.ts under a cache-busting query string to pick up a fresh `MIGRATIONS_DIR` per test. That is not reliable under the loader chain CI uses (`--import tsx/esm --import setupPolyfill --import isolateDataDir`): the second test got a runner still pointing at the REAL migrations directory and tried to apply migration 127 to an empty in-memory DB. The core directory is now fixed once, before the first import; only the extra directories vary per test, and those are resolved at call time by design. - Tests were registered with top-level `await`. With synchronous bodies that drains the event loop between tests and `--test-force-exit` — used by every CI test script — cancels the remainder of the file. Both constraints are now written down in the file header so the next edit does not reintroduce them. Validated with the exact CI invocation, not the bare runner: 11/11, 0 cancelled. Neighbouring suites green under the same flags: db-migration-runner (26), check-migration-numbering (15), db-migrationrunner-constants-split (7), db-migration-version-uniqueness (2), check-env-doc-sync (13), issue-7793-env-doc-sync-repro (1). * perf(api): skip the full catalog build for quota-exclusive keys (#8771) buildUnifiedModelsResponseCore builds the entire catalog first — every provider's models, the auto/* combos with their candidate scoring, the embedding/image/rerank/ audio/moderation/video/music registries, the OpenRouter catalog, custom models — and only at the very end, once the caller turns out to be scoped to a quota pool (allowedQuotas non-empty), discards all of it and returns the pool's qtSd/* combos instead. Measured on a 1 vCPU shared-quota host: ~1.2s of CPU per cold build to return 10 models, and 4.4-7.1s under contention. Claude Code's gateway model discovery aborts at 3s, so on a busy host the discovery silently falls back. Everything the quota path needs (`combos`, `timestamp`, `buildComboCatalogMetadata`) already exists before the expensive loops start, so resolve the key metadata there and return early. Extracts two helpers into ./catalogResponse so the short-circuit and the full build share one implementation instead of two copies that drift: - applyCatalogPostFilters — the chain that runs AFTER the API-key filter (configuredOnly, claude effort variants, no-thinking variants, cc-discovery mirrors, synced effort variants, dedupe) - finalizeCatalogResponse — enrichment + the codex `models: []` compatibility field + the response envelope That chain is not optional for the quota path: the cc-discovery mirrors are exactly what lets Claude Code see a quota pool's models, and a first draft of this change dropped them by returning before it. The regression is now pinned by a test that was verified to fail without the call. catalog.ts 1615 -> 1480 lines. TDD: tests/unit/quota-exclusive-catalog-short-circuit.test.ts uses the OpenRouter catalog fetch as the observable — it is part of the full build and reaches the network, so a request that performs it did the whole build. The quota request runs first, while OpenRouter's 24h cache is still cold, otherwise a cached second call would make the assertion vacuous. Red before (1 fetch), green after (0), and a normal key still fetches. Behaviour guards green: quota-exclusive-catalog-4806 (2), quota-key-models-route (18), cc-discovery-aliases-catalog (9), catalog-helpers-extraction (12), cc-compatible-model-catalog (1), instrumentation-warm-catalog-cache (3), catalog-pricing-surface-8018 (3), apikeypolicy-quota-only (6). typecheck, lint and the file-size gate clean. * fix(providers): handle space-separated search queries via matchesAnyToken (#8660) Consolidates PR #8660 (matchesAnyToken with full-match priority over token-level OR fallback) with the existing Turkish search normalization shipped on release/v3.8.49. The PR adds a new matchesAnyToken helper used by the providers search to allow space-separated queries (e.g. 'pollinations sambanova') to match when any of the tokens is present. Full query match takes priority so that an exact 'pollinations sambanova' query still hits even if a partial token would have been ambiguous. The unit test file gains 12 PR-side matchesAnyToken tests on top of the 6 release-side Turkish-normalization tests covering the same function, totaling 27 tests. Co-authored-by: maxmad64bis <maxmad64bis@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(sse): guard the KIE task-id and callback-url reads at their source (#8661) `kieExecutor.createTask()` returns `JsonObject` (`Record<string, unknown>`), so `createData.data` is `unknown` and the `createData?.data?.taskId` read that image, video and music generation each duplicated could not compile. The same three-line expression appeared verbatim in all three handlers. `open-sse/utils/kieTask.ts` already holds two helpers with exactly this shape — `normalizeKieTaskState()` and `parseKieResultJson()` both take `unknown`, guard with `isJsonObject()` and return a declared type. `getKieTaskId()` follows them, so the three handlers now share one guarded read instead of three unguarded ones. `getKieCallbackUrl()` took `KieCallbackBody`, a weak type (all properties optional). Passing a request body whose declared keys are `prompt` / `timeout_ms` / `poll_interval_ms` tripped TS2559 "no properties in common" at both music call sites. It receives arbitrary upstream request bodies, so it now takes `unknown` and guards the same way its neighbours do; `KieCallbackBody` had no other reference and is gone. Behaviour is unchanged. `isJsonObject()` rejects arrays and null exactly where optional chaining already yielded `undefined`, and the callers' `String(taskId)` coercion moved inside the helper, so a numeric id still reaches `pollTask()` as a string and a falsy id still takes the 502 branch. Fixes 5 of the 208 `tsc -p open-sse/tsconfig.json` diagnostics with no new ones: 3 x TS2339 `taskId` on `unknown`, 2 x TS2559 on `KieCallbackBody`. Refs #8484 * fix(autoCombo): fallback to base model intelligence for -free alias models (#8601) (#8662) When looking up models_dev_tier or capability scores for -free alias models (e.g. deepseek-v4-flash-free), strip the -free suffix to query the underlying model's intelligence data if direct lookup yields null. Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * fix(autoCombo): use longest pattern match in static fitness table (#8603) (#8664) Sort static fitness table patterns by descending length before matching. This prevents shorter substrings like 'gpt-4o' from incorrectly matching longer model IDs like 'gpt-4o-mini' when 'gpt-4o' happens to be listed earlier in JavaScript Object key iteration order. Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * refactor(sse): declare the ArrayBuffer backing on media byte producers (#8665) Six declarations spell a byte buffer as bare `Buffer` / `Uint8Array`. Without its type argument that widens to `ArrayBufferLike`, which also admits `SharedArrayBuffer` — so the value is rejected at every Web API boundary it is actually passed to: `BodyInit` for `new Response(...)` and `BlobPart` for `new Blob([...])`. Every one of them is already ArrayBuffer-backed at runtime. `hexToBytes()` allocates with `new Uint8Array(len)`; `synthesizeGtts()` and `pcmToWav()` return `Buffer.concat(...)`; `fetchRemoteImage()` returns `Buffer.from(await response.arrayBuffer())`; `readPageResponseBody()` returns `Buffer.from(body)`, which copies. The declarations were simply less specific than the values, so this states what the code already guarantees. Same fix #8533 applied to the multipart and gRPC-web bodies. Fixes 5 of the 208 `tsc -p open-sse/tsconfig.json` diagnostics with no new ones: 3 in audioSpeech.ts (MiniMax hex, gTTS, Vertex Gemini TTS), 1 in imageGeneration.ts (Topaz Blob upload) and 1 in browserBackedChat.ts. Refs #8484 * fix(dashboard): broken icon allignment in `SegmentedControl.tsx` (#8679) * fix(providers): deprecate Monster API provider (fixes #8676) (#8691) Monster API shuttered operations on 2026-06-30. Mark monsterapi entry as isDeprecated with deprecationReason in INFERENCE_HOSTS catalog. Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local> * Dependabot updates (#8695) * deps: bump node from 24-trixie-slim to 26-trixie-slim Bumps node from 24-trixie-slim to 26-trixie-slim. --- updated-dependencies: - dependency-name: node dependency-version: 26-trixie-slim dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump codecov/codecov-action from 5.5.5 to 7.0.0 Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.5 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](0fb7174895...fb8b3582c8) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/setup-python from 6 to 7 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * deps: bump the production group with 5 updates Bumps the production group with 5 updates: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1090.0` | `3.1091.0` | | [marked](https://github.com/markedjs/marked) | `18.0.6` | `18.0.7` | | [next-intl](https://github.com/amannn/next-intl) | `4.13.2` | `4.13.3` | | [recharts](https://github.com/recharts/recharts) | `3.9.2` | `3.10.0` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.11.1` | `13.0.1` | Updates `@aws-sdk/client-bedrock-runtime` from 3.1090.0 to 3.1091.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1091.0/clients/client-bedrock-runtime) Updates `marked` from 18.0.6 to 18.0.7 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](https://github.com/markedjs/marked/compare/v18.0.6...v18.0.7) Updates `next-intl` from 4.13.2 to 4.13.3 - [Release notes](https://github.com/amannn/next-intl/releases) - [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md) - [Commits](https://github.com/amannn/next-intl/compare/v4.13.2...v4.13.3) Updates `recharts` from 3.9.2 to 3.10.0 - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](https://github.com/recharts/recharts/compare/v3.9.2...v3.10.0) Updates `better-sqlite3` from 12.11.1 to 13.0.1 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](https://github.com/WiseLibs/better-sqlite3/compare/v12.11.1...v13.0.1) --- updated-dependencies: - dependency-name: "@aws-sdk/client-bedrock-runtime" dependency-version: 3.1091.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: marked dependency-version: 18.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: next-intl dependency-version: 4.13.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: recharts dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: better-sqlite3 dependency-version: 13.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(executors): pass TimeoutError reason to controller.abort() in 7 niche executors (#8699) Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(sse): stop thrashing the provider prompt cache for caching-aware clients (#8705) * fix(sse): stop thrashing the provider prompt cache for caching-aware clients - shouldPreserveCacheControl: preserve client cache_control markers for every combo strategy. The deterministic-strategy gate forced marker rewrites whose per-request breakpoint positions are not stable turn-over-turn, thrashing the upstream prompt cache (observed in production as ~200k cache_write tokens per turn on quota-share combos). Preserving is never worse: on a stable target the client's breakpoints advance deterministically; on a target switch both approaches miss equally. - prepareClaudeRequest: translator-path opt-in fallback — when preserve-mode has nothing to preserve (client sent no cache_control anywhere), apply the standard heuristic so requests never ship with zero cache breakpoints. The claude-code-compatible relay path keeps its no-supplement contract. - anthropic-beta: forward the client-negotiated context-1m-2025-08-07 through the allowlist merge so a /model <id>[1m] client keeps its long-context negotiation behind the proxy (never forced when the client did not send it). * fix(sse): surface cache tokens in non-streaming OpenAI usage + finalize pending on quota-share block - translateNonStreamingResponse (claude→openai): fold cache_read into prompt_tokens and expose prompt_tokens_details.cached_tokens / cache_creation_tokens, mirroring the streaming contract (#1426/#2215). Non-streaming OpenAI clients behind a cached Claude upstream previously saw prompt_tokens=<uncached remainder> (e.g. 23 for a ~9k request) with no cache visibility. - chatCore quota-share block: finalize the pending-request slot before returning the policy 429 — the path never reaches upstream and the orphaned pending lingered as a status-0 call-log row until the reaper swept it. Validated live on the staging box (repro: blocked key → orphan row; after: clean). --------- Co-authored-by: diegosouzapw <diegosouzapw24@gmail.com> * docs(codex): document session affinity and stream idle for long tasks (#8709) * docs(codex): document session affinity and stream idle for long tasks Operators running multi-hour Codex sessions need both knobs spelled out: sessionAffinityTtlMs (default off) and STREAM_IDLE_TIMEOUT_MS (10 min), with a concrete recipe and an explicit keep-defaults decision (#7287). * fix(ci): keep #7287 docs-only so base-red gates stay skipped Drop the unit content-guard that classified the PR as code (triggering i18n/unit/eslint/dast on a red release tip). Sync agent-skills so check:agent-skills-sync passes (config-codex-cli blank line + stale cli-backup-sync catalog drift). * fix(oauth): show GitLab Duo setup before authorize error (#8710) * fix(oauth): show GitLab Duo setup before authorize error Surface the OAuth app registration and env-var recipe in the Add Connection modal before auto-starting authorize, and keep the same shared copy for catalog authHint and the authorize fallback (#8688). * fix(oauth): keep OAuthModal under file-size baseline for #8688 Extract waiting/error panels so the GitLab Duo setup step does not trip the Fast Quality Gates file-size ratchet, and update the retry Button regression guard for the extracted error step. * fix(sse): fall back to target provider for combo compression limits (#8716) (#8720) parseModel can return provider:null when a combo target modelStr lacks a provider/ prefix; ResolvedComboTarget already carries provider, so use it before getTokenLimit to avoid null.toUpperCase() during compression. * fix: hydration mismatch, duplicate React keys, and missing ponytail i18n (#8723) - KimiSponsorBanner/RiskNoticeBanner: read the localStorage dismissal flag via useSyncExternalStore (server snapshot = visible) instead of a useState lazy initializer, so the first client render matches SSR (which has no localStorage) instead of diverging on hydration. - usage/analytics route: key the per-model aggregation map by model name alone instead of `${provider}::${model}`, matching the table's one-row- per-model display and eliminating duplicate `key={m.model}` rows when a model is served through multiple provider connections/accounts. - CommandPalette: look up existing section/subgroup by id across the whole list instead of only comparing to the previous item, so sections whose children interleave root items and groups (e.g. omni-proxy) don't produce two subgroups sharing the same "_root" key. - Add the missing `compressionOutputStyle.ponytail` label/description to all 43 locale message files (present in the style catalog but never added to any locale, causing a MISSING_MESSAGE crash). Co-authored-by: Gillz <gillz@Gillzs-MacBook-Pro.local> * fix(db): preserve readonly and existing-file semantics in node:sqlite fallback (#8724) * fix(db): preserve node sqlite open semantics * test(db): keep node sqlite coverage off Bun * chore(changelog): number native sqlite fallback * test(db): register node sqlite tests only under Node * Create AMIT (#8727) * fix(sse): hide synthetic OpenAI startup reasoning (#8729) * fix(reasoning): sanitize Kimi K3 think tags * ci: build patched OmniRoute image * fix(sse): hide synthetic OpenAI startup reasoning --------- Co-authored-by: rinseaid <rinseaid@rinseaid.net> * fix(guardrails): check feature flag helper in PIIMasker to honor DB overrides (#8708) (#8730) Previously checked directly, ignoring database feature flag overrides configured via settings/UI. This update routes the check through so DB overrides are respected as intended. Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * fix(sse): report a stream that completes without any content (#8732) An `auto/*` combo whose first step lands on an uncredentialed backend returns HTTP 200 with `finish_reason: "stop"`, `content: null` and `error: null`. The agent sees a clean empty assistant turn, has no error to stop on, and retries to its cap. The non-streaming path already refuses this: `isEmptyContentResponse` rewrites a 200-with-no-content into a 502 "Provider returned empty content", which the combo layer classifies as a model-level transient and fails over on (#5085). The streaming path had no equivalent, and neither existing guard covers it: - `ensureStreamReadiness` is a LIVENESS probe, not a content one. Its failure message says so — "Stream ended before producing a non-ping SSE event" — and `hasStreamReadinessSignal` returns true for a bare `delta:{"role":"assistant"}`. - `createDisconnectAwareStream`'s #7699 branch fires on a MISSING terminal marker and is scoped to the Claude client format, because for other formats a marker-less close is genuinely ambiguous. The reported stream trips neither: OpenAI format, terminates with `finish_reason: "stop"` and `[DONE]`, contains nothing. "Completed normally but emitted zero content" is not ambiguous the way a missing marker is, so this guard is format-agnostic. It reuses `hasUsefulStreamContent`, which already existed in streamReadiness.ts — exported, correct, and wired to nothing — and which already counts tool-call-only and reasoning-only output as real (#2520). A watcher wraps it to handle frames split across network chunks and to spot the terminal states where emptiness is legitimate, kept in step with errorClassifier.ts's `LEGIT_EMPTY_OPENAI_FINISH` / `LEGIT_EMPTY_CLAUDE_STOP`: length, tool_calls, content_filter, max_tokens, tool_use. Two guards keep it from over-firing, one of which caught a real regression while building this: the check applies only when bytes were forwarded, and only when the body actually looked like SSE. A plain JSON completion travels through the same wrapper and has no `data:` frames, so "no content seen" says nothing about it — without the SSE gate, four existing stream tests failed. The `if (done)` branch's reasoning moved into `resolveSilentCloseReason()`, which also drops `pull` back under the function-length ceiling; cyclomatic lands at 2187 against a baseline of 2188. This surfaces the error rather than failing over. Failing over would mean holding every stream until its first content token, since the combo has already returned leg 1's response by then — a much larger change. Surfacing the error satisfies the issue's stated expectation ("surface the upstream error OR fail over") and stops the retry loop, which is the reported harm. Closes #8649 * chore(ci): add release PR build gate (#8735) Co-authored-by: Erick Kinnee <erick@ekinnee.dev> * fix(plugins): delete the generated host script synchronously so plugin loads stop leaking temp files (#8749) * fix(plugins): delete the host script synchronously and stop two tests leaking child processes Three related leaks in the plugin child-process lifecycle, found while tracing 27 node processes on a developer machine. 1. loader.ts removed the generated omniroute-plugin-host-*.mjs with a fire-and-forget `rm(...).catch(() => {})`. That unlink loses the race against process exit: test:unit runs with --test-force-exit, which tears the process down before the promise settles, so every plugin load leaked one temp .mjs into TMPDIR. Measured at 6 files per full-suite run, 40 accumulated over a handful of local runs. rmSync closes the race; the throw stays swallowed because an exception raised from a child "exit" handler would take the server down, and a leftover temp script would not. 2. plugins-manager-lifecycle.test.ts "activates an installed plugin" called activate() -- which spawns the plugin's child process -- but never deactivate(). deactivate() is the only path that reaches the loader's cleanup(), so the child outlived the test and its IPC channel kept the test process's event loop alive. 3. plugins-manager-restart-reload-7806.test.ts simulateRestart() deleted the entry from loadedPlugins without calling cleanup(), dropping the only handle that can kill child #1. The reload then spawned child #2, and the finally block's deactivate() could reach only child #2 -- one dangling child per test. A real restart takes the whole process tree down, so calling cleanup() here is both the faithful simulation and the fix. Combined effect: a run without --test-force-exit deadlocks. The test process cannot exit while its child holds the IPC channel open, and the child waits for messages that never come. Observed as three plugin hosts alive for 4h51m under a runner that never finished. Validation (Hard Rule #18, TDD): the new plugins-loader.test.ts case fails against the old async unlink ("must delete the host script synchronously, not on a later tick") and passes with rmSync. It redirects TMPDIR/TEMP/TMP to a private directory before counting, because test:unit runs at --test-concurrency=20 and a concurrent file's host scripts would otherwise land in the counted directory and flake the assertion. After: 19/19 pass across the three files, 0 temp scripts created, 0 orphan processes. tests/unit/build/** 334/334; typecheck:core and eslint clean. * docs(changelog): add fragment for plugin host script sync delete * Stabilize Notion web sessions and JSON output (#8751) * feat(providers): live monthly credit quota for Firecrawl (#8759) * feat(providers): live monthly credit quota for Firecrawl Wire Firecrawl team credits into Provider Limits / preflight via GET /v2/team/credit-usage (Bearer API key) - firecrawlQuotaFetcher + usage/firecrawl leaf - USAGE_FETCHER_PROVIDERS + USAGE_SUPPORTED_PROVIDERS + apikey allowlist - register via quotaTrackersBatch - unit tests for fetcher + usage dispatch * chore(changelog) - add changelog on live monthly credit quota for Firecrawl * fix(providers): satisfy provider limits file-size gate --------- Co-authored-by: allanvb <allanvb@users.noreply.github.com> * fix(sse): update ANTHROPIC_PING heartbeat data payload to {"type":"ping"} (fixes #8750) (#8762) Anthropic SSE ping events require data: {"type":"ping"} payload. Updated sseHeartbeat.ts and associated unit tests. * fix(cloudflare-ai): sync missing free catalog models (fixes #8725) (#8763) Adds @cf/qwen/qwen2.5-coder-32b-instruct, @cf/meta/llama-3.3-70b-instruct-fp8-fast, @cf/meta/llama-3.2-3b-instruct, @cf/qwen/qwq-32b, @cf/zai-org/glm-4.7-flash, @cf/moonshotai/kimi-k2.6, and @cf/google/gemma-4-26b-a4b-it to freeModelCatalog.data.ts to match the provider registry. * fix(bedrock): preserve additionalModelRequestFields in converse payload (fixes #8746) (#8764) Passes through request.additionalModelRequestFields in openAIToBedrockConverse so reasoning/thinking options passed from Kiro/Bedrock translators are retained in the AWS Converse payload. * fix(docs): use correct kebab-case CLI flags in OpenCode guide (take 2) (#8766) * initial commit * update the date * docs(podman): clarify Podman Machine deployment (#8569) * docs(podman): clarify Podman Machine deployment * style(podman): format guidance and regression test * fix(backend): add error.code to synthOpenAIErrorChunk for guard compatibility (#8570) synthOpenAIErrorChunk() sets error.type to upstream_empty_response but omits error.code. The isRequestScopedUpstreamFailure guard only checks type for context_length_exceeded, so an upstream_empty_response error slips past it. - Added code: upstream_empty_response to the error object in synthOpenAIErrorChunk() - Added test assertion verifying error.code matches error.type This ensures the guard correctly identifies upstream empty responses as request-scoped failures. Closes #8469 * feat(ci): block stale UI translations when an English value is rewritten (#8574) Closes the gap that let #8463 ship. `oauthModal.googleOAuthWarning`'s English value was rewritten when the Antigravity login helper landed (#5203); 39 of 43 locales kept a translation of the PREVIOUS English, which told operators to "copy the full URL and paste it below" — a flow that cannot complete for that provider family. Non-English users read confident, wrong instructions for months and no gate noticed. None of the three existing gates can see this class: - `sync-ui-keys.mjs` only backfills keys that are ABSENT, never ones that are STALE; - `check-ui-keys-coverage.mjs` counts key PRESENCE, so a stale translation scores as fully covered (all 43 locales sat at 99.6% throughout); - `check-translation-drift.mjs` tracks the `docs/i18n/<locale>/**.md` documentation mirrors — it never reads `src/i18n/messages/*.json` at all. (Its `.i18n-state.json` is also absent, so it self-skips, but bootstrapping it would not have helped: wrong surface.) New gate `scripts/i18n/check-ui-value-drift.mjs` is DIFF-AWARE rather than baseline-backed: it compares `en.json` at the merge base against the working tree, and for every key whose English value changed, reports any locale still holding an untouched translation. That choice deliberately freezes pre-existing debt — a diff cannot reveal which old English a long-standing translation came from, so the gate judges only what the current change touches, and unrelated PRs never pay for historical drift. The alternative, a per-key hash baseline over 11207 keys, would have cost a ~600 KB generated file (3x the largest existing baseline) churning on every i18n PR. Two ways to satisfy it: refresh the translations, or set them to `__MISSING__:<new english>` so the runtime serves the corrected English (#7258) while the key queues for translation. When the string's MEANING changes, renaming the key is better still — a new key cannot inherit a stale translation, which is what #8463 did. Wired blocking into the `i18n-ui-coverage` job (the `i18n` job is `continue-on-error: true`, so a gate there could not block anything). That job gains `fetch-depth: 0` because the gate needs the base ref; without it the gate self-skips with `base-unresolved`, mirroring `check-openapi-breaking`. `BASE_REF` is passed via `env:` and reaches git only through `execFileSync` argv — never a shell string. Verified against the real defect: rewriting an English value with translations left behind reports exactly 39 stale locales and exits 1; `--warn` exits 0; an unresolvable base exits 0 with `SKIP reason=base-unresolved`. Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> * fix(video): validate Veo AI Free artifacts before success (#8581) * fix(video): validate Veo AI Free artifacts before success * fix(build): serialize apt cache mounts for multi-arch docker builds * refactor(sse): extract combo dispatch prelude into combo/dispatchPrelude.ts (#8582) * refactor(sse): extract combo dispatch prelude into combo/dispatchPrelude.ts Pure move, no behaviour change. First of ~7 PRs decomposing the combo.ts god-file (#3501). handleComboChat evaluates a series of dispatch branches before it ever reaches target resolution or the sequential attempt loop. None of them iterate targets in priority order or need the failover/retry/credential gate machinery that follows, so they move to a leaf: - context-cache pin routing (Fix #679), including the pinIsDurablyUnhealthy / isPinnedModelDurablyUnhealthy health gate - fusion panel dispatch + the #6455 misconfiguration warn - pipeline chaining - nested combo-ref execute-mode runtime-unit dispatch Only the chaos and round-robin hand-offs stay inline (11 and 13 lines); extracting those would be pure indirection. open-sse/services/combo.ts 3642 -> 3341 (-301) open-sse/services/combo/dispatchPrelude.ts: 619 (under the 800 cap) Each helper keeps the fall-through protocol the inline blocks had: return a Response to OWN the request, return null to fall through. A flipped null/Response would silently bypass the whole combo strategy, so the new tests pin both directions for every branch. combo.ts re-exports pinIsDurablyUnhealthy so combo-pin-health-gate.test.ts keeps resolving. The leaf takes handleComboChat as a `runCombo` parameter instead of importing it, so combo/ keeps zero back-edges into combo.ts. Complexity-neutral: the first cut added +3 violations (two max-lines-per-function, one complexity) inside the new leaf, so evaluatePinnedResponse, orderRuntimeUnits, recordRuntimeUnitStickySuccess and buildBaseOptions were split out. check:complexity now measures 2169 and check:cognitive-complexity 956 — identical to the pristine base. * test(sse): close the dispatch-prelude coverage holes found by mutation testing An adversarial mutation audit of the suite added in the previous commit found it guarded the fall-through protocol well but asserted almost nothing about what the helpers do once they OWN the request. 5 of 12 seeded mutations survived. Worst case: deleting the pinned-model dispatch call outright left all 12 tests green. Three holes, now closed (8 tests -> 20): Hole A — the honored-pin path had zero coverage. Both existing pin tests DROP the pin, so the dispatch, the 200-but-empty quality gate, the [408, 429, 500, 502, 503, 504] failover list and the catch(pinErr) branch were unguarded — exactly the logic the 2026-06-21 / 2026-06-22 incident comments call load-bearing. Adds five tests over a seeded healthy provider connection so the pin is actually honored. Hole B — orderRuntimeUnits was only ever driven with `priority`, which is a no-op through it. Four of five strategy branches could be deleted with nothing failing. Adds round-robin rotation and weighted sticky ordering tests. Hole C — recordRuntimeUnitStickySuccess never did anything under test: both its guards need weighted/round-robin, so an early return changed nothing. Covered by the new sticky-batch test. Verified by re-running the mutations rather than assuming: all 7 that previously survived (delete-pin-dispatch, serve-despite-failed-quality, never-fail-over-on-transient, rr-counter-not-advanced, rotation-removed, weighted-sticky-skipped, sticky-recording-no-op) are now killed. The first sticky-batch test I wrote was itself vacuous — asserting "same unit twice" holds equally when the recording helper is stubbed out, since nothing advances the counter either. It now asserts the batch runs out and rotation resumes on the third dispatch, which is what actually distinguishes the two. Also restores API_KEY_SECRET in test.after; it was set at module load and never put back, inconsistent with the DATA_DIR handling beside it. * fix(ci): teach known-symbols gate the relocated fusion/pipeline dispatch The combo sub-check of check:known-symbols asserts every canonical routing strategy has a real dispatch branch. It scanned a hardcoded file list and matched only `strategy === "..."`, so the prelude extraction tripped it twice: [combo] 2 estratégia(s) canônica(s) sem branch de despacho em combo.ts: ✗ fusion ✗ pipeline Both branches are still wired — they just moved to combo/dispatchPrelude.ts and took the early-return guard form `if (strategy !== "fusion") return null;` that extracting a branch into a `tryXDispatch()` leaf naturally produces. Two changes, both extending existing precedent (the list already carries the Block J leaves for the same reason): - register combo/dispatchPrelude.ts in comboDispatchFiles - widen the extractor to `strategy [!=]== "..."` so the inverted guard counts Loose `==`/`!=` stay rejected, and no `handledNotCanonical` fallout: the gate now reports 20 canonical strategies, all 20 via despacho. * chore(ci): register combo-dispatch-prelude test in stryker tap.testFiles check:mutation-test-coverage --strict failed once the known-symbols fix let Fast Quality Gates advance to it: ✗ 2 covering unit test(s) across 2 module(s) are missing from stryker.conf.json tap.testFiles open-sse/services/combo/comboStructure.ts open-sse/services/combo/rrState.ts The new tests/unit/combo-dispatch-prelude.test.ts exercises both modules, and both are already in stryker's mutate list, so without the registration its mutant kills would not have counted toward the nightly mutation gate. Note (unchanged, still out of scope): combo/dispatchPrelude.ts itself is not in stryker's `mutate` list. Adding it would widen the nightly mutation surface, which is a separate call from fixing this drift. * docs(changelog): add fragment for #8582 combo dispatch prelude * refactor(tls): update TLSClient instantiation to use buildNativeTlsClientOptions across multiple services (#8583) This change modifies the instantiation of TLSClient in chatgptTlsClient, claudeTlsClient, grokTlsClient, lmarenaTlsClient, notionTlsClient, and perplexityTlsClient to utilize the new buildNativeTlsClientOptions function. This refactor enhances consistency and maintainability across the TLS client implementations. * chore(quality): rebank file-size shrinks on release/v3.8.49 tip (#8585) Regenerate file-size-baseline.json with shrink-only `--update` measured on the current tip (5f365bae7), after #8741 (--update removes at-cap entries) and #8767 (OWNER-APPROVED temporary cap/testCap 800->1000 for the v3.8.50-.54 PREPARE phase) both landed. frozen 186 -> 120 entries (75 shrank, 66 removed as redundant) testFrozen 58 -> 43 entries (19 shrank, 15 removed as redundant) Shrink-only, verified against the pre-rebase baseline: no entry grew, no entry was added, every removed entry measures <= cap, and `cap`/`testCap` stay at the 1000 that #8767 set. All `_rebaseline_*` audit notes are preserved verbatim, including both #8767 relax entries. The earlier SKILL.md sync and the `--update` removal fix are dropped from this branch — both landed upstream via #8741. * fix(routing): exclude locked-out models from auto-combo candidates (#7623) (#8586) Filter auto-combo candidates through existing model lockout, connection cooldown, and terminal testStatus so repeatedly failing no-auth models are not re-advertised into auto/* pools. * fix(api): prevent silent lost updates on concurrent settings writes (#7784) (#8587) Add opt-in settingsRevision / If-Match optimistic concurrency so stale PATCH writers get 409 instead of silently clobbering map settings. * fix(providers): persist perplexity-web Set-Cookie session rotations (#8200) (#8588) Wire NextAuth session-token merge/persist on successful perplexity-web responses so rotated cookies survive in provider_connections, matching chatgpt-web behavior. * fix(cli): prepare Next.js cache dir on Android/Termux before serve (#8593) * fix(cli): ensure `~/.cache` is created and `XDG_CACHE_HOME` is set before Next.js loads on Android/Termux to prevent silent HTTP 500 errors due to instrumentation hook failures (#8519) * chore(quality): ignore XDG_CACHE_HOME in the env/docs contract scanner XDG_CACHE_HOME is an XDG Base Directory spec variable set by the OS or the operator, never OmniRoute product config — the same reason XDG_CONFIG_HOME is already ignored. The Android/Termux cache-dir preparation added here reads it to honor an operator-set cache location, which made check-env-doc-sync demand an .env.example/ENVIRONMENT.md entry for a variable we do not own. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * build(pack): require bin/cli/utils/ensureAndroidCacheDir.mjs in the tarball bin/omniroute.mjs imports this module at startup to prepare the Next.js cache dir before serve on Android/Termux. bin/cli/ is only an allowlist PREFIX, so a file missing from the tarball would not fail the unexpected-paths check — it would ship a CLI that throws ERR_MODULE_NOT_FOUND on the very platform this change targets. Registering it makes the absence loud, same guard class as storageKeyProvision.mjs and versionFastPath.mjs. Caught by tests/unit/pack-artifact-entrypoint-closures.test.ts in the v3.8.49 merge-train. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(context): isolate context-manager suite from local DATA_DIR (#8596) Pin the unit suite to a temp data directory before imports so getTokenLimit resolves against the registry fallback instead of a developer models.dev sync. * fix(auto-combo): short-circuit expandAutoComboCandidatePool when models[] is non-empty (#8598) When an auto-combo has models[] populated by the operator but config.auto.candidatePool is empty (the default for combos created via the dashboard), expandAutoComboCandidatePool silently expands the candidate pool to every model of every active provider connection. This overrides the explicit list in models[] and lets unintended models (e.g. gemini-3.1-flash-lite) win the auto-strategy scoring contest. In omniroute@3.8.48 (npm) only one guard exists before the expansion loop (GUARD A: if (config.auto.candidatePool populated) return eligibleTargets). The upstream release branch release/v3.8.49 added a second guard (combo-ref check, PR #7301) but it does not cover the common pattern where models[] holds explicit kind:"model" entries. Both gaps share the same root mechanism and the same fix. The new guard short-circuits whenever models[] is a non-empty array, covering both kind:"model" entries (the dashboard default) and kind:"combo-ref" entries (which #7301 already handles). With this guard in place, the existing combo-ref check becomes redundant; it is left in place for the minimal-scope surgical fix, and can be removed in a follow-up cleanup. Validation (in isolated Docker, 3 providers + 4 controlled combos): - 3 explicit models, empty candidatePool: pool 60 -> 6 - 1 combo-ref + 2 explicit, empty candidatePool: pool 64 -> 10 - 3 explicit models, populated candidatePool (GUARD A path): 6 -> 6 - empty models[] virtual auto: 57 -> 57 (expansion preserved) Closes #8597 Co-authored-by: Michael de Souza Marcos <michael.smarcos@hotmail.com> * fix(sse): route task-aware defaults by intent, fix fitness pattern shadowing (#8602, #8603) (#8605) * fix(sse): restore task-aware routing config on restart (#8601) The T05 Task-Aware Smart Routing config was persisted to settings.taskRouting by PUT /api/settings/task-routing but never read back, so it silently reverted to enabled:false + the hardcoded default model map on every restart. Two root causes, both fixed: - No boot hydration existed. Adds hydrateTaskRoutingConfig(settings), wired into src/instrumentation-node.ts next to the Thinking-Budget restore (#5312). It accepts either the JSON string the route persists or an already-parsed object, and fails open on malformed values. applyRuntimeSettings does not cover this key, same as the Global System Prompt (#2470). - The config lived in a plain module-level `let`, which is duplicated per module graph — a boot hydration would have landed on the instrumentation graph's copy and never reached the one src/sse/handlers/chat.ts reads. This is the exact break #5312 fix-A hit on the VPS. Moves the store to the globalThis pattern already used by thinkingBudget.ts and systemPrompt.ts. Runtime stats are never restored from the persisted blob. Note the hydration is wired into instrumentation-node.ts, not the unused src/server-init.ts. * docs(changelog): add fragment for #8604 task-routing boot restore * fix(sse): route task-aware defaults by intent, guard fitness pattern order (#8602, #8603) Two related defects in the hand-maintained model-quality tables. #8602 — DEFAULT_TASK_MODEL_MAP hardcoded literal provider/model ids (openai/gpt-4o, gemini/gemini-2.5-flash-lite, deepseek/deepseek-chat, ...). Wrong twice over: the ids rotted by a generation or two, and applyTaskAwareRouting overwrites body.model directly, so a literal target skipped auto-combo's 13-factor scoring (quota, circuit-breaker health, cost, latency, stability), connection cooldown and model lockout — hard-failing for any operator with no connection for that provider. Refreshing the strings would only reset the rot clock, so the defaults now name auto/* INTENTS that resolve against the operator's actually connected backends: coding -> auto/coding analysis -> auto/reasoning vision -> auto/vision summarization -> auto/chat:fast background -> auto/chat:cheap creative and chat stay pass-through. Operators can still pin a specific model via PUT /api/settings/task-routing; only the shipped defaults change. No provider/model literal remains in the module. #8603 — the pattern-shadowing fix LANDED UPSTREAM while this PR was open (9f5be229b, Train 1D). lookupStaticFitnessTable now ranks patterns longest-first, so gpt-4o-mini no longer inherits gpt-4o's 0.9 and deepseek-v3.2 no longer inherits deepseek-v3's 0.85. This PR therefore no longer changes that behaviour — the upstream scan is kept verbatim. What remains for #8603 is the regression guard. The resolution chain hits the DB (user_override / arena_elo / models.dev tier) before reaching layer 4, so asserting the ordering through getTaskFitness would depend on DB fixture state. The layer is exposed as getStaticFitnessTableScore and pinned directly by taskFitness-pattern-order-8603.test.ts (7 cases), so the guarantee survives future edits to FITNESS_TABLE. Those 7 cases were written against this PR's original implementation and pass unchanged against the upstream one — independent confirmation that the two are behaviourally equivalent. * docs(changelog): add fragment for #8605 task-routing intent + fitness order * fix(auth): tag internal/loopback-origin failed logins in the audit log (#8606) * fix(auth): tag internal/loopback-origin failed logins in the audit log Failed dashboard logins (`auth.login.failed`) are emitted only after a submitted, non-empty password fails verification, and the recorded IP is accurate. On a single-process deployment with no reverse proxy, a loopback / private source IP therefore means the attempt genuinely originated on the box or the LAN (someone browsing http://localhost and mistyping, or a browser autofill replaying a stale password) — but the Audit Log had no way to distinguish those from an external intrusion attempt, so they read as suspicious noise. Add `classifyIpScope()` to `ipUtils` (loopback / private / public / unknown, using bounded string-prefix checks — ReDoS-safe) and stamp `sourceScope` + `internalOrigin` onto the `auth.login.failed` audit metadata so the audit view can label internal-origin failures distinctly. No change to which events are written or to IP attribution. Closes #8336 * test(auth): assert the new origin tags on the failed-login audit event This PR tags failed logins with sourceScope/internalOrigin, but the pre-existing admin-audit-events assertion still deepEqual'd the old two-field metadata shape and broke. The request under test carries a public x-forwarded-for, so the expected tags are sourceScope: "public" and internalOrigin: false — the assertion stays strict, it just covers the fields this PR introduces. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(providers): flatten multi-turn history for gemini-web (#8371) (#8607) gemini-web is a stateless Web Cookie provider: it drives a real browser page and captures only the first StreamGenerate response, so it has no upstream conversation id to thread across turns. The no-tools path forwarded only the last user message (`messages.filter(m => m.role === "user").pop()`), so follow-up questions lost all prior context — e.g. "I am in Berlin" then "What should I wear today?" was answered without Berlin. Implement the issue's accepted fallback (b): flatten the full messages history into the single prompt typed into the web UI, emitting a labeled System / Previous conversation / Current user message transcript. Single-turn requests are preserved byte-for-byte (only the final user message is returned), keeping the #7286 no-tools regression guard intact. Applies uniformly to streaming and non-streaming since both derive from the same `prompt`. claude-web already threads context via its conversation cache (session.ts, #8230) and needs no change. Closes #8371 * fix(providers): declare explicit OpenCode plugin feature-flag defaults (#8608) The OpenCode plugin `features` block (opencode.json) marks every toggle `.optional()` with no default, and the effective value is applied implicitly at each read site via the scattered `features.X !== false` (default-ON) / `features.X === true` (default-OFF) convention. An operator who omits the `features` block therefore cannot tell whether combos / autoCombos / enrichment are enabled — they read the `autoCombos=0` startup diagnostic (a count that can be 0 for reasons unrelated to the flags, e.g. missing auth) and conclude the features are disabled when they are actually on. Declare the defaults explicitly in one place and surface the effective flags: - `OMNIROUTE_FEATURE_DEFAULTS` — the declared default state for every boolean `features.*` toggle, mirroring the existing read-site conventions exactly (runtime routing behaviour unchanged). - `resolveEffectiveFeatureFlags(features)` — derives the effective boolean state for any (possibly-undefined) features object. - Startup diagnostics now emit a `features(effective): ...` line so an operator who omitted the block can see combos/autoCombos/enrichment are on. Purely additive: no read site changes, so the existing `features: {} → {}` schema pass-through contract is preserved. Closes #7624 * fix(providers): complete OpenCode Go effort alias exposure (#8610) * fix(providers): complete OpenCode Go effort aliases * chore: number OpenCode Go changelog fragment * fix(ci): use webpack fallback for Node 26 compat build to stop OOM (#8611) The `compat-build-26` job in nightly-compat.yml is the only place in the CI matrix that runs `npm run build` on Node 26 (ci.yml pins CI_NODE_VERSION=24). It failed every nightly with the runner-reclaimed signature ("The runner has received a shutdown signal" / "The operation was canceled", no exit code), always at the same Turbopack compile phase — the classic OOM-kill pattern on the memory-constrained ubuntu-latest runner. Root cause: Turbopack's native (Rust, off-V8-heap) allocation is not bounded by --max-old-space-size and peaks far higher than webpack on OmniRoute's large module graph (#6409), heavier still under Node 26. Raising the heap does not help — the codebase's own documented escape hatch for RAM-constrained environments is the webpack fallback (OMNIROUTE_USE_TURBOPACK=0; see docs/reference/ENVIRONMENT.md and scripts/build/build-next-isolated.mjs). Wire that fallback into the Node 26 compat build: it still validates the app builds on Node 26 (the point of the job) at a much lower memory peak. Turbopack-on-Node-24 stays covered by ci.yml's build job. Adds a regression guard (tests/unit/nightly-compat-node26-webpack-8090.test.ts) asserting the job keeps the webpack fallback so it cannot silently regress. Class 1 of the triage (shard test failures) was already resolved by #8390, #8386, #8381, #8383. Closes #8090 Refs #6949 #6409 * feat(ci): automate ratchet shrink-banking so caps stop outliving their files (#8584) (#8612) * feat(ci): automate ratchet shrink-banking on the release branch (#8584) The quality ratchet is only half automatic, and it is the wrong half. Raising a cap is a manual JSON edit that takes ten seconds and is the fastest way to unblock a red PR. Lowering one requires someone to run `--update` and commit the result — and no workflow does: grepping `.github/workflows/` for `--update` finds only wiki-sync.yml (unrelated) and ci.yml's check-quality-ratchet.mjs --require-tighten (a different script against a different metric). Measured on release/v3.8.49 at4053e2314: 18 frozen files already at or under the 800-line new-file cap, the worst at 132x (src/shared/validation/schemas.ts, 19 lines carrying a 2,523 cap); the complexity ceiling walked 1794 -> 2169 across ~37 rebaseline notes with exactly one decrease (-1); "tighten via --update next cycle" written 31 times and honoured once in six weeks. A cap that outlives the code that earned it converts every completed decomposition into a growth allowance for whoever edits that file next. New job `bank-ratchet-shrinks` in nightly-release-green.yml measures the active release branch, runs the two shrink-only `--update` paths, and opens ONE always-current PR with the result. Schedule/dispatch only, deliberately not on push: banking has no latency requirement, while a per-merge run would rebuild the PR branch during merge campaigns and pay for a full ESLint walk each time. Detection stays on push (release-green); only banking is batched. The job never pushes to release/* — a human merges, so a bad measurement cannot land unreviewed. scripts/quality/verify-ratchet-bank.mjs is the hard guarantee that the automation can only ever write downward. It diffs the post-`--update` tree against HEAD and aborts the job before a commit exists — opening no PR — unless every change is a frozen/testFrozen entry lowered or removed, `count` lowered, or cognitiveComplexity.value lowered. Raising a number, adding an entry, changing cap/testCap, or deleting/rewriting a `_rebaseline_*` note all fail. A bot that could raise a cap would be strictly worse than the status quo. Verified both directions against the real baselines: --update + verifier reports 77 lowered / 14 removed / nothing raised, exit 0; hand-raising chatCore.ts to 9999 and cap to 1200 is rejected with exit 1. 22 unit tests cover each way the automation could go wrong. No product code changes. * chore(skills): sync cli-backup-sync SKILL.md after rebase onto tip * fix(resilience): report local queue expiry as unavailable (#8613) * fix(resilience): report local queue expiry as unavailable * docs(changelog): document queue expiry status * fix(docker): honor OMNIROUTE_BASE_PATH behind reverse-proxy subpaths (#8615) * fix(docker): honor OMNIROUTE_BASE_PATH behind reverse-proxy subpaths Next.js basePath is compile-time state; Docker now records the baked value, forwards the env var as a build-arg, patches root-path images at container start when needed, and probes health under the active subpath. Hard Rule #13: scripts/docker/patch-basepath.sh and the entrypoint invoke Node with a fixed argv; OMNIROUTE_BASE_PATH is read from process.env only — never interpolated into sed/awk. Closes #8600 * fix(docs): unblock CI for Docker basePath guide Describe the build-time basePath marker as a sentinel file instead of a fabricated env var, and replace the unsupported ```env fence with bash so fumadocs/Shiki can compile DOCKER_GUIDE.md during DAST smoke. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(docker): add changelog fragment for #8615 basePath bundle patch Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(resilience): recover idle wedged limiters (#8616) * chore(resilience): log queue state on expiry * docs(changelog): document rate limiter instrumentation * fix(resilience): recover idle wedged limiters * chore(resilience): remove diagnostic queue logging * fix(claude): classify native subscription quota 429 (#8628) Co-authored-by: Escalada Online <aescaladaonline@gmail.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * fix(providers): recover Kimi after quota reset (#8632) * fix(providers): recover Kimi after quota reset * docs: add Kimi quota recovery changelog * fix(windows): request shell when spawning bare qoder binary name on Windows (fixes #8590) (#8633) * fix(windows): request shell when spawning bare qoder binary name on Windows (fixes #8590) Post Node CVE-2024-27980, spawn('qodercli', [], { shell: false }) fails with ENOENT on Windows when command is a bare binary name without extension. Enabling shell mode for bare command names allows cmd.exe to resolve .cmd / .bat wrappers from PATH. * fix(windows): ensure windowsHide: true on open-sse qoder/devin child spawns --------- Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local> * fix(middleware): declare withInjectionGuard's context parameter optional (#8644) All five diagnostics in src/lib/batches/dispatch.ts are the same: Type '(request: any, context: any) => Promise<any>' is not assignable to type 'BatchRouteHandler'. Target signature provides too few arguments. Expected 2 or more, but got 1. `withInjectionGuard()` returns `guardedHandler(request, context: any)` with the second parameter required, so every route it wraps advertises arity 2. The batch dispatcher's `BatchRouteHandler` is `(request: Request) => …`, and TS rejects assigning a function that needs an argument the caller will never supply. The declaration was wrong about its own runtime. `dispatch.ts:48` already calls `handler(request)` with one argument, and has been doing so in production; `context` is only forwarded to the inner handler, where routes that do not read it get `undefined`. Marking it `context?: any` states what was already true. 208 -> 203, zero new, on a line-number-agnostic diff of the full tsc error set. One character; nothing executable changed. No test added: the one-argument call path is the existing behaviour and is already covered — embeddings-auth.test.ts and embeddings-route-apikeymeta-6929 call `POST(req)` directly through withInjectionGuard, which is exactly the arity this now permits. 370/370 across the 43 injection-guard / batch / embeddings / moderation suites; typecheck:core, eslint and check:file-size clean. Co-authored-by: backryun <busan011@ormbiz.co.kr> * refactor(sse): peel the bare Response off handleChatCore's union in responsesHandler (#8647) `handleChatCore` returns a union that includes a bare `Response` alongside the `{ success, response, … }` envelopes — early returns that never build one. responsesHandler read `result.success` / `result.response` straight off it, so three diagnostics fired on the `Response` arm, which has neither. Added an `instanceof Response` guard before the envelope checks. The outcome is unchanged: a bare Response already fell through `!result.success` (undefined, so truthy under `!`) and was returned as-is; it is now returned one branch earlier, explicitly. 208 -> 205, zero new, on a line-number-agnostic diff of the full tsc error set. The other two diagnostics in this file are left alone on purpose. Declaring convertResponsesApiFormat's return type fixes them, but immediately surfaces the next masked error at the handleChatCore call — `onStreamFailure` is declared required in that parameter object while responsesHandler has always omitted it in production. Fixing that means touching chatCore's signature, which belongs with the chatCore work rather than a three-line guard. Measured 5 fixed / 1 new and reverted, keeping the zero-new invariant. No new tests: the guard adds a branch that returns the same value the fall- through already returned, and the bare-Response path is exercised by the 400 tests in the responses suites, all passing. Co-authored-by: backryun <busan011@ormbiz.co.kr> * fix(autoCombo): handle missing model_capabilities table in taskFitness (#8603) (#8650) Check if model_capabilities table exists in SQLite before running SELECT query in loadModelCapabilities to prevent SQL error when the table has not been created yet. Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local> * chore(skills): regenerate cli-backup-sync SKILL.md to match catalog (#8657) * chore(skills): regenerate cli-backup-sync SKILL.md to match catalog check:agent-skills-sync was failing on release/v3.8.49 tip because the generated SKILL.md still documented backup-status flags the catalog no longer exposes. Re-run generate-agent-skills --apply (9-line delete only). * docs(changelog): add fragment for #8657 agent-skills sync * chore(quality): re-pin file-size ceilings after merge-train 1H + fix stryker drift file-size: nine frozen entries could not absorb the combined result of the 31-PR train. Two distinct causes, kept apart in the baseline note on purpose: (1) GENUINE irreducible growth at existing chokepoints — providerLimits/auth (#8632), rateLimitManager (#8616), models-catalog-route.test (#8610). (2) COLLISION with #8585, which banked shrinks measured on the pre-train release tip while 30 sibling PRs in the SAME train grew those files again — chat/accountFallback (#8628), chatCore (#8613), videoGeneration (#8581), imageGeneration. Ceilings re-pinned to the post-merge tip. #8612 (also in this train) automates shrink-banking so this self-inflicted drift stops recurring. stryker: three covering unit tests were missing from tap.testFiles — isLocalStreamLifecycleError-abort-shape (circuitBreaker.ts, a shared base-red that was reddening Fast Quality Gates on every open PR), noauth-autocombo-lockout-7623 (accountFallback.ts) and kimi-quota-reset-recovery (auth.ts), the latter two landed with this train. * refactor(sse): extract combo target resolution into combo/targetResolution.ts (#8592) * refactor(sse): extract combo dispatch prelude into combo/dispatchPrelude.ts Pure move, no behaviour change. First of ~7 PRs decomposing the combo.ts god-file (#3501). handleComboChat evaluates a series of dispatch branches before it ever reaches target resolution or the sequential attempt loop. None of them iterate targets in priority order or need the failover/retry/credential gate machinery that follows, so they move to a leaf: - context-cache pin routing (Fix #679), including the pinIsDurablyUnhealthy / isPinnedModelDurablyUnhealthy health gate - fusion panel dispatch + the #6455 misconfiguration warn - pipeline chaining - nested combo-ref execute-mode runtime-unit dispatch Only the chaos and round-robin hand-offs stay inline (11 and 13 lines); extracting those would be pure indirection. open-sse/services/combo.ts 3642 -> 3341 (-301) open-sse/services/combo/dispatchPrelude.ts: 619 (under the 800 cap) Each helper keeps the fall-through protocol the inline blocks had: return a Response to OWN the request, return null to fall through. A flipped null/Response would silently bypass the whole combo strategy, so the new tests pin both directions for every branch. combo.ts re-exports pinIsDurablyUnhealthy so combo-pin-health-gate.test.ts keeps resolving. The leaf takes handleComboChat as a `runCombo` parameter instead of importing it, so combo/ keeps zero back-edges into combo.ts. Complexity-neutral: the first cut added +3 violations (two max-lines-per-function, one complexity) inside the new leaf, so evaluatePinnedResponse, orderRuntimeUnits, recordRuntimeUnitStickySuccess and buildBaseOptions were split out. check:complexity now measures 2169 and check:cognitive-complexity 956 — identical to the pristine base. * test(sse): close the dispatch-prelude coverage holes found by mutation testing An adversarial mutation audit of the suite added in the previous commit found it guarded the fall-through protocol well but asserted almost nothing about what the helpers do once they OWN the request. 5 of 12 seeded mutations survived. Worst case: deleting the pinned-model dispatch call outright left all 12 tests green. Three holes, now closed (8 tests -> 20): Hole A — the honored-pin path had zero coverage. Both existing pin tests DROP the pin, so the dispatch, the 200-but-empty quality gate, the [408, 429, 500, 502, 503, 504] failover list and the catch(pinErr) branch were unguarded — exactly the logic the 2026-06-21 / 2026-06-22 incident comments call load-bearing. Adds five tests over a seeded healthy provider connection so the pin is actually honored. Hole B — orderRuntimeUnits was only ever driven with `priority`, which is a no-op through it. Four of five strategy branches could be deleted with nothing failing. Adds round-robin rotation and weighted sticky ordering tests. Hole C — recordRuntimeUnitStickySuccess never did anything under test: both its guards need weighted/round-robin, so an early return changed nothing. Covered by the new sticky-batch test. Verified by re-running the mutations rather than assuming: all 7 that previously survived (delete-pin-dispatch, serve-despite-failed-quality, never-fail-over-on-transient, rr-counter-not-advanced, rotation-removed, weighted-sticky-skipped, sticky-recording-no-op) are now killed. The first sticky-batch test I wrote was itself vacuous — asserting "same unit twice" holds equally when the recording helper is stubbed out, since nothing advances the counter either. It now asserts the batch runs out and rotation resumes on the third dispatch, which is what actually distinguishes the two. Also restores API_KEY_SECRET in test.after; it was set at module load and never put back, inconsistent with the DATA_DIR handling beside it. * fix(ci): teach known-symbols gate the relocated fusion/pipeline dispatch The combo sub-check of check:known-symbols asserts every canonical routing strategy has a real dispatch branch. It scanned a hardcoded file list and matched only `strategy === "..."`, so the prelude extraction tripped it twice: [combo] 2 estratégia(s) canônica(s) sem branch de despacho em combo.ts: ✗ fusion ✗ pipeline Both branches are still wired — they just moved to combo/dispatchPrelude.ts and took the early-return guard form `if (strategy !== "fusion") return null;` that extracting a branch into a `tryXDispatch()` leaf naturally produces. Two changes, both extending existing precedent (the list already carries the Block J leaves for the same reason): - register combo/dispatchPrelude.ts in comboDispatchFiles - widen the extractor to `strategy [!=]== "..."` so the inverted guard counts Loose `==`/`!=` stay rejected, and no `handledNotCanonical` fallout: the gate now reports 20 canonical strategies, all 20 via despacho. * chore(ci): register combo-dispatch-prelude test in stryker tap.testFiles check:mutation-test-coverage --strict failed once the known-symbols fix let Fast Quality Gates advance to it: ✗ 2 covering unit test(s) across 2 module(s) are missing from stryker.conf.json tap.testFiles open-sse/services/combo/comboStructure.ts open-sse/services/combo/rrState.ts The new tests/unit/combo-dispatch-prelude.test.ts exercises both modules, and both are already in stryker's mutate list, so without the registration its mutant kills would not have counted toward the nightly mutation gate. Note (unchanged, still out of scope): combo/dispatchPrelude.ts itself is not in stryker's `mutate` list. Adding it would widen the nightly mutation surface, which is a separate call from fixing this drift. * docs(changelog): add fragment for #8582 combo dispatch prelude * refactor(sse): extract combo target resolution into combo/targetResolution.ts Pure move, no behaviour change. Lifts the target-resolution stage of handleComboChat — everything between the dispatch prelude and the attempt loop — into a new leaf, open-sse/services/combo/targetResolution.ts. Moved verbatim: provider-wildcard expansion, weighted step-group resolution + sticky-weighted eligibility, request-tag routing, the known-context-overflow early return, the smart/pipeline-enabled auto dispatch, auto-strategy ordering, per-strategy ordering, cache-strategy affinity, session stickiness, eval scores, request-compatibility + context-requirement filters, task-aware reordering, prompt-cache affinity, and the priority-strategy pre-screen. The three early exits become an { earlyResponse } result so the host decides to return them (same pattern as resolveAutoStrategyOrder). The values the attempt loop still reads — orderedTargets, stickyWeightedLimit, getWeightedStepKeyForTarget, the session-stickiness result and preScreenMap — are returned instead of closed over. Loop config (maxRetries, retryDelayMs, fallbackDelayMs, maxSetRetries, setRetryDelayMs) stays in combo.ts. buildAutoCandidates is dependency-injected because it lives in combo.ts, so the leaf keeps zero back-edges into its host. combo.ts 3640 -> 3321 lines; new leaf 484 lines (under the 800 cap). Part of the #3501 god-file decomposition campaign. * refactor(sse): split targetResolution into stage helpers, ratchet combo.ts file-size baseline Follow-up to the target-resolution extraction: the moved region landed as one 311-line function, which converted inline code inside the (already-violating) handleComboChat into a NEW separately-counted violating function — check:complexity 2169 -> 2171 and check:cognitive-complexity 956 -> 957. Split resolveComboTargetPipeline along its natural stage boundaries into 14 helpers (wildcard expansion, weighted eviction/eligibility/sticky-key/selection, step-key mapper, context-overflow response, pool-size log, smart-pipeline dispatch and its fall-through logger, strategy ordering, continuity filters, task-aware ordering, prompt-cache enablement/first-target protection/affinity stage). Each stage takes the previous stage's output and returns the next; still a pure move. The leaf now contributes ZERO complexity, max-lines-per-function and cognitive-complexity violations. Both ratchets are back at base4053e2314values: check:complexity 2169, check:cognitive-complexity 956. (Both still print RED against their frozen ceilings 2130/951 — pre-existing base-red per #8580.) Also ratchets ONLY the open-sse/services/combo.ts entry in config/quality/file-size-baseline.json from 3642 to 3322, with a justification note in the file's existing style. No sweep of unrelated entries. * chore: stack targetResolution on dispatchPrelude tip, rebank + skills Rebased onto refactor/combo-dispatch-prelude. Keep both leaves in check-known-symbols. Regenerate file-size baseline; sync agent skills. * fix(sse): restore #8494 capability fail-closed after targetResolution extract Stacking targetResolution onto the dispatchPrelude tip dropped the #8488/#8494 compatFilterFailOpen wiring: hard capability filters emptied the pool into a generic 404 no_executable_targets, and fail-open never re-admitted the pool. Restore describeCapabilityFilterExhaustion earlyResponse in applyContinuityFilters and the matching round-robin path, then rebank the file-size baseline for tip growth the incomplete prior rebank missed. * fix(sse): realign model-lockout cooldown options with the post-#8254 type This branch predates #8254, which renamed the recordModelLockoutFailure option `exactCooldownVerified` -> `exactCooldownIsUpstreamReset` and changed combo.ts's predicate from `lockoutHintVerified` (#8393's `lockoutHintMs > 0`) to `lockoutHintMs > mlSettings.baseCooldownMs`. Rebasing onto the current tip brought the renamed type without updating these two call sites, so typecheck:core failed with TS2353 at both. Restores the base expression verbatim rather than re-wiring `lockoutHintVerified` under the new name. The base predicate is the correct one: selectLockoutCooldownMs returns the parsed hint ONLY when `lockoutHintMs > baseCooldownMs`, and otherwise returns 0 or a synthetic baseCooldownMs — so `lockoutHintMs > 0` would mark a synthetic cooldown as an upstream reset and let it bypass the #7940 maxCooldownMs cap, which is the bug #8254 fixed. --------- Co-authored-by: MumuTW <johnsxn.us@gmail.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(pack): list ensureAndroidCacheDir.mjs in the pack-artifact fixture #8593 registered bin/cli/utils/ensureAndroidCacheDir.mjs in PACK_ARTIFACT_REQUIRED_PATHS so the Android/Termux cache module cannot silently drop out of the npm tarball. Three test files read that list; only pack-artifact-entrypoint-closures.test.ts derives it dynamically. This one hardcodes the expected set, so it went red on a correct change. Adding the entry here, not relaxing the assertion — a hardcoded fixture is what makes an accidental REMOVAL from the required-paths list loud, which is the whole point of the guard. * fix(sse): compact Responses multi-turn images before context hard-reject (#8560) (#8595) * fix(sse): compact Responses multi-turn images before context hard-reject (#8560) Codex Desktop sessions near the 372k input cap were rejected on the second inline image because compressContext no-op'd on Responses input[] and never pruned older vision turns. Adapt via bodyAdapter, prune older images while keeping the latest, and run last-resort compaction before the budget check. * docs(env): document CONTEXT_KEEP_LATEST_IMAGES for #8560 Keep check:env-doc-sync green after the context image-pruning override. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * deps: bump electron from 43.1.1 to 43.2.0 in /electron (#8782) Bumps [electron](https://github.com/electron/electron) from 43.1.1 to 43.2.0. - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v43.1.1...v43.2.0) --- updated-dependencies: - dependency-name: electron dependency-version: 43.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * deps: bump the production group across 1 directory with 18 updates (#8793) Bumps the production group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1091.0` | `3.1096.0` | | [@lobehub/icons](https://github.com/lobehub/lobe-icons) | `5.14.0` | `5.15.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` | | [@toon-format/toon](https://github.com/toon-format/toon) | `2.3.1` | `4.1.0` | | [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.11.5` | `16.13.0` | | [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.11.5` | `16.13.0` | | [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.4` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.27.0` | | [material-symbols](https://github.com/marella/material-symbols/tree/HEAD/material-symbols) | `0.45.8` | `0.45.9` | | [next](https://github.com/vercel/next.js) | `16.2.11` | `16.2.12` | | [next-intl](https://github.com/amannn/next-intl) | `4.13.3` | `4.13.4` | | [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [react-is](https://github.com/react/react/tree/HEAD/packages/react-is) | `19.2.7` | `19.2.8` | | [recharts](https://github.com/recharts/recharts) | `3.10.0` | `3.10.1` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.0` | `1.7.1` | | [undici](https://github.com/nodejs/undici) | `8.8.0` | `8.9.0` | Updates `@aws-sdk/client-bedrock-runtime` from 3.1091.0 to 3.1096.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-bedrock-runtime) Updates `@lobehub/icons` from 5.14.0 to 5.15.0 - [Release notes](https://github.com/lobehub/lobe-icons/releases) - [Changelog](https://github.com/lobehub/lobe-icons/blob/master/CHANGELOG.md) - [Commits](https://github.com/lobehub/lobe-icons/compare/v5.14.0...v5.15.0) Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0) Updates `@toon-format/toon` from 2.3.1 to 4.1.0 - [Release notes](https://github.com/toon-format/toon/releases) - [Commits](https://github.com/toon-format/toon/compare/v2.3.1...v4.1.0) Updates `fumadocs-core` from 16.11.5 to 16.13.0 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.11.5...fumadocs@16.13.0) Updates `fumadocs-ui` from 16.11.5 to 16.13.0 - [Release notes](https://github.com/fuma-nama/fumadocs/releases) - [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs@16.11.5...fumadocs@16.13.0) Updates `jose` from 6.2.3 to 6.2.4 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](https://github.com/panva/jose/compare/v6.2.3...v6.2.4) Updates `lucide-react` from 1.25.0 to 1.27.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.27.0/packages/lucide-react) Updates `material-symbols` from 0.45.8 to 0.45.9 - [Release notes](https://github.com/marella/material-symbols/releases) - [Commits](https://github.com/marella/material-symbols/commits/v0.45.9/material-symbols) Updates `next` from 16.2.11 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12) Updates `next-intl` from 4.13.3 to 4.13.4 - [Release notes](https://github.com/amannn/next-intl/releases) - [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md) - [Commits](https://github.com/amannn/next-intl/compare/v4.13.3...v4.13.4) Updates `playwright` from 1.61.1 to 1.62.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.61.1...v1.62.0) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `react-is` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-is) Updates `recharts` from 3.10.0 to 3.10.1 - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](https://github.com/recharts/recharts/compare/v3.10.0...v3.10.1) Updates `smol-toml` from 1.7.0 to 1.7.1 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](https://github.com/squirrelchat/smol-toml/compare/v1.7.0...v1.7.1) Updates `undici` from 8.8.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.8.0...v8.9.0) --- updated-dependencies: - dependency-name: "@aws-sdk/client-bedrock-runtime" dependency-version: 3.1096.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@lobehub/icons" dependency-version: 5.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@toon-format/toon" dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: fumadocs-core dependency-version: 16.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: fumadocs-ui dependency-version: 16.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: jose dependency-version: 6.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: lucide-react dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: material-symbols dependency-version: 0.45.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: next-intl dependency-version: 4.13.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: playwright dependency-version: 1.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: react-is dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: recharts dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: smol-toml dependency-version: 1.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(resilience): add UND_ERR_SOCKET to PROXY_UNREACHABLE_ERROR_CODES (#8788) (#8795) Fixes #8788. - Added 'UND_ERR_SOCKET' to PROXY_UNREACHABLE_ERROR_CODES so socket disconnects and mid-stream closes are properly tagged with code PROXY_UNREACHABLE and errorCode proxy_unreachable. - Ensured tagProxyUnreachable normalizes error code to PROXY_UNREACHABLE and errorCode to proxy_unreachable when catching socket-level disconnects. - Added test in proxyfetch-undici-retry.test.ts verifying UND_ERR_SOCKET classification. * fix(resilience): keep resource 404s from cooling models (#8756) * fix(hyperagent): sticky thread for agentic tool loops (Claude Code) (#8470) * fix(hyperagent): sticky thread for agentic tool loops (Claude Code) Follow-up to #7994. When a reverse-conversion proxy rewrites assistant text between turns (Intent+JSON -> native tool_calls -> re-serialized tool text), conversationFingerprint(prefix) no longer matches the key stored after turn 1, so HyperAgent created a new thread and multi-turn tool results appeared as a cold start. - Key sticky sessions by root user task (normalize pin wrappers) - Flatten Anthropic tool_use / tool_result for lastUserText + fingerprints - Regression tests for mutated-assistant tool loops Tests: tests/unit/executor-hyperagent.test.ts (19/19) * chore(quality): rebaseline for PR #8470 own-growth (hyperagent sticky thread) open-sse/executors/hyperagent.ts grows 937->1026 lines and gains one new cognitive/cyclomatic-complexity violation (extractMessageText, from the new Anthropic tool_use/tool_result flattening branches) on top of inherited base-tip drift already present on origin/release/v3.8.49 (file-size was already at cap; cognitive-complexity 951->956 and cyclomatic-complexity 2130->2169 drift predates this PR). Rebaselined file-size to 1026, cognitiveComplexity to 957, complexity count to 2170, matching measured values on the merged tree. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(client): rewrite absolute fetch/EventSource paths under basePath (#8515) * fix(client): rewrite absolute fetch/EventSource paths under basePath Absolute browser calls like fetch("/api/...") and new EventSource("/api/...") do not honor Next.js basePath, so subpath deploys (OMNIROUTE_BASE_PATH) break dashboard health checks, settings APIs, and SSE unless a reverse proxy rewrites the domain root. - Add withBasePath / getDeployBasePath helpers - Install ref-counted fetch + EventSource rewrite when basePath is set (same pattern as installDashboardCsrfFetch) - Mount BasePathNetworkProvider at the root so login works too - Mirror OMNIROUTE_BASE_PATH to NEXT_PUBLIC_OMNIROUTE_BASE_PATH for the client - Document in .env.example; unit tests for rewrite rules * docs(changelog): add fragment for #8515 basePath client fetch * test(client): move basePath tests into a scanned dir and fix no-op call-shape asserts Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(client-sweep-8515): restore CHANGELOG #8471 bullet and fix basePath TS2322 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: rqzbeh <rqzbeh@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * chore(quality): re-pin chatCore.ts ceiling after merge-train 2 #8595 (compact Responses multi-turn images before the context hard-reject) grows open-sse/handlers/chatCore.ts 4955 -> 5006. The growth is irreducible at the existing compaction chokepoint: a last-resort retry against the concrete token budget plus the estimateFinalInputTokens helper, both wired into the pre-existing call site rather than a new branch. Covered by tests/unit/8560-responses-image-compaction.test.ts. * fix(combo): fail open when strict context filter empties unknown-only pools (#8786) (#8798) Strict contextFilterMode excluded every target whose context limit was missing from the capability catalog, so otherwise-executable combos returned 404 no_executable_targets. Restore unknown-context targets when no known-good survivor remains, surface context_requirements_exhausted from targetResolution, and keep the empty-pool payload in pinRecovery after the #8592 split. * fix(resilience): honor Cloudflare 1010 retryable:false — skip COOLDOWN_RETRY (#8775) (#8800) Api-key 403 bodies with Cloudflare error 1010 / browser_signature_banned / retryable:false were treated as short AUTH_ERROR cooldowns, so the chat loop waited ~21–33s before falling through. Return cooldownMs:0 so the tier fails fast without permanently banning the account. * fix(dashboard): restore Usage Model Breakdown column sorting (#8769) (#8802) Extract ModelTable from the charts god-file and drive header clicks through a single sort state object plus a pure sorter so column toggles reliably reorder rows. Compute missing share pct from summary totals when the analytics API omits it. * fix(api): treat cx/* and codex/* as equivalent API-key model permissions (#8805) Dashboard Codex restrictions use the public cx/ alias while /v1/responses normalizes bare Codex IDs to codex/, so allow/block checks falsely 403'd. Expand permission candidates via the provider registry alias map. Closes #8803 * fix(sse): pass real response payload into plugin onResponse hooks (#8806) Plugins always received a hard-coded {status:200} stub, so hooks like request-logger never saw response bodies. Forward translated JSON for non-streaming completions and a streamed flag for SSE without reading the body twice. Closes #8711 * fix(types): export web executor types from their module (#8810) * fix(types): preserve reasoning policy record shapes (#8811) * fix(types): preserve compression detail config shapes (#8812) * fix(types): declare virtual chaos combo config (#8815) * fix(electron): use NEXT_DIST_DIR when stripping stale native modules (#8794) removeNativeModules() was called with a hardcoded ".next" path while the actual distDir is NEXT_DIST_DIR (".build/next" by default). Because the function early-returns when the directory does not exist, the cleanup silently no-opped and the plain-Node-ABI better-sqlite3 copy produced by `next build` survived into the packaged app. At runtime the standalone server runs under ELECTRON_RUN_AS_NODE, so it needs the Electron ABI (148 for electron 43). Loading the ABI-137 copy fails with ERR_DLOPEN_FAILED, the app falls back to the sql.js WASM driver, the connection is closed and retried in a loop, WASM memory is never reclaimed and the process OOMs -> HTTP 500 on every route. Also adds assertNoStaleHashedNatives() so a wrong baseDir fails the build instead of silently shipping a broken installer. This has regressed at least twice (#1497 with ABI 127 vs 145, #7082/#7681 with 137 vs 148). Refs #7082, #7681, #1497, #8792. Supersedes the abandoned #7123. * feat(search): add Firecrawl search provider (#8814) * feat(search): add Firecrawl search provider Introduce the Firecrawl search provider to handle `POST /v1/search` requests via Firecrawl /v2/search API (sources: web|news) * chore(changelog): add changelog on firecrawl search provider support * fix(search): satisfy file-size freeze and APIKEY count --------- Co-authored-by: allanvb <allanvb@users.noreply.github.com> * fix(api): enforce image generation API key auth (#8306) * fix(api): enforce image generation API key auth * fix(api): align image route auth guard with clientApiPolicy The route-level guard added for image generation was stricter than the authz middleware that already fronts /api/v1/* (src/proxy.ts → clientApiPolicy), so requests the pipeline admits were 401'd by the handler: - A cookie-authenticated dashboard session was rejected under REQUIRE_API_KEY=true. The dashboard Media page (dashboard/cache/media) and the Playground call these routes with a session and no Bearer — the same mismatch already fixed for /api/playground/presets. - A presented invalid key was rejected even with REQUIRE_API_KEY=false, where clientApiPolicy (#2257) and the sibling /v1/embeddings and /v1/web/fetch routes degrade a stale CLI key to anonymous instead. Extract the shared guard into shared/utils/clientApiRouteAuth so both image routes (and future /v1 handlers) mirror the middleware contract instead of re-deriving it, and drop the now-dead auth imports. Also switch the call-log attribution fallback back to `||`: with `??`, an empty-string apiKeyId/apiKeyName would be persisted verbatim and would block the request-scoped context, which the previous `entry.apiKeyId || null` never did. Tests: cover the dashboard-session and keyless-mode-invalid-key branches, and split the auth/attribution cases into image-generation-route-auth.test.ts to stay under the 800-line new-test-file cap. Co-authored-by: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: alexey.nazarov@softmg.ru <alexey.nazarov@softmg.ru> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): remove quadratic trailing-slash trim in Alibaba endpoint normalization (#8333) CodeQL js/polynomial-redos (alerts #765/#766). `/\/+$/` has no left anchor, so the engine retries the match at every start offset and each attempt re-walks the whole slash run before failing `$` — O(n^2) on a connection baseUrl made of many slashes. Measured on the vulnerable code: 10k slashes = 102ms, 30k = 968ms, 60k = 4028ms (clean quadratic); through the public resolvers the same input took 22s. providerSpecificData.baseUrl is operator-supplied config and reaches the trim via isFamilyPresetUrl() -> normalizeEndpoint() and both resolve*Url() helpers, so the input is reachable. Replaces all three identical occurrences with a linear charCodeAt scan. CodeQL only flagged two of them; the third (resolveAlibabaProviderModelsUrl) carries the same defect and is fixed here rather than left behind. Behavior is unchanged: every trailing slash is still removed (not a bounded subset), interior slashes are preserved, and an all-slash string still collapses to empty — asserted by the new behavior test. * chore(quality): re-pin ceilings after merge-train 3 + register CF-1010 test file-size: apiKeys.ts 1518 -> 1529 (#8805, treating cx/* and codex/* as equivalent provider prefixes in API-key model permissions) and chatCore.ts 5006 -> 5020 (#8806, passing the real response payload into plugin onResponse hooks instead of a hardcoded {status:200}). Both extend existing call sites rather than adding a branch. stryker: account-fallback-cf1010-no-retry-8775.test.ts covers accountFallback.ts but was missing from tap.testFiles, which would redden Fast Quality Gates on every subsequent PR. * fix(types): type memory skills injection logger (#8816) * fix(types): align web fallback contracts (#8819) * fix(types): declare idempotency input contracts (#8820) * test(quality): fail loudly when a source-scanning guard is negative-only (#8619) * test(quality): fail loudly when a source-scanning guard is negative-only A negative guard — assert.doesNotMatch(src, /x/) or src.includes(x) === false — passes against an empty string. Once the code it guards is extracted into another file the parent no longer contains the string, so the assertion keeps passing while protecting nothing. The regression coverage is deleted with no test turning red, which is exactly the failure mode the god-file decomposition campaign (#8617) is about to trigger 90-odd times. Adds tests/unit/source-scanner-guards.test.ts: a hard gate (no baseline, no allowlist) requiring every test variable bound to project source to carry at least one positive anchor. Classification runs on logical statements with strings, regexes and comments blanked out, so a guard wrapped across lines cannot slip past — that folding is what exposed 3 of the 7 violations. Fixes all 7 violations across 6 files with one stable top-level export anchor each. Two were security scope guards held only by multi-line negative assertions: the SSRF guards on /api/sync/initialize (#323) and the proxy-bypass guards on chatHelpers.ts and chatCore.ts (#3226) — the latter anchored on handleChatCore precisely because that file is a decomposition target. Adds tests/_helpers/readSrc.ts, a repo-root-relative reader that throws on a missing or empty file instead of returning "". Refs #8617 * docs(changelog): number the fragment for #8619 * chore(skills): sync cli-backup-sync SKILL.md with catalog Same tip fix as #8657 so Merge integrity is green without waiting for that PR to land. Regenerated via generate-agent-skills --apply. * docs: replace outdated Polish docs with translation from latest English (#8823) * fix(types): normalize Kie transcription results (#8824) * fix(reasoning): sanitize streamed K3 think tags (#8821) * fix(reasoning): sanitize streamed K3 think tags * refactor(stream): move think-tag helpers into thinkTagParser leaf module open-sse/utils/stream.ts is frozen at 2887 lines with zero headroom, and the kimi-coding-apikey think-tag handling added here pushed it to 2951. The parsing half of that work has no SSE dependency, so it moves to thinkTagParser.ts (an unfrozen leaf): the open-tag lookahead predicate and the end-of-stream flush delta assembly. stream.ts keeps only the SSE envelope - enqueue, payload collection, logging. Getting back under the frozen ceiling needed more than just the PR's own added lines, since even the fully self-gating helpers still cost a handful of call-site lines stream.ts has zero room for. Along the way this also deduplicates a synthetic chat-completion-chunk literal that was copy-pasted three times in stream.ts (textual tool-call flush, think-tag flush, terminal finish_reason synthesis) into one buildSyntheticChatChunk() in streamHelpers.ts - pure DRY, no behavior change. Behavior is unchanged: same tests, same counts. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: rinseaid <rinseaid@rinseaid.net> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * docs: restore the Polish API_REFERENCE removed by #8823 (#8831) * docs: restore the Polish API_REFERENCE removed by #8823 `docs/reference/API_REFERENCE.md` lists Polish in its language index, but the target file no longer exists: #8823 ("replace outdated Polish docs with translation from latest English") deleted `docs/i18n/pl/docs/reference/API_REFERENCE.md` without writing a replacement. Every other one of the 31 linked languages still has the file. That leaves `check:doc-links` red — and because the Docs Gates job only runs on pull requests, the branch itself reports green while carrying the break. The first PR opened afterwards is what surfaces it, and it blocks every PR until fixed. Restored from `71c5a7592^`. The content is the pre-#8823 translation, which is by definition outdated relative to the English source — but an outdated translation behind a working link is strictly better than a 404, and the next translation pass will overwrite it. `check:doc-links` now passes (813 internal links, 0 broken). The same commit also removed four other Polish files (`cloudflare-zero-trust-guide.md`, `features/context-relay.md`, `reference/CLI-TOOLS.md`, `reference/ENVIRONMENT.md`). None of them is linked from a scanned index, so none breaks the gate; they are noted here so a later translation pass can decide whether they should come back too. * chore(quality): freeze the pre-existing exhaustive-deps error in ProviderAccountRoutingCard Second half of unbreaking the base. `lint:json --max-warnings 0` fails on `ProviderAccountRoutingCard.tsx:87` — `save` calls `load()` but declares only `[providerKey]`. Same root cause as the broken doc link in the previous commit: the Lint job is skipped on pushes to `release/**`, so the branch reports green while carrying the violation, and every PR inherits it. Frozen rather than fixed: adding `load` to the dependency array changes when the callback is recreated in a settings component, and that belongs in a change that can verify the card's behaviour. The entry keeps the gate meaningful for genuinely new warnings instead of leaving it red for everyone. With this and the restored Polish file, both gates pass on the base again. * fix(dashboard): surface quota pool delete failures instead of failing silently (#8829) The handler awaited the DELETE and never looked at the response: if (!confirm(t("removeConfirm"))) return; await fetch(`/api/quota/pools/${id}`, { method: "DELETE" }); await mutate(); When the request failed — a 401 from an expired session, a 500, a dropped connection — the page revalidated, the card stayed exactly where it was, and nothing was shown. From the operator's side the click was indistinguishable from a misclick, so the natural reaction is to click again. The page had no error surface at all, unlike the sibling flow in the API manager which already checked res.ok and rendered the message. Adds a dismissible alert above the header, fed by both failure paths: a non-ok response (appending the API's message when it sends one) and a thrown request, which has no response to read. The alert clears on the next attempt, so a transient failure does not leave a stale error on screen. Reported against two boxes on 2026-07-28. The delete itself was working there — the audit log shows the pools were removed — which is exactly what this change makes visible either way. Tests (vitest/jsdom, 5): non-ok response, thrown request, success path stays quiet and still revalidates, a dismissed confirmation issues no DELETE at all, and an earlier error clears once a later delete succeeds. * feat(api): prompt-cache health summary endpoint and analytics tab (#8827) Adds GET /api/usage/cache-health and a Cache Health tab under /dashboard/analytics, both backed by a pure summary over the cache columns already present in call_logs. Motivated by a production diagnosis where the aggregate ratio was actively misleading. The window read 24.8M cached tokens and wrote 9.5M — a write/read of 0.385, which reads as merely mediocre. The actual shape was very different: the median call wrote 848 tokens while 18% of the calls carried 94% of every written token, and two models in the same window sat at 0.13 (Sonnet) and 0.51 (Opus). Averaging hid all three facts. So the summary reports what the average cannot: the distribution (p50/p90/p99), the concentration (how few calls carry how much of the write), and the per-model split. The heavy-write threshold is relative to the window (10x the median, floored at 1024) because a cutoff tuned for 130k-token conversations reports nothing at all on 2k-token ones; 1024 is the minimum Anthropic bills for cache creation, below which a write carries no signal. Calls that neither read nor wrote are counted separately from thrash — a route that does not cache is an absence of caching, not a sick cache — and only successful calls are summarized, since a 4xx/5xx never reached the provider cache and would dilute the ratio. Tests cover the summary (8) and the route (6, against a real SQLite so the WHERE clause itself is exercised), including that an internal failure answers 500 without leaking the stack trace, the SQL text or a table name. * fix(api): stop /v1/models rebuilding the catalog on almost every request (#8833) * fix(api): stop /v1/models rebuilding the catalog on almost every request The response cache added by #6408 memoized the serialized body for `modelCatalogCacheTtlMs`, defaulted to 1500 ms. On a real install the builder takes far longer than that: measured on the production VPS, ~49 s for a 1.3 MB / 2645-model catalog. Any two requests more than 1.5 s apart therefore both missed the fresh window, and the second fell into stale-while-revalidate — which rebuilds via `setTimeout(…, 0)` and, because the builder is overwhelmingly synchronous under the single-threaded App Router, pins the event loop, so even the "served immediately" stale body only reaches the client once the rebuild finishes. Net effect: ~50 s on essentially every call. Measured on the VPS (1 cold build + 5 sequential requests): cold = 48.93s req1 = 3.19s ← the only hit req2 = 50.51s req3 = 50.93s req4 = 47.43s req5 = 52.28s Raise the default to 60 s. A short TTL is redundant with the invalidation this cache already has: `invalidateDbCache()` bumps `modelCatalogCacheVersion` on every settings/connections/combos/pricing write and `dropCatalogCacheIfStateChanged()` drops the whole cache the moment it moves, so post-write freshness never depended on the TTL. What the TTL governs is the "nothing was written" case, where replaying a body built seconds ago is the point of the cache. 60 s matches the ceiling the settings schema already allows for the override, so the default can never exceed what an operator may configure. The value that actually takes effect is the settings default, not the constant: `catalog.ts` resolves `dbSettings.cache?.modelCatalogCacheTtlMs ?? CATALOG_CACHE_TTL_MS_DEFAULT`, and the `??` never falls through while a settings default is declared. Raising only the constant is a silent no-op — which is how the first attempt at this fix measured identical to no fix at all. All three declarations are aligned and a test pins them together. * docs(changelog): add fragment for #8833 --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * fix(providers): correct Codex GPT-5.6 context window (#8838) * fix(providers): correct Codex GPT-5.6 context window (#7702) * docs(changelog): add fragment for #8838 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(providers): align the remaining GPT-5.6 context-window assertions Three suites assert the pinned GPT_5_6_CODEX_CAPABILITIES contract through the VS Code and provider-models routes, and still expected 372000. They only surface in a full run, so the focused loop on this PR stayed green while `npm run test:unit` failed with five `272000 !== 372000`. The two conservative-merge cases in provider-models-route-codex keep testing what they tested: live 999999 still exceeds the pinned value (pinned wins) and live 100000 is still below it (live wins). Only the pinned number and the comments naming it move. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(ghe-copilot): route OpenAI-native models via Responses API (#8835) * fix(ghe-copilot): route OpenAI-native models via Responses API - Add targetFormat: 'openai-responses' to gpt-5.4-mini, gpt-5.3-codex, gpt-5-mini, mai-code-1-flash, and oswe-vscode-prime in ghe-copilot registry. - Register gpt-5.6-sol, gpt-5.6-terra, and gpt-5.6-luna with openai-responses targetFormat. - Update GheCopilotExecutor.buildUrl() to route openai-responses and codex models to <gheUrl>/responses while keeping Claude and Gemini on /chat/completions. - Add unit tests verifying targetFormat parity and buildUrl endpoint routing. * docs(changelog): add fragment for #8835 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Alex <sefias_methue@hotmail.de> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(cli): escape claude args and stop aborting on exit in omniroute launch (#8837) * fix(cli): escape claude args and stop aborting on exit in omniroute launch Windows launches go through spawn(..., { shell: true }), which joins argv with plain spaces and no escaping (Node DEP0190). Any argument containing a space was split, so `omniroute launch -p "two words"` reached claude as `-p two` plus stray positionals, and the prompt was silently truncated. Escape each argument for cmd.exe instead: CRT argv rules first (double the backslashes preceding a quote, escape embedded quotes, wrap in quotes), then cmd metacharacters caret-escaped twice. The second pass is required because claude.cmd is an npm shim that re-parses %* on the way to node; with a single pass arguments still truncated at the first `&` or `|`. The command action also called process.exit() on any non-zero exit. That tore the loop down while the exited child's inherited stdio handles were still closing and aborted the process with a libuv assertion (!(handle->flags & UV_HANDLE_CLOSING), src/win/async.c:94, exit 0xC0000409) instead of returning claude's exit code. Set process.exitCode and let the loop drain. Extracts resolveClaudeSpawn() alongside the existing resolveCodexSpawn() precedent so both the platform choice and the escaping are unit-testable. Tests: tests/unit/cli/launch-windows-spawn-args.test.ts (new, 7 tests). Four pure-function tests plus golden strings pin the exact encoding on every platform; a Windows-only test round-trips argv through a real npm-style .cmd shim and asserts embedded quotes, `&`, `|`, `%PATH%`, `^`, `!`, a trailing backslash and an empty string all arrive byte-identical. Note: bin/cli/commands/launch-codex.mjs carries the identical defect (same shell:true concatenation, same process.exit) and is left unchanged here. * docs(changelog): add fragment for #8837 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(antigravity): discover projectId during token refresh (#8842) * fix(antigravity): discover projectId during token refresh The initial OAuth exchange can fail to populate projectId via loadCodeAssist (network timeout, account not yet onboarded). The runtime transformRequest path already recovers via ensureAntigravityProjectAssigned, but refreshCredentials did not -- after a token refresh the per-token memoization cache is invalidated (new access token = new cache key), so every subsequent request triggers a fresh loadCodeAssist round-trip that may fail again. Add a best-effort ensureAntigravityProjectAssigned call in refreshCredentials when projectId is empty, mirroring the pattern in transformRequest. Persist the discovered id so it survives the next refresh or restart. Signed-off-by: Minxi Hou <houminxi@gmail.com> * chore(quality): rebaseline antigravity.ts and test file-size antigravity.ts grew from 1493 to 1528 lines (+35) with projectId discovery in refreshCredentials. executor-antigravity.test.ts is a new test file at 1098 lines (above cap 1000) with 4 new test cases. Signed-off-by: Minxi Hou <houminxi@gmail.com> * fix(antigravity): match ExecutorLog arity in the refresh discovery log `ExecutorLog.info` (open-sse/executors/base.ts) is `(tag, message) => void` — two parameters. The discovery log passed a third metadata object, which failed typecheck:core with TS2554 on antigravity.ts:777. Bind the message to a local and pass two arguments, matching the sibling warn on the catch branch. Kept to two lines so the file stays at its frozen size; ran Prettier, which also wrapped the pre-existing over-width `const msg` line below. Also adds the changelog fragment for the fix. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Minxi Hou <houminxi@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(oauth): support web client type for remote Google OAuth (#8845) * feat(oauth): support web client type for remote Google OAuth Google Desktop app OAuth clients require loopback redirect URIs per policy, which breaks remote deployments where the browser cannot reach 127.0.0.1 on the server. Add ANTIGRAVITY_OAUTH_CLIENT_TYPE env var: when set to 'web' and OMNIROUTE_PUBLIC_BASE_URL is configured, the loopback redirect URI is upgraded to the public base URL. Default behavior (desktop) is unchanged. Enables remote deployments without SSH tunneling by registering a Web application OAuth client in Google Cloud Console. Signed-off-by: Minxi Hou <houminxi@gmail.com> * docs(changelog): add fragment for #8845 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Minxi Hou <houminxi@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(ci): raise the git ls-files buffer in check:tracked-artifacts (#8844) * fix(ci): raise the git ls-files buffer in check:tracked-artifacts `execFileSync` defaults to a 1 MiB stdout buffer and throws ENOBUFS past it. `git ls-files -s` on this repo is already at 1,042,494 bytes across 11,091 tracked files — 6,082 bytes from the ceiling. Any PR adding roughly sixty files crosses it. That matters more than a failing script: the check runs on pre-commit, so once the listing crosses 1 MiB, committing breaks for everyone working the repo, not just for the change that happened to cross it. It is not a hypothetical — the private EE fork hit it this week when a sync landed ~214 translation files and pushed the listing 504 bytes over; every commit there failed the hook until this same fix landed. Both call sites now share a GIT_LS_OPTS with a 64 MiB ceiling — far above any plausible tree, rather than just above today's, since the listing only grows. * docs(changelog): add fragment for #8844 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(executors): route current Claude generations through Vertex partner endpoint (#8852) * fix(executors): route current Claude generations through Vertex partner endpoint PARTNER_MODELS pinned three Claude 3.x prefixes (claude-3-5-sonnet, claude-3-opus, claude-3-haiku). Every newer Claude generation on Vertex (claude-sonnet-4-6, claude-haiku-4-5, etc.) fell through to the Google-publisher branch instead, producing an invalid publishers/google/models/claude-... path. Replace the pinned prefixes with a single generic "claude-" prefix: any Claude model on Vertex is always an Anthropic partner model, never a Google one, so this can't go stale again the way pinned version strings did. Fixes #1985 * docs: add changelog fragment for #8852 * fix(cli): escape codex args and stop aborting on exit in launch-codex (#8856) * fix(cli): escape codex args and stop aborting on exit in launch-codex `launch-codex` spawns `codex.cmd` with `shell: true` on Windows, so Node joins argv with plain spaces and no escaping (DEP0190). This mangles every Windows invocation, not only the ones with a multi-word user argument, because the injected `-c` provider flags carry quoted TOML values: ["-c","model_provider=omniroute", ..., "model_providers.omniroute.base_url=http://localhost:20128/v1", "fix","the","bug"] cmd.exe strips the TOML quotes (`model_provider=omniroute` no longer parses as a TOML string), splits multi-word arguments, and swallows everything after an unquoted `&`. The same defect was fixed for `launch` in #8837; this ports it to `launch-codex`, which that PR disclosed but left unfixed. - extract the escaping into `bin/cli/utils/winShellArgs.mjs` and reuse it from both launchers instead of keeping a private copy in `launch.mjs` - quote the codex argv (provider flags + profile + pass-through args) on the win32 shell path; argv is untouched off Windows, where no shell is involved - replace `process.exit()` in the command action with `process.exitCode`: on any non-zero child exit it aborted with the libuv `!(handle->flags & UV_HANDLE_CLOSING)` assertion while the inherited stdio handles were closing Test: `tests/unit/cli/launch-codex-windows-spawn-args.test.ts` pins the exact encoding with golden strings (the cmd.exe round-trip is Windows-only and skips on Linux CI, so without goldens CI would guard nothing) and round-trips the real provider flags through a probe `.cmd` shim that forwards `%*`. * docs(changelog): add fragment for #8856 Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): reconcile v3.8.49 — aggregate 584 fragments, restore lost credits Aggregates every pending changelog.d fragment into the [3.8.49] section and regenerates the contributors table from the reconciled bullets. Three fixes this surfaced: - The [3.8.49] section had no `### 📝 Maintenance` heading, so the aggregator's findIndex matched the first one in the file — inside [3.8.47] — and would have filed 92 maintenance bullets under the wrong release. Added the heading to the living section; [3.8.47] stays at its original 234 bullets. - 46 bullets carried no PR/issue reference. Fragments may keep the number only in the filename (`<N>-slug.md`), which the aggregator does not copy into the bullet, so the link and the credit were dropped on aggregation. Restored, scoped strictly to the [3.8.49] range. - 9 external contributors lost their attribution that way and are credited again: @MisileLab (#8566), @MumuTW (#8619), @epsilonode (#8724), @hppsc1215 (#8835), @sumanxg (#8837, #8856), @TitoTFP (#8838), @HouMinXi (#8842, #8845). Contributors table: 84 → 155 entries, no one removed. 42 i18n mirrors synced. check:changelog-integrity green — no base bullet lost. * fix(token-refresh): discover projectId during token refresh (#8860) * fix(token-refresh): discover projectId during token refresh The token refresh path (tokenRefresh.ts) did not discover projectId for antigravity/agy accounts. Dashboard and health check refresh use this path, not the executor path. Add ensureAntigravityProjectAssigned call after refreshGoogleToken for antigravity/agy providers when projectId is empty. Signed-off-by: Minxi Hou <houminxi@gmail.com> * chore(quality): rebaseline the token-refresh test file + changelog fragment tests/unit/token-refresh-service.test.ts 1311->1378 (+67) — the four cases covering projectId discovery on the tokenRefresh.ts path. Growth is the tests this PR adds, nothing else. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Minxi Hou <houminxi@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat: Xiaomi MiMo Token Plan provider + per-connection API protocol selector (#8861) * feat(sse): add alternateFormats registry field and resolver * feat(sse): honor per-connection targetFormat in getTargetFormat Registry-driven format lookup now resolves an alternate protocol declared for the provider when the connection's providerSpecificData carries a matching targetFormat, falling back to the entry's default format otherwise. * feat(sse): resolve base URL from selected alternate format resolveBaseUrl now falls back to the connection's selected alternate protocol (providerSpecificData.targetFormat) before the provider's default base URL, while a manual providerSpecificData.baseUrl override still wins over both. * feat(sse): apply alternate format auth header and extra headers DefaultExecutor's registry authHeader lookup and BaseExecutor's shared header preamble now both honor a connection's selected alternate protocol: the alternate's authHeader wins over the registry default, and its extra headers (e.g. Anthropic-Version) are merged in. * refactor(sse): extract resolveAlternate helper into BaseExecutor Centralizes the getRegistryEntry() + resolveAlternateFormat() pair that resolveBaseUrl, buildHeadersPreamble, and DefaultExecutor's authHeader lookup each duplicated, so a future call-site can't diverge from the shared precedence. Also translates the PT-BR comments added in the previous three commits to match the surrounding English. Pure refactor — no behavior change. * feat(sse): declare Anthropic-compatible variant for xiaomi-mimo The provider publishes the same catalog over /anthropic/v1/messages on the same host. Selecting it also required bypassing the per-provider URL normalizers in DefaultExecutor.buildUrl(): normalizeXiaomiMimoChatUrl() appends /chat/completions unconditionally, which mangled the alternate's already-complete endpoint into .../anthropic/v1/messages/chat/completions. * feat(sse): add xiaomi-mimo-token-plan provider with monthly quota Token Plan is a separate product: tp- keys authenticate only on the regional token-plan-sgp host and return 401 on api.xiaomimimo.com, where the existing xiaomi-mimo provider points. Same pattern as qwen-cloud-token-plan. Registers the monthly token allowance (no balance API upstream) and declares the Anthropic-compatible variant on the token-plan host. * feat(dashboard): add API protocol selector to connection modal Providers that declare alternateFormats in the registry now expose an opt-in protocol dropdown on the connection modal. The choice persists to providerSpecificData.targetFormat as an explicit null when set back to the default, since the PUT route merges { ...existing, ...incoming } and an omitted key would keep the previous override. * fix(i18n,quality): vi parity for the protocol selector + own-growth rebaselines The three new provider keys landed only in en/pt-BR, so the vi parity test failed (tests/unit/i18n-vi-completeness.test.ts asserts key parity AND no __MISSING__ markers — running i18n:sync-ui would have satisfied the first and broken the second). Added translated values instead. Scoped to vi: it and pt-BR are the only locales with a parity test. Rebaselines are this PR's own growth: EditConnectionModal.tsx 1283->1316 (the selector field) and open-sse/executors/base.ts 1540->1562 (alternate-format resolution at the existing buildUrl/headers chokepoint). Adds the changelog fragment. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * fix(oauth): support Test Connection for xAI OAuth (#8862) * fix(oauth): support Test Connection for xAI OAuth Wire xai-oauth / xao into OAUTH_TEST_CONFIG with the shared api.x.ai chat probe so dashboard Test Connection no longer returns "Provider test not supported" on healthy accounts. * chore(changelog): add changelog for xai-oauth test connection support --------- Co-authored-by: allanvb <allanvb@users.noreply.github.com> * fix(combo): clean up stale connectionId refs after provider delete (#8865) * fix(combo): clean up stale connectionId refs after provider delete Deleting a provider connection left stale connectionId references in combo route models, causing the dashboard to show deleted providers. Add cleanupComboConnectionRefs to scan combos and null out any connectionId or allowedConnectionIds entry matching the deleted connection. Call it from the DELETE handler alongside the existing synced-model cleanup. Signed-off-by: Minxi Hou <houminxi@gmail.com> * fix(types): widen the combo-step cast + changelog fragment typecheck:core rejected `combo.models as Record<string, unknown>[]` with TS2352 — ComboStep[] and Record<string, unknown>[] do not overlap enough for a direct assertion. Goes through `unknown`, as the compiler suggests. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Minxi Hou <houminxi@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(autoRouting): recognize auto/\<family\> combos in classifyAutoModel (#8866) * fix(autoRouting): recognize auto/\<family\> combos in classifyAutoModel classifyAutoModel() checks VALID_AUTO_VARIANTS and parseAutoSuffix but never isValidModelFamily, so auto/glm, auto/minimax, auto/llama etc. are rejected as "Unknown built-in auto combo" before chatHelpers.ts or builtinCatalog.ts can handle them. Fix: import isValidModelFamily and ModelFamily, add family to spec type, check family suffixes before returning unrecognized. Mirrors the pattern already in builtinCatalog.ts createBuiltinAutoCombo. Closes: auto/\<family\> combos listed in /api/combos/auto but unusable at /v1/chat/completions. * test(autoRouting): cover auto/<family> classification + changelog fragment The PR changed production code with no test — nothing in tests/ referenced classifyAutoModel. Since it is module-private, the new suite exercises it through the public resolveAutoRoutingState(). Verified it guards something real: against the release tip without this fix the family case fails ("auto/glm should be a recognized built-in auto model"), and passes with it. Also pins that a category suffix does not pick up spec.family and that an unknown suffix stays unrecognized. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: rafaeldrincon <rafaeldrincon@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(adobe-firefly): default gpt-image detailLevel to maximal (5) (#8863) * fix(adobe-firefly): default gpt-image detailLevel to maximal (5) GPT Image 2 quality is dominated by generationSettings.detailLevel (1-5). The SPA often defaults to 3 (medium); missing/auto quality previously mapped to 3 as well. Default now to 5 (high/max) so API clients and Media without an explicit quality still get maximal detail. Explicit low/medium still honored. * chore(quality): rebaseline adobeFireflyClient + changelog fragment adobeFireflyClient.ts 2317->2322 (+5) — this PR's own growth at the existing payload-build site. Covered by tests/unit/adobe-firefly.test.ts. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> * chore(changelog): aggregate the tail of v3.8.49 (6 fragments, 5 PRs credited) Second aggregation pass, for the PRs merged after the main reconciliation: #8860, #8861, #8862, #8863, #8865, #8866. The `### 📝 Maintenance` heading added to the living section in26a7783521held — [3.8.47] stays at its 234 bullets instead of absorbing this cycle's maintenance entries. Credits attached where the fragment carried the number only in its filename: @HouMinXi (#8860, #8865), @artickc (#8863), @rafaeldrincon (#8866). #8862 already carried its own link and credit. [3.8.49]: 1172 -> 1178 bullets · contributors 155 -> 156 · 42 i18n mirrors synced. * fix(logs): avoid giant provider pills for failed auto family requests (#8867) * fix(logs): avoid giant provider pills for failed auto family requests * refactor(logs): extract resolveRejectedComboProvider + cover it The provider label was decided inline in handleChat, which has no test harness — the change shipped untested and pushed chat.ts over its frozen size (1848 > 1845). Moved to rejectedRequestUsage.ts next to summarizeComboAttemptedModels, the helper it replaces on this path. chat.ts shrinks back under its baseline (no rebaseline needed) and the logic gets three cases in the suite that already covers its sibling: auto/* collapses to "auto", a named combo keeps its name, and bare "auto" (no slash) is NOT collapsed — that one is a combo request, not a family request. Also rebased on the current release tip and added the changelog fragment. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: rafaeldrincon <rafaeldrincon@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): aggregate #8867 and credit @rafaeldrincon [3.8.49]: 1178 -> 1179 bullets. [3.8.47] untouched at 234. 42 i18n mirrors synced. * chore(changelog): v3.8.49 reconciliation — 200 missing bullets + 22 restored credits Phase 0a of /generate-release. Measured commit<->CHANGELOG coverage over the real cycle range (2c62333b0..HEAD, 933 non-merge commits) instead of the last tag: 180 merged PRs had no bullet at all (they landed without a changelog.d fragment) and a further 19 were invisible because the merge-train landed them under a generic 'Train 1D: merge via --admin' subject that carries no PR reference. - +200 bullets, all with PR back-reference and author attribution (1179 -> 1379) - 🙌 Contributors 156 -> 178; credits @terrafirmbot-source for #7904, which shipped through the conflict-resolved #8685 without any attribution - closed-PR credit audit over the 32 human PRs closed unmerged this cycle: 12 had already landed under the author's own follow-up PR and were verified credited - rollup bullet for the direct release-branch maintenance (merge-train landings, ratchet re-pins, base-red sweeps) that carries no PR of its own - [3.8.49] header dated 2026-07-28 (was TBD) in the root file and the 42 i18n mirrors Coverage after: 0 commits uncovered. * chore(quality): v3.8.49 pre-flight — clear 4 base-reds, absorb cycle drift Pre-flight sweep (Phase 0). Test suites ran on the dedicated 32-core box so the self-inflicted load of `node --test` could not fabricate timing flakes. Base-reds fixed (all real, all from merged cycle PRs that did not update their characterization tests): - providers-constants-split / quota-plan-registry / provider-translate-path GOLDEN: #8861 added the Xiaomi MiMo Token Plan provider, so APIKEY_PROVIDERS is 195 (was 194), knownProviders() is 12 (was 11) and the translate-path snapshot gains one purely additive entry. Counts aligned to the shipped catalog, never relaxed. - agent-skills-content: skills/config-codex-cli/ was added by #8709 with a custom block, so the custom-block set is 13, not 12. - chatcore-compression-integration: #8595/#8560 deliberately decoupled REACTIVE context compaction from the `enabled` master switch, so a body above 70% of the window is pruned even with compression off. The test was sized above that threshold, which made it assert against intended behavior; it now stays below it and keeps testing the invariant it was written for (resolveBasePlan short-circuits to "off" before reading comboOverrides). Static gates: - 3 shellcheck directives were malformed (`# shellcheck disable=SC2086 — text`; the em-dash makes shellcheck reject the whole directive as SC1125) in ci.yml and nightly-release-green.yml — the comment now sits on its own line. - gitleaks: 2 new generic-api-key false positives allowlisted with justification — a localStorage key for the sponsor banner (#8723) and the PUBLIC Adobe Firefly web x-api-key, whose only literals are in JSDoc (the runtime reads it through resolvePublicCred, per Hard Rule #11). secretFindings back to 0. - zizmor 176 -> 189 and bundleSize 6762 -> 7666 rebaselined with the measurement and the reason; both are ordinary cycle drift absorbed at release. Environment-dependent failures classified out, not silenced: the two tproxy tests assert the native addon is unavailable/unprivileged and therefore fail when the suite runs as root on the build box (they pass as a normal user), and the consoleInterceptor rate-limit test is a 4s-timing flake under load (6/6 isolated). * test(codex): align the Responses HTTP e2e to the #8507 input-item contract Fifth and last base-red of the v3.8.49 pre-flight. #8507 (#8083) deliberately sets `status: "completed"` on Responses input items so strict upstream validators accept them; codex-chat-reasoning-http-e2e still asserted the pre-#8507 shape, so it failed against intended behavior. Expectation updated with the reason inline — the assertion is not relaxed, it now pins the current contract. The test was never reached in the first pre-flight sweep (the run was interrupted during the integration phase, and this file sorts after the one that failed). * docs(release): v3.8.49 feature-documentation sync Phase 1 step 6b. Swept the cycle's 284 New Features bullets against the existing docs before writing anything: nearly every large theme (Kimi, xAI OAuth, session affinity, bun:sqlite, Firecrawl, Opus 5, omniglyph, GCF v3.2, homologation suite) was already covered. Six real gaps were left undocumented by the PRs that shipped them, each verified in source before being written up: - CredentialMaskerGuardrail (#7683) is registered in guardrails/registry.ts but the GUARDRAILS table listed only 3 of the 4 guardrails - the cacheAffinity scoring factor and the cache-optimized combo strategy (#8008): the docs still said 12 factors / 18 strategies, the code has 13 / 19 - the optional dashboard OIDC login gate (#6973) — /api/auth/oidc/{login,callback} had no mention in AUTHZ_GUIDE - GET /api/usage/cache-health (#8827) and GET /api/usage/model-latency-stats (#6873) were missing from the API reference README "What's New" gains one bullet (routing transparency) and merges two others rather than growing a second changelog. PROVIDER_REFERENCE regenerated with the generator (Firecrawl reclassified to Search, Xiaomi MiMo added by #8861). check:docs-all green: 134 docs, 813 internal links, no fabricated API/env/CLI references. Known pre-existing drift left alone and reported: stale nominal counts in ARCHITECTURE/CODEBASE_DOCUMENTATION (soft), the 9-factor mentions scattered in AUTO-COMBO, and the auto-combo diagram SVG (the renderer needs a browser this environment does not have — the .mmd source is updated and the .md says so). * chore(release): v3.8.49 — clear the release-PR CI in one pass Every finding from the first full ci.yml run on the release PR, fixed or justified together so a single re-push clears the board. Lint / check:route-validation:t06 — three routes read request.json() with no visible Zod validation. The two proxy-subscriptions routes validated with a hand-rolled parsePayload(); they now use real Zod schemas (src/lib/proxySubscription/schema.ts) reproducing the same acceptance rules, error strings and status codes. chat/completions is the proxy's hottest path and parses the body ONCE on purpose (#4380 OOM crash-loop), so it now safeParses the ALREADY-PARSED object against a deliberately permissive structural schema — proven not to change behavior: absent model and model:null still pass through, role "developer" still reaches 200, a ~300 KB payload is accepted, and the body is still read exactly once. 25 new tests. i18n UI value drift — 13 English strings rewritten during the cycle left stale translations in up to 41 locales (317 pairs). Eleven are genuine rewrites and now carry the pipeline's __MISSING__:<english> marker so the runtime serves corrected English until translation catches up; vi forbids that marker by test, so it got a real translation. PR Test Policy — 33 files flagged. Each was verified against the SOURCE, not the diff: 26 assert reductions are legitimate (mostly the #7866 Qwen OAuth provider removal and the #8013 Antigravity refactor deleting the surface under test) and are allowlisted with the PR and the evidence; 5 deleted files have verified replacements. One was NOT legitimate: #7528's GraphQL->WebSocket migration dropped four muse-spark continuation scenarios whose logic is still live — connection isolation, cache eviction after a failed turn (the commit itself says "was missing"), parallel-chat cache collision, and the empty-content guard. All four are restored against the new transport and each was verified to fail when the corresponding production mechanism is broken. Quality Ratchet / openapiCoverage — 36.6% against a baseline of 38: the cycle added routes faster than the spec. Eight real endpoints are now documented from their route.ts (usage cache-health and model-latency-stats, the two OIDC endpoints, and the five proxy-subscriptions paths), bringing it to 38.1%. Quality Gates (Extended) / zizmor — the runner measures 190 where the devbox measures 189 on the same commit, a delta already recorded in this baseline's history. Baselined to the runner's number. Also: the driverFactory better-sqlite3 guard moved from a mid-body t.skip() to a declared { skip: <condition> } test option. Same behavior for the optional native dependency, but the skip now shows up in the report and is distinguishable from a test.skip() that silences a test outright. Verified under both runners: 15/15 on Node, 14/14 on Bun. SonarCloud Code Analysis stays red and is not a blocker: sonar.qualitygate.wait=false since #7038 makes the job informative, the built-in gate cannot be swapped on the FREE plan, and main has no branch protection. * chore(quality): close the last two release-PR reds test-masking — I had missed one of the 34 flagged files: my first pass grepped only paths under tests/, so open-sse/services/__tests__/tierResolver.test.ts was invisible. Same #7866 cause as the other eight qwen-driven reductions: the "classifies Qwen as free" case and qwen's entry in the batch list went with the removed provider, and the batch indices dropped from 10 to 9 (61→59). Allowlisted with that evidence. dast-smoke — all four Schemathesis findings are on the two OIDC endpoints documented in the previous commit, and none is a defect. /api/auth/oidc/* is a BROWSER redirect flow: it answers 302 to the IdP and 302 back to /login?oidc_error=... on every failure, which Schemathesis reads as "accepted a schema-violating request", and it answers 400 when OIDC is not configured, which it reads as "rejected a schema-compliant request". Keeping the endpoints in the spec is right — operators need them, and they are what brought openapi coverage back over the baseline — so the flow is excluded from the fuzz instead, with the reason inline in the workflow. The rest of /api/auth and /api/keys stays in scope. * test(db): reword the driverFactory skip comment so the gate stops counting it The anti-test-masking gate greps text, not code: my explanation of WHY the better-sqlite3 guard moved out of the test body spelled the runner API out literally, and those two mentions inside a comment were counted as two new skip markers — the exact signal the previous commit set out to clear. Same explanation, phrased without the call syntax. Verified with the gate's own exported helpers against the merge-base: 0 modified-file violations, 0 deletion violations. Test still 15/15. * fix(dashboard): unbreak the vitest:ui gate — 2 real production bugs + the i18n test seam The Vitest job is a BLOCKING gate that had not run to completion once in this whole release: rounds 1-3 cancelled it via cancel-in-progress on each successive fix push, so its red was indistinguishable from green. Round 4 finally ran it and the suite was broken cycle-wide. Root cause of the suite: #7935 instrumented ~180 shared/dashboard components with next-intl's useTranslations/useLocale without updating the tests that mount them, so every one of them threw "context from NextIntlClientProvider was not found". Fixed at the shared seam (tests/_setup/vitestUiPolyfills.ts) rather than per file: a translator built from the REAL en.json via next-intl's own createTranslator, memoized per namespace — the naive version returns a fresh function each call and any component whose useCallback/useEffect depends on t spins forever, which reads as a hang, not a failure. A local mock still wins over the default. 22 files fixed by the seam alone, 15 realigned to the real strings; no assert removed or weakened. Two production bugs the suite was hiding, both pre-existing and both with a failing regression test already in the tree: - RequestLoggerDetail crashed on a structured error object. #7920 gave the component formatErrorForDisplay for exactly this case, then #8213's combo-503 / cooldown checks went to the raw field and called .toLowerCase() on it. Both paths now use the helper. - The logs detail modal reopened on first close again. #6830 fixed that by reading the deep-link id ONCE; the #8354 page rewrite regressed it by reading the live searchParams every render, so the prop flips mid-session and re-fires the child's deep-link effect exactly as the modal closes. Frozen at mount again. Also tightens i18nUiCoverage 75.5 -> 99, which the ratchet demanded under --require-tighten: the metric genuinely improved as the async translation workflow paid off the debt that the v3.8.39/.44/.47 rebaselines had been recording. The collector subtracts placeholders, so this release's 317 __MISSING__ markers are already netted out of the 99. Two UI files still fail locally under 20-worker concurrency (combos-page-smoke, evals-tab-smoke) — cold-import flakes that pass isolated and with a larger timeout. * test(e2e): repair the four shards the first green Build finally exercised test-e2e has `needs: [build]`, and the release PR's Build died on every round until now — so the 9-shard matrix produced ZERO signal for this whole cycle while ~200 PRs merged. The first successful Build surfaced four independent breakages, each traced to the commit that caused it: - providers-management (#7361): the single-connection delete moved from window.confirm() to a ConfirmModal, so page.once("dialog") never fired and the DELETE was never sent (deleteCalls stayed 0). Click the modal instead. - providers-bailian-coding-plan (#7882): the free-text Base URL field was deliberately replaced by a region step whose choice resolves the endpoint (global-sg -> coding-intl.dashscope, china-beijing -> coding.dashscope). Both cases rewritten against the region step; the invalid-URL case is unreachable from this modal now, so it covers the CN choice instead. - group-b-activity-feed: the stack-trace guard ran against page.content(), which embeds the serialized i18n payload — zenmux's "endpoint at /api/v1/chat/completions" is prose, not a leak. Assert on rendered innerText and require the :line:col every real stack frame carries. - navigation (#8292): APP_ROUTE_PATTERN accepted only /login and /dashboard, but the new prefetch spec is the sole caller passing /home, so waitForURL never resolved and the retry loop burned the full 180s timeout. E2E is green on main (9/9 on 07-22 and 07-23), so all four are cycle regressions, not pre-existing debt. Tests only — no production code touched. * fix(dashboard): stop the /home quick-start cards from prefetching too #8292 fixed half the RSC prefetch storm: it added prefetch={false} to the sidebar's navigation and logo links, but /home — the landing route, and the one its own e2e guard visits — renders five more internal Links in the quick-start cards. First paint still fired 12 speculative RSC requests for /dashboard/{analytics,logs,providers,api-manager} and /docs. That PR shipped the test that would have caught this, but the test never got to its assertion: gotoDashboardRoute("/home") hung because APP_ROUTE_PATTERN accepted only /login and /dashboard, so the retry loop burned the whole 180s timeout with no assertion error. With that helper repaired in the previous commit, navigation.spec.ts finally ran and reported the 12 requests. Validated both ways, per Hard Rule #18: - tests/unit/sidebar-prefetch-policy-8281.test.ts extended to /home — red on the parent commit (5 internal Links, 5 without prefetch={false}), green here. - the e2e assertion expect(speculativeRequests).toEqual([]) is the end-to-end guard; it is what surfaced the defect in the first place. * refactor(dashboard): shrink HomePageClient back under the size gate The prefetch fix in the parent commit tripped check:file-size — the frozen budget for this file is 1377 lines and a naive fix measured 1391, because `href` + `prefetch={false}` + `className` no longer fits Prettier's 100-column budget, so three one-line <Link> elements each expanded to five. Followed the gate's own first suggestion (extract/DRY) before touching the baseline: the quick-start links repeated the same className literal four times, and the docs link carried a 180-char one inline. Hoisting both into INLINE_LINK / DOCS_LINK collapses five wrapped <Link> blocks back to a single line each and removes the duplication — 1391 -> 1381. The remaining +4 over the frozen budget is the five prefetch attributes themselves, which cannot be expressed in fewer lines. Rebaselined to 1381 with the rationale recorded in file-size-baseline.json under _rebaseline_2026_07_29_8281_home_quickstart_prefetch. tests/unit/sidebar-prefetch-policy-8281.test.ts still passes (2/2): it matches whole <Link ...> blocks, so it is indifferent to the wrapping and only checks that every internal link opts out of prefetch. --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Minxi Hou <houminxi@gmail.com> Co-authored-by: Adrian Rogala <adrian.rogala@outlook.com> Co-authored-by: Jay Ongg <11032569+swingtempo@users.noreply.github.com> Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: growab <nekron@icloud.com> Co-authored-by: KooshaPari <42529354+KooshaPari@users.noreply.github.com> Co-authored-by: Chirag Singhal <76880977+chirag127@users.noreply.github.com> Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com> Co-authored-by: Ronaldo Davi <ronaldodavi@gmail.com> Co-authored-by: Andrew Munsell <andrew@wizardapps.net> Co-authored-by: WITALO ROCHA <witalo_rocha@hotmail.com> Co-authored-by: Wital <witalorocha216@gmail.com> Co-authored-by: Aoxiong Yin <i@yinaoxiong.cn> Co-authored-by: Andrew B. <37745667+AndrianBalanescu@users.noreply.github.com> Co-authored-by: Andrian B. <andrewbalanesq@gmail.com> Co-authored-by: Xiangzhe <32761048+xz-dev@users.noreply.github.com> Co-authored-by: Jon Bailey <297513015+Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: Samir Abis <me@samirabis.com> Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com> Co-authored-by: chy1211 <31048289+chy1211@users.noreply.github.com> Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> Co-authored-by: whale9820 <whale9820@users.noreply.github.com> Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com> Co-authored-by: Septianata Rizky Pratama <19322988+ianriizky@users.noreply.github.com> Co-authored-by: NOXX - Commiter <artur1992123@mail.ru> Co-authored-by: backryun <bakryun0718@proton.me> Co-authored-by: lunkerchen <labanchen@gmail.com> Co-authored-by: lunkerchen <lunkerchen@users.noreply.github.com> Co-authored-by: Ray Doan <raydoan.contact@gmail.com> Co-authored-by: kfiramar <83420275+kfiramar@users.noreply.github.com> Co-authored-by: Jan Leon <Jan.gaschler@gmail.com> Co-authored-by: Someres <168349709+quanturbo@users.noreply.github.com> Co-authored-by: MikeTuev <ra9ftm@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Imam Wahyu Widodo <120608486+hajilok@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: AgentKiller45 <jamalzzj45@gmail.com> Co-authored-by: judy459 <JUDYZHU459@outlook.com> Co-authored-by: Diego Rodrigues de Sa e Souza <souzamiriamrodrigues790@gmail.com> Co-authored-by: Markus Hartung <mail@hartmark.se> Co-authored-by: KooshaPari <koosha@phenotype.io> Co-authored-by: Jade Guo <jade.gly@gmail.com> Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com> Co-authored-by: oyi77 <oyi77@users.noreply.github.com> Co-authored-by: Dayna Blackwell <dayna@blackwell-systems.com> Co-authored-by: backryun <backryun@daonlab.local> Co-authored-by: brick30llc-ctrl <brick30llc@gmail.com> Co-authored-by: brick30llc-ctrl <admin@brick30.com> Co-authored-by: Saren <saren@dumstruck.com> Co-authored-by: Rafael Dias Zendron <mmmarckos@gmail.com> Co-authored-by: Xiangzhe <xiangzhedev@gmail.com> Co-authored-by: Rafael Dias Zendron <rafael.zendron22@gmail.com> Co-authored-by: KooshaPari <62650152+KooshaPari@users.noreply.github.com> Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com> Co-authored-by: huohua-dev <celentanohertor@gmail.com> Co-authored-by: huohua-dev <258873123+huohua-dev@users.noreply.github.com> Co-authored-by: CitrusIce <31264099+CitrusIce@users.noreply.github.com> Co-authored-by: minisforum <no@mail.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Prudhvi Vuda <53619858+Prudhvivuda@users.noreply.github.com> Co-authored-by: Ridho Pratama <p.ridho9@gmail.com> Co-authored-by: Bob.Hou <houminxi@gmail.com> Co-authored-by: Ravi Tharuma <noreply@github.com> Co-authored-by: Markus Hartung <markus.hartream@gmail.com> Co-authored-by: Dvir Arad <dvirarad@users.noreply.github.com> Co-authored-by: MumuTW <42820974+MumuTW@users.noreply.github.com> Co-authored-by: Honey Tyagi <78690656+HoneyTyagii@users.noreply.github.com> Co-authored-by: backryun <busan011@ormbiz.co.kr> Co-authored-by: Alex <mrfenix007new@gmail.com> Co-authored-by: alexey.nazarov@softmg.ru <alexey.nazarov@softmg.ru> Co-authored-by: AmirHossein Rezaei <78272016+DinonowDev@users.noreply.github.com> Co-authored-by: Dizzle <112548150+maxmad64bis@users.noreply.github.com> Co-authored-by: Max <maxmad64@gmail.com> Co-authored-by: Harvey Doan <mnhatlinh.doan@gmail.com> Co-authored-by: linh.doan <linh.doan@be.com.vn> Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com> Co-authored-by: Probe Test <probe@example.com> Co-authored-by: herjarsa <herjarsa@users.noreply.github.com> Co-authored-by: nguyenha935 <nguyenthanhha935@gmail.com> Co-authored-by: Nguyễn Thanh Hà <nguyenha@Mac-mini-M4.local> Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com> Co-authored-by: Md Sadruzzahan Khan <2023-1-60-147@std.ewubd.edu> Co-authored-by: sadruzzahan <istykhan.ik@gmail.com> Co-authored-by: Joshim Uddin <70097642+JoshimOfficial@users.noreply.github.com> Co-authored-by: Rouzbeh† <78313022+rqzbeh@users.noreply.github.com> Co-authored-by: rqzbeh <rqzbeh@users.noreply.github.com> Co-authored-by: Alan Vb <53047487+allanvb@users.noreply.github.com> Co-authored-by: allanvb <allanvb@users.noreply.github.com> Co-authored-by: Prudhvivuda <Prudhvivuda@users.noreply.github.com> Co-authored-by: Gustavo Costa <guhcostan@gmail.com> Co-authored-by: RCrushMe <299186960+RCrushMe@users.noreply.github.com> Co-authored-by: TonPro <hello@tonpro.fu> Co-authored-by: Makcim Ivanov <makcimbx@gmail.com> Co-authored-by: Makcim Ivanov <10184529+makcimbx@users.noreply.github.com> Co-authored-by: maxmad64bis <maxmad64bis@users.noreply.github.com> Co-authored-by: Austin Liu <193228693+Dingding-leo@users.noreply.github.com> Co-authored-by: rinseaid <richardjhunt@gmail.com> Co-authored-by: fuko2935 <66748427+fuko2935@users.noreply.github.com> Co-authored-by: SteeleHu <51671175+SteeleHu@users.noreply.github.com> Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local> Co-authored-by: saroj_r <git@xn--81b3bxa1f.com> Co-authored-by: Kamal Pandey <18480929+justdoGIT@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw24@gmail.com> Co-authored-by: Mananz90 <130450677+Mananz90@users.noreply.github.com> Co-authored-by: Gillz <gillz@Gillzs-MacBook-Pro.local> Co-authored-by: epsilonode <40526619+epsilonode@users.noreply.github.com> Co-authored-by: amitgolan60-coder <amitgolan60@gmail.com> Co-authored-by: rinseaid <rinseaid@rinseaid.net> Co-authored-by: Erick Kinnee <erick@kinnee.net> Co-authored-by: Erick Kinnee <erick@ekinnee.dev> Co-authored-by: 0xheycat <81378817+0xheycat@users.noreply.github.com> Co-authored-by: Shixi Li <40780706+shixi-li@users.noreply.github.com> Co-authored-by: Marceli Pawlinski <marceli@pawlinski.pl> Co-authored-by: brunnolouzada <brunnolsji@gmail.com> Co-authored-by: mikeiagents <iagents@mikek8s.win> Co-authored-by: Michael de Souza Marcos <michael.smarcos@hotmail.com> Co-authored-by: Jonathan Bailey <127773378+excessivechaos@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Éder Costa <eder.almeida.costa@gmail.com> Co-authored-by: Escalada Online <aescaladaonline@gmail.com> Co-authored-by: glaze <luyiping1011@gmail.com> Co-authored-by: MumuTW <johnsxn.us@gmail.com> Co-authored-by: Wilson <pedbookmed@gmail.com> Co-authored-by: NBN-N3 <noc2@nbntelecom.com.br> Co-authored-by: Tito Fauzan Putra <141005910+TitoTFP@users.noreply.github.com> Co-authored-by: hppsc1215 <34004905+hppsc1215@users.noreply.github.com> Co-authored-by: Alex <sefias_methue@hotmail.de> Co-authored-by: Suman <53814993+sumanxg@users.noreply.github.com> Co-authored-by: Will Gordon <wgordon@redhat.com> Co-authored-by: rafaeldrincon <rafaeldrincon@gmail.com> Co-authored-by: rafaeldrincon <rafaeldrincon@users.noreply.github.com>
This commit is contained in:
Diego Rodrigues de Sa e Souza
committed by
GitHub
GitHub
parent
4ed014469a
commit
c9d4a45f18
253
.env.example
253
.env.example
@@ -40,6 +40,11 @@ INITIAL_PASSWORD=CHANGEME
|
||||
# also if you want to share the same database as "npm run dev" use "./data"
|
||||
# DATA_DIR=/var/lib/omniroute
|
||||
|
||||
# Fallback alias for DATA_DIR, checked only when DATA_DIR is unset.
|
||||
# Used by: open-sse/executors/promptql/threadSticky.ts — locates the PromptQL
|
||||
# executor's on-disk thread-sticky session cache. Leave unset to rely on DATA_DIR.
|
||||
# OMNIROUTE_DATA_DIR=/var/lib/omniroute
|
||||
|
||||
# Encryption key for SQLite database encryption at rest.
|
||||
# Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
|
||||
# Generate: openssl rand -hex 32 | Leave empty to disable DB encryption.
|
||||
@@ -75,8 +80,26 @@ PORT=20128
|
||||
|
||||
# Base path (URL subpath) when serving OmniRoute behind a reverse proxy under a subpath.
|
||||
# Used by: next.config.mjs — sets Next.js `basePath`; auth redirects are basePath-aware.
|
||||
# Also mirrored to NEXT_PUBLIC_OMNIROUTE_BASE_PATH at build time so the dashboard
|
||||
# endpoint display (useDisplayBaseUrl) shows https://host/omniroute/v1 instead of
|
||||
# https://host/v1. Rebuild after changing this value (Next basePath is build-time).
|
||||
# Default: "" (served at the domain root). Example: /omniroute to serve under https://host/omniroute
|
||||
# Docker: baked at image build time via build-arg; root-path images can also apply this at
|
||||
# container start (see docs/guides/DOCKER_GUIDE.md).
|
||||
# OMNIROUTE_BASE_PATH=
|
||||
# Client fetch/EventSource under this path are rewritten via installBasePathFetch
|
||||
# (src/shared/utils/basePathFetch.ts) so absolute `/api/*` and `/v1/*` hits work
|
||||
# without a reverse-proxy rewrite. Rebuild after changing (Next basePath is build-time).
|
||||
#
|
||||
# Browser-visible mirror of OMNIROUTE_BASE_PATH, inlined at build time so the
|
||||
# dashboard endpoint display can read it client-side. Set it to the same value
|
||||
# as OMNIROUTE_BASE_PATH; when unset the hook falls back to OMNIROUTE_BASE_PATH.
|
||||
# Used by: src/shared/hooks/useDisplayBaseUrl.ts
|
||||
# NEXT_PUBLIC_OMNIROUTE_BASE_PATH=
|
||||
#
|
||||
# Optional: set the public origin *with* the same path so OAuth and display URLs
|
||||
# stay consistent without relying on window.location.origin alone:
|
||||
# NEXT_PUBLIC_BASE_URL=https://host/omniroute
|
||||
|
||||
# Split-port mode: serve Dashboard and API on separate ports for network isolation.
|
||||
# Used by: src/lib/runtime/ports.ts — overrides PORT for each service.
|
||||
@@ -88,6 +111,14 @@ PORT=20128
|
||||
# Used by: src/sse/utils/backpressure.ts — disabled when unset/0.
|
||||
# OMNI_MAX_CONCURRENT_CONNECTIONS=0
|
||||
|
||||
# Optional OmniRoute-to-OmniRoute peer chaining guard. Give every instance a
|
||||
# unique ID and allowlist only the other OmniRoute base URLs it may call.
|
||||
# Requests to allowlisted peers carry X-OmniRoute-Peer-Trace; repeated instances
|
||||
# and exhausted hop budgets are rejected with HTTP 508 before provider routing.
|
||||
# OMNIROUTE_INSTANCE_ID=gateway-a
|
||||
# OMNIROUTE_PEER_URLS=http://gateway-b:20128/v1
|
||||
# OMNIROUTE_PEER_MAX_HOPS=4
|
||||
|
||||
# Port for the real-time WebSocket live monitoring server.
|
||||
# Used by: src/server/ws/liveServer.ts, src/app/api/v1/ws/route.ts
|
||||
# Default: 20132
|
||||
@@ -209,8 +240,9 @@ NODE_ENV=production
|
||||
|
||||
# Container runtime — controls startup script behavior (permissions, advice).
|
||||
# Values: docker | podman | Default: docker
|
||||
# Set to "podman" when running under rootless Podman so the entrypoint
|
||||
# gives the correct fix instructions (podman unshare chown vs sudo chown).
|
||||
# Set to "podman" for any Podman topology. The entrypoint cannot determine
|
||||
# whether the engine is local or reached through Podman Machine, so it prints
|
||||
# topology-neutral guidance and links contrib/podman/README.md.
|
||||
CONTAINER_HOST=docker
|
||||
|
||||
# Container runtime override for skill sandboxing.
|
||||
@@ -222,7 +254,7 @@ CONTAINER_HOST=docker
|
||||
# - orbstack: OrbStack (high-perf Linux VM + docker shim on macOS)
|
||||
# - podman: Podman (rootless, daemonless)
|
||||
# - docker: Docker (default fallback)
|
||||
SKILLS_SANDBOX_RUNTIME=auto
|
||||
# (defined under SKILLS & SANDBOXING section below)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# 4. SECURITY & AUTHENTICATION
|
||||
@@ -288,18 +320,25 @@ ALLOW_API_KEY_REVEAL=false
|
||||
# Default: 10485760 (10 MB)
|
||||
# MAX_BODY_SIZE_BYTES=10485760
|
||||
|
||||
# Heap-pressure-aware admission for POST /v1/chat/completions (#5152). A large
|
||||
# coding-agent "compact" body amplifies into hundreds of MB of transient JS objects
|
||||
# on the combo path; concurrent compacts can stack past the V8 heap ceiling and OOM
|
||||
# the process. These shed a LARGE body with 503 (Retry-After) only while the heap is
|
||||
# already under pressure — healthy heap admits every body untouched.
|
||||
# Atomic admission for POST /v1/chat/completions (#7846). Large request bodies
|
||||
# amplify into multiple transient representations during parsing, compression, and
|
||||
# provider dispatch. Heavyweight capacity is reserved before parsing; excess work
|
||||
# receives 503 + Retry-After instead of overlapping until the process OOMs.
|
||||
# Used by: src/shared/middleware/chatBodyAdmission.ts
|
||||
# Bodies below this size skip the guard entirely (heap not even sampled). Default 262144 (256 KB).
|
||||
# Actual bodies at or above this size require a heavyweight lease. Default 262144 (256 KB).
|
||||
# OMNIROUTE_CHAT_LARGE_BODY_BYTES=262144
|
||||
# Hard cap — bodies above this are rejected with 413 before any clone/parse. Default 52428800 (50 MB).
|
||||
# Actual-byte hard cap enforced during bounded ingestion. Default 52428800 (50 MB).
|
||||
# OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES=52428800
|
||||
# Shed large bodies once heapUsed/heap_size_limit reaches this ratio (0<r<1). Default 0.75.
|
||||
# OMNIROUTE_CHAT_HEAP_SHED_RATIO=0.75
|
||||
# Maximum heavyweight requests simultaneously admitted in one process. Default 1.
|
||||
# OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT=1
|
||||
# Message count that classifies an otherwise small body as heavyweight. Default 200.
|
||||
# OMNIROUTE_CHAT_HEAVY_MESSAGE_COUNT=200
|
||||
# Tool count that classifies an otherwise small body as heavyweight. Default 64.
|
||||
# OMNIROUTE_CHAT_HEAVY_TOOL_COUNT=64
|
||||
# Conservative string-size token estimate that classifies a request as heavyweight. Default 32000.
|
||||
# OMNIROUTE_CHAT_HEAVY_ESTIMATED_TOKENS=32000
|
||||
# Hard message-count cap; excess receives compact-required 413. Default 800.
|
||||
# OMNIROUTE_CHAT_HARD_MAX_MESSAGES=800
|
||||
|
||||
# Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
|
||||
# (#5152). Past this the upstream reader is cancelled and the request fails fast
|
||||
@@ -340,16 +379,24 @@ ALLOW_API_KEY_REVEAL=false
|
||||
# ── Request-Side: Prompt Injection Guard ──
|
||||
# Scans incoming messages for prompt injection patterns before routing.
|
||||
# Used by: src/middleware/promptInjectionGuard.ts
|
||||
# INPUT_SANITIZER_ENABLED=true
|
||||
# INPUT_SANITIZER_MODE=warn # warn = log only | block = reject request | redact = strip patterns
|
||||
# Default ON when unset. Set to false/0/no/off to disable. Truthy: true/1/yes/on.
|
||||
# INPUT_SANITIZER_ENABLED=false
|
||||
# INPUT_SANITIZER_MODE=warn # warn = log only | block = reject request | redact = legacy (does NOT strip injection; use PII_REDACTION_ENABLED for request PII)
|
||||
# INPUT_SANITIZER_BLOCK_THRESHOLD=high # high (default) | medium | low — severities at/above this are blocked in block mode
|
||||
|
||||
# Legacy alias for INPUT_SANITIZER_MODE (same effect).
|
||||
# Legacy aliases for INPUT_SANITIZER_MODE / INPUT_SANITIZER_BLOCK_THRESHOLD (same effect).
|
||||
# INJECTION_GUARD_MODE=warn
|
||||
# INJECTION_GUARD_BLOCK_THRESHOLD=high
|
||||
|
||||
# PII detection in incoming requests (emails, phone numbers, SSNs, etc.).
|
||||
# Used by: src/middleware/promptInjectionGuard.ts — extends injection guard.
|
||||
# PII_REDACTION_ENABLED=false
|
||||
|
||||
# Redacts well-known API-key / secret-token patterns (OpenAI, Anthropic, GitHub,
|
||||
# Slack, etc.) from request/response payloads before they reach providers/clients.
|
||||
# Opt-in; mirrors PII_REDACTION_ENABLED. Used by: src/lib/guardrails/credentialMasker.ts.
|
||||
# CREDENTIAL_REDACTION_ENABLED=false
|
||||
|
||||
# Minimum streaming window size for PII detection (bytes). Default: 200.
|
||||
# Used by: src/lib/streamingPiiTransform.ts.
|
||||
# PII_WINDOW_SIZE=200
|
||||
@@ -649,6 +696,15 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
|
||||
# Legacy alias for OMNIROUTE_API_KEY.
|
||||
# ROUTER_API_KEY=
|
||||
|
||||
# Enable the offline/local Issue Agent recorded-triage endpoint.
|
||||
# Used by: src/app/api/issue-agent/runs/route.ts. Default: disabled.
|
||||
# OMNIROUTE_ISSUE_AGENT_ENABLED=false
|
||||
|
||||
# Timeout (ms) for a single Issue Agent recorded-triage run. Clamped to an internal
|
||||
# maximum; falls back to the built-in default when unset or invalid.
|
||||
# Used by: src/lib/issueAgent/execution.ts.
|
||||
# OMNIROUTE_ISSUE_AGENT_TIMEOUT_MS=
|
||||
|
||||
# CLI remote-mode context/profile for `omniroute` commands (overrides the active
|
||||
# context in the local contexts store). Equivalent to the `--context <name>` flag.
|
||||
# Used by: bin/cli/program.mjs, bin/cli/api.mjs (remote mode).
|
||||
@@ -755,6 +811,15 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
|
||||
# Default: <repo>/src/lib/db/migrations.
|
||||
#OMNIROUTE_MIGRATIONS_DIR=
|
||||
|
||||
# Additional migration directories, as `namespace=dir` entries separated by the
|
||||
# platform path delimiter (`:` on POSIX, `;` on Windows). Files found there are
|
||||
# recorded as `<namespace>-<number>` (e.g. `ee-134`), a version space that cannot
|
||||
# collide with the upstream numeric slots — so a distribution shipping its own
|
||||
# migrations never silently loses one to a number the upstream set also claimed.
|
||||
# A malformed entry, an invalid namespace or a missing directory aborts startup
|
||||
# rather than skipping the schema. Unset = no extra directories (the default).
|
||||
#OMNIROUTE_EXTRA_MIGRATIONS_DIRS=ee=/opt/app/enterprise/db/migrations
|
||||
|
||||
# Mass-pending-migrations safety threshold (#3416). If more than this many
|
||||
# migrations are pending on an existing DB, startup aborts (a wiped tracking
|
||||
# table could cause data loss). Raise it to restore an older backup; set to 0
|
||||
@@ -817,10 +882,11 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
|
||||
# Used by: open-sse/executors/antigravity.ts — escape hatch for multi-project setups.
|
||||
# OMNIROUTE_ALLOW_BODY_PROJECT_OVERRIDE=0
|
||||
|
||||
# Adjust how Antigravity advertises remaining credits. Used by:
|
||||
# open-sse/services/antigravityCredits.ts — accepts forced override strings.
|
||||
# Default: empty (use upstream-reported credits).
|
||||
#ANTIGRAVITY_CREDITS=
|
||||
# Control Antigravity Google One AI credit usage. Used by:
|
||||
# open-sse/services/antigravityCredits.ts — accepts off, retry, or always.
|
||||
# off (default): never use credits; retry: use credits once after eligible quota 429;
|
||||
# always: use credits on the first request (higher account and spend risk).
|
||||
#ANTIGRAVITY_CREDITS=off
|
||||
|
||||
# Override the path to the Antigravity CLI (agy) token file read by the
|
||||
# "auto-detect local login" import. Used by:
|
||||
@@ -874,15 +940,17 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
|
||||
# ANTIGRAVITY_OAUTH_CLIENT_SECRET=
|
||||
# WINDSURF_FIREBASE_API_KEY=
|
||||
|
||||
# ── Qwen (Alibaba) ──
|
||||
QWEN_OAUTH_CLIENT_ID=f0304373b74a44d2b584a3fb70ca9e56
|
||||
|
||||
# ── Kimi Coding (Moonshot) ──
|
||||
KIMI_CODING_OAUTH_CLIENT_ID=17e5f671-d194-4dfb-9706-5516cb48c098
|
||||
|
||||
# ── GitHub Copilot ──
|
||||
GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
|
||||
|
||||
# ── GitHub Enterprise (GHE) Copilot ──
|
||||
# Optional override for GHE Copilot's OAuth client id. Falls back to the public
|
||||
# GITHUB_OAUTH_CLIENT_ID default when unset. Used by: src/lib/oauth/constants/oauth.ts.
|
||||
# GHE_COPILOT_OAUTH_CLIENT_ID=
|
||||
|
||||
# ── GitLab Duo ──
|
||||
# Register an OAuth app at: https://gitlab.com/-/profile/applications
|
||||
# Set redirect URI to: http://localhost:20128/callback (or your NEXT_PUBLIC_BASE_URL + /callback)
|
||||
@@ -987,7 +1055,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
|
||||
# Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
|
||||
# Update these when providers release new CLI versions to avoid blocks.
|
||||
|
||||
CLAUDE_USER_AGENT="claude-cli/2.1.207 (external, cli)"
|
||||
CLAUDE_USER_AGENT="claude-cli/2.1.219 (external, cli)"
|
||||
|
||||
# Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
|
||||
# (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
|
||||
@@ -1012,7 +1080,6 @@ KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
|
||||
# Used by: open-sse/executors/kiro.ts
|
||||
# KIRO_VERIFY_FULL_CRC=false
|
||||
QODER_USER_AGENT="Qoder-Cli"
|
||||
QWEN_USER_AGENT="QwenCode/0.19.3 (linux; x64)"
|
||||
CURSOR_USER_AGENT="Cursor/3.4"
|
||||
|
||||
# Override Codex client version sent in headers independently of the
|
||||
@@ -1042,8 +1109,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
|
||||
# CLI_COMPAT_KIMI_CODING=1
|
||||
# CLI_COMPAT_KILOCODE=1
|
||||
# CLI_COMPAT_CLINE=1
|
||||
# CLI_COMPAT_QWEN=1
|
||||
|
||||
# Or enable for all providers at once:
|
||||
# CLI_COMPAT_ALL=1
|
||||
|
||||
@@ -1139,6 +1204,20 @@ CURSOR_USER_AGENT="Cursor/3.4"
|
||||
# OMNIROUTE_GROK_TLS_TIMEOUT_MS=60000
|
||||
# OMNIROUTE_GROK_TLS_GRACE_MS=10000
|
||||
|
||||
# ── Notion web TLS sidecar (Chrome-fingerprinted client) ──
|
||||
# Used by: open-sse/services/notionTlsClient.ts — wire-level timeout for the
|
||||
# bogdanfinn/tls-client koffi binding and the JS-side grace window layered on
|
||||
# top of it when the native library is wedged. The notion-web executor raises
|
||||
# the wire timeout per-request to 180000 for long generations.
|
||||
# OMNIROUTE_NOTION_TLS_TIMEOUT_MS=30000
|
||||
# OMNIROUTE_NOTION_TLS_GRACE_MS=10000
|
||||
|
||||
# ── Grok web quota fetcher (auth.json override) ──
|
||||
# Used by: open-sse/services/grokQuotaFetcher.ts — path of the Grok CLI
|
||||
# auth.json used to fetch the grok-web weekly quota. Defaults to
|
||||
# ~/.grok/auth.json; override for tests or a non-standard CLI install.
|
||||
# GROK_AUTH_PATH=
|
||||
|
||||
# ── Browser-backed web-cookie chat (Playwright shared pool) ──
|
||||
# Used by: open-sse/services/browserPool.ts + browserBackedChat.ts. The shared
|
||||
# browser pool warms a headless context for web-cookie providers (e.g. claude-web)
|
||||
@@ -1169,6 +1248,13 @@ CURSOR_USER_AGENT="Cursor/3.4"
|
||||
# PIN_DROP_BACKOFF_LEVEL=2
|
||||
# PIN_DROP_GRACE_MS=20000
|
||||
|
||||
# Whether OmniRoute may emit SSE `:` comment lines (e.g. the `: keepalive` heartbeat).
|
||||
# Some strict OpenAI-compatible clients parse every SSE line as JSON and crash on `:`
|
||||
# comments. Set to `off` to suppress comment-shaped heartbeats (they become a no-op);
|
||||
# `data:` heartbeats are unaffected. Default: enabled.
|
||||
# Used by: open-sse/utils/sseHeartbeat.ts.
|
||||
# OMNIROUTE_SSE_COMMENTS=off
|
||||
|
||||
# ── Stream idle detection ──
|
||||
# STREAM_IDLE_TIMEOUT_MS=600000 # Max silence between SSE chunks (default: 600000)
|
||||
# # Extended-thinking models rarely pause >90s.
|
||||
@@ -1425,6 +1511,12 @@ APP_LOG_TO_FILE=true
|
||||
# NANOBANANA_POLL_TIMEOUT_MS=120000 # Max wait for job completion (default: 120s)
|
||||
# NANOBANANA_POLL_INTERVAL_MS=2500 # Poll frequency (default: 2.5s)
|
||||
|
||||
# ── Microsoft Designer Web (Image Generation) ──
|
||||
# Polling config for the microsoft-designer-web submit-then-poll image job.
|
||||
# Used by: open-sse/handlers/imageGeneration/providers/designerWeb.ts
|
||||
# DESIGNER_WEB_POLL_TIMEOUT_MS=60000 # Max wait for job completion (default: 60s)
|
||||
# DESIGNER_WEB_POLL_INTERVAL_MS=2000 # Poll frequency (default: 2s)
|
||||
|
||||
# ── AWS Bedrock (Kiro / Audio) ──
|
||||
# Region used to construct AWS Bedrock endpoints. Used by:
|
||||
# src/lib/providers/validation.ts and open-sse/handlers/audioSpeech.ts.
|
||||
@@ -1570,9 +1662,13 @@ APP_LOG_TO_FILE=true
|
||||
# Also configurable from Dashboard > Settings > Feature Flags.
|
||||
# OMNIROUTE_CONTROL_PLANE_PROXY_DIRECT_FALLBACK=false
|
||||
|
||||
# Rate limit maximum wait time before failing a request (ms). Default: 120000 (2 min)
|
||||
# Rate limit maximum wait time before failing a request (ms). Default: 15000 (15s)
|
||||
# Used by: open-sse/services/rateLimitManager.ts
|
||||
# RATE_LIMIT_MAX_WAIT_MS=120000
|
||||
# RATE_LIMIT_MAX_WAIT_MS=15000
|
||||
|
||||
# Rate limit queue admission cap: reject with 429 queue_full once this many requests
|
||||
# are already queued (0 = disabled/unbounded, the default). Used by: open-sse/services/rateLimitManager.ts
|
||||
# RATE_LIMIT_MAX_QUEUE_DEPTH=0
|
||||
|
||||
# Force the auto-enable rate limit safety net on/off regardless of the persisted
|
||||
# Dashboard setting. Used by: open-sse/services/rateLimitManager.ts.
|
||||
@@ -1621,6 +1717,17 @@ APP_LOG_TO_FILE=true
|
||||
# Used by: src/lib/tokenHealthCheck.ts. Default: 3000.
|
||||
# HEALTHCHECK_STAGGER_MS=3000
|
||||
|
||||
# Randomized jitter range (ms) added on top of HEALTHCHECK_STAGGER_MS between
|
||||
# provider token healthchecks, to prevent bursting (Issue #1220).
|
||||
# Used by: src/lib/tokenHealthCheck.ts. Defaults: min=500, max=5000.
|
||||
# HEALTHCHECK_JITTER_MIN_MS=500
|
||||
# HEALTHCHECK_JITTER_MAX_MS=5000
|
||||
|
||||
# Concurrent-check batch size for the startup token-healthcheck sweep. Larger
|
||||
# values check more connections in parallel; smaller values reduce burst load.
|
||||
# Used by: src/lib/tokenHealthCheck.ts. Default: 20 (Issue #7875, regression of #7719).
|
||||
# HEALTHCHECK_BATCH_SIZE=20
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
# 22. DEBUGGING
|
||||
# ═══════════════════════════════════════════════════════════════════════════════
|
||||
@@ -1723,6 +1830,10 @@ APP_LOG_TO_FILE=true
|
||||
# Tokens reserved for completion output when computing prompt budgets.
|
||||
# Used by: open-sse/services/contextManager.ts. Default: 1024.
|
||||
# CONTEXT_RESERVE_TOKENS=1024
|
||||
# How many of the newest inline images to keep when pruning older ones to fit
|
||||
# the context window (#8560). Used by: open-sse/services/contextManager.ts.
|
||||
# Default: 2.
|
||||
# CONTEXT_KEEP_LATEST_IMAGES=2
|
||||
|
||||
# ── Model alias rewriting (legacy compatibility) ──
|
||||
# Toggle the legacy model-alias compatibility layer used by older clients.
|
||||
@@ -1759,6 +1870,22 @@ APP_LOG_TO_FILE=true
|
||||
# for root-less / user-namespaced deployments (e.g. rootless Docker/Podman)
|
||||
# where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).
|
||||
# OMNIROUTE_NO_SUDO=0
|
||||
# Explicit opt-out: skip provisioning /etc/hosts DNS entries for the Antigravity
|
||||
# proxy hostnames entirely (containers with no sudo/root available).
|
||||
# Used by: src/mitm/dns/provision.ts.
|
||||
# SKIP_ANTIGRAVITY_DNS=true
|
||||
# Skip writing to the hosts file when adding/removing DNS entries (e.g. sandboxed
|
||||
# or read-only test environments). Used by: src/mitm/dns/dnsConfig.ts.
|
||||
# OMNIROUTE_SKIP_DNS_WRITE=1
|
||||
# Opt in to the root-CA + per-host-leaf cert model for the MITM proxy (#6684).
|
||||
# Fresh installs and installs with this set to "true" get a persisted root CA that
|
||||
# signs per-host leaves; installs with a pre-existing trusted legacy leaf keep the
|
||||
# legacy fixed-SAN cert unless opted in. Used by: src/mitm/manager.ts.
|
||||
# MITM_ROOT_CA_ENABLED=true
|
||||
# Set BY the MITM manager for the spawned proxy process ("root-ca" | "legacy") —
|
||||
# reflects the migration decision above; not meant to be set manually.
|
||||
# Read by: src/mitm/server.cjs.
|
||||
# MITM_CERT_MODE=legacy
|
||||
|
||||
# ── Test/CI-only guards (never needed in production) ──
|
||||
# Set automatically by tests/_setup/isolateDataDir.ts and the CI workflows: the
|
||||
@@ -1778,6 +1905,14 @@ APP_LOG_TO_FILE=true
|
||||
# ONEPROXY_MAX_PROXIES=500
|
||||
# ONEPROXY_MIN_QUALITY_THRESHOLD=50
|
||||
|
||||
# ── Free Proxy Pool (auto-sync scheduler) ──
|
||||
# Background refresh of the free-proxy pool. Opt-in, OFF by default (parallels
|
||||
# Hard Rule #20's default-off posture for data-mutating background features).
|
||||
# Used by: src/lib/freeProxyProviders/scheduler.ts
|
||||
# FREE_PROXY_AUTO_SYNC_ENABLED=true
|
||||
# Sync interval in ms (default: 1800000 = 30 min).
|
||||
# FREE_PROXY_AUTO_SYNC_INTERVAL_MS=1800000
|
||||
|
||||
# ── Free Proxy Pool (1proxy source) ──
|
||||
# Used by: src/lib/freeProxyProviders/oneproxy.ts
|
||||
# Set FREE_PROXY_1PROXY_ENABLED=false to disable this source.
|
||||
@@ -1834,6 +1969,11 @@ APP_LOG_TO_FILE=true
|
||||
# Used by: src/lib/db/backup.ts.
|
||||
# DB_BACKUP_MAX_FILES=20
|
||||
# DB_BACKUP_RETENTION_DAYS=0
|
||||
# Tick interval (ms) of the server-side job that executes backup-schedule.json.
|
||||
# Must stay well under the 1-minute cron granularity; values below 5000 (or
|
||||
# unparseable) fall back to the 30000 default.
|
||||
# Used by: src/lib/jobs/backupScheduleJob.ts
|
||||
# OMNIROUTE_BACKUP_SCHEDULE_JOB_INTERVAL_MS=30000
|
||||
|
||||
# ── TLS sidecar override ──
|
||||
# Used by: open-sse/services/chatgptTlsClient.ts tests. Production deployments
|
||||
@@ -1996,6 +2136,15 @@ QUOTA_STORE_DRIVER=sqlite # sqlite | redis
|
||||
# the full (unfiltered) pool with a warning. Source: open-sse/services/autoCombo/virtualFactory.ts
|
||||
# OMNIROUTE_AUTO_FREE_FALLBACK_TO_FULL_POOL=false
|
||||
|
||||
# ─── Auto-Combo chaos panel (broadcast variant) ────────────────────────────
|
||||
# Tuning for the `auto/*:chaos` variant, which fans a single request out to a
|
||||
# panel of provider-diverse models. Panel size is clamped to 1..10 (default 5);
|
||||
# min-panel and the panel hard-timeout fall back to the engine defaults when
|
||||
# unset. Source: open-sse/services/autoCombo/virtualFactory.ts
|
||||
# OMNIROUTE_CHAOS_MAX_PANEL=5
|
||||
# OMNIROUTE_CHAOS_MIN_PANEL=
|
||||
# OMNIROUTE_CHAOS_PANEL_TIMEOUT_MS=
|
||||
|
||||
# ─── OpenCode config regeneration (scripts/ad-hoc/regen-opencode-config.ts) ───
|
||||
# Base URL of the OmniRoute instance to query for /v1/models when regenerating
|
||||
# an opencode.json with accurate limit.context values. Used by:
|
||||
@@ -2133,3 +2282,51 @@ QUOTA_STORE_DRIVER=sqlite # sqlite | redis
|
||||
# OMNIROUTE_ROTATE_ON_400=false
|
||||
# OMNIROUTE_ROTATE_400_THRESHOLD=1
|
||||
# OMNIROUTE_ROTATE_400_WINDOW_SECONDS=120
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# PromptQL playground provider (Unofficial/Experimental — src/shared/constants/providers/web-cookie.ts)
|
||||
# Reverse-engineered GraphQL session bridge for prompt.ql.app. All optional —
|
||||
# defaults point at the public playground endpoints; override only for a
|
||||
# self-hosted/alternate PromptQL deployment.
|
||||
# Used by: open-sse/executors/promptql.ts, open-sse/services/usage/promptql.ts
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# PROMPTQL_GRAPHQL_ENDPOINT=https://data.prompt.ql.app/promptql/playground-v2-hge/v1/graphql
|
||||
# PROMPTQL_CREDITS_ENDPOINT=https://data.pro.ql.app/v1/graphql
|
||||
# PROMPTQL_TOKEN_REFRESH_URL=https://auth.pro.ql.app/ddn/project/token
|
||||
# PROMPTQL_POLL_TIMEOUT_MS=180000
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# HyperAgent web provider (Unofficial/Experimental — src/shared/constants/providers/web-cookie.ts)
|
||||
# Reverse-engineered session bridge for hyperagent.com. Optional — defaults
|
||||
# point at the public billing/usage endpoint; override only for a
|
||||
# self-hosted/alternate HyperAgent deployment.
|
||||
# Used by: open-sse/services/usage/hyperagent.ts
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# HYPERAGENT_USAGE_URL=https://hyperagent.com/api/settings/billing/usage
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# Browser-login VNC sessions (optional — src/lib/vncSession/manifest.ts)
|
||||
# Containerized Chromium+VNC used for interactive browser-login credential
|
||||
# capture via /api/vnc-session. All optional — defaults target the bundled
|
||||
# `omniroute-vnc-chromium:local` image; override only for a custom image, ports,
|
||||
# or lifecycle tuning.
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# OMNIROUTE_VNC_IMAGE=omniroute-vnc-chromium:local
|
||||
# OMNIROUTE_DOCKER_BIN=docker
|
||||
# OMNIROUTE_VNC_CONTAINER_VNC_PORT=3000
|
||||
# OMNIROUTE_VNC_CONTAINER_CDP_PORT=9223
|
||||
# OMNIROUTE_VNC_CONTAINER_PROFILE_DIR=/config
|
||||
# OMNIROUTE_VNC_PROFILE_DIR=
|
||||
# OMNIROUTE_VNC_IDLE_MS=600000
|
||||
# OMNIROUTE_VNC_MAX_MS=1800000
|
||||
# OMNIROUTE_VNC_MAX_SESSIONS=4
|
||||
# OMNIROUTE_VNC_READY_MS=45000
|
||||
# OMNIROUTE_VNC_HARVEST_MS=20000
|
||||
# OMNIROUTE_VNC_CHROMIUM_ARGS=--remote-debugging-port=9222 --no-first-run --no-default-browser-check
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# Data-dir alias (optional — open-sse/services/notionThreadSessions.ts)
|
||||
# Legacy fallback for DATA_DIR, checked only after DATA_DIR and
|
||||
# OMNIROUTE_DATA_DIR are both unset. Locates the Notion web-thread session cache.
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# VIBEPROXY_DATA_DIR=
|
||||
|
||||
8
.github/pull_request_template.md
vendored
8
.github/pull_request_template.md
vendored
@@ -9,10 +9,12 @@
|
||||
|
||||
## Validation
|
||||
|
||||
Run only the focused loop for what you changed — the full unit suite, Vitest, the
|
||||
60% coverage gate, and the production build all run in CI on this PR (#8329):
|
||||
|
||||
- [ ] Focused tests for the change: `node --import tsx/esm --test tests/unit/<file>.test.ts`
|
||||
- [ ] `npm run lint`
|
||||
- [ ] `npm run test:unit`
|
||||
- [ ] `npm run test:coverage`
|
||||
- [ ] Coverage is still `>= 60%` for statements, lines, functions, and branches
|
||||
- [ ] Production-code changes include a new or updated automated test in this PR
|
||||
- [ ] SonarQube PR analysis is green or any remaining issues are explicitly documented below
|
||||
|
||||
## Tests Added Or Updated
|
||||
|
||||
39
.github/workflows/build-rinseaid-image.yml
vendored
Normal file
39
.github/workflows/build-rinseaid-image.yml
vendored
Normal file
@@ -0,0 +1,39 @@
|
||||
name: Build Rinseaid OmniRoute image
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [build-k3-reasoning-image]
|
||||
paths:
|
||||
- Dockerfile
|
||||
- package-lock.json
|
||||
- package.json
|
||||
- open-sse/**
|
||||
- scripts/build/**
|
||||
- .github/workflows/build-rinseaid-image.yml
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
target: runner-base
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
tags: ghcr.io/rinseaid/omniroute:k3-reasoning-${{ github.sha }}
|
||||
93
.github/workflows/ci.yml
vendored
93
.github/workflows/ci.yml
vendored
@@ -35,11 +35,11 @@ jobs:
|
||||
workflow: ${{ steps.classify.outputs.workflow }}
|
||||
testsOnly: ${{ steps.classify.outputs.testsOnly }}
|
||||
steps:
|
||||
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
||||
with:
|
||||
persist-credentials: false
|
||||
fetch-depth: 0
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
- id: classify
|
||||
@@ -82,7 +82,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -171,7 +171,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -280,7 +280,7 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
fetch-depth: 0
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -388,7 +388,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -424,7 +424,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -449,15 +449,46 @@ jobs:
|
||||
# UI keys move with dashboard code OR message catalogs.
|
||||
if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
|
||||
steps:
|
||||
# fetch-depth: 0 — the value-drift gate diffs en.json against the merge base to
|
||||
# find rewritten English strings. On a shallow clone the base ref is missing and
|
||||
# the gate self-skips (base-unresolved), so it would never actually run.
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
fetch-depth: 0
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
- uses: ./.github/actions/npm-ci-retry
|
||||
- run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65
|
||||
# #8463: a rewritten English value used to leave its 39 translations behind
|
||||
# silently (googleOAuthWarning shipped wrong copy in 39 locales for months).
|
||||
# Key parity above cannot see it — a stale translation counts as covered.
|
||||
- name: i18n UI value drift (stale translations)
|
||||
env:
|
||||
BASE_REF: ${{ github.base_ref && format('origin/{0}', github.base_ref) || '' }}
|
||||
run: node scripts/i18n/check-ui-value-drift.mjs
|
||||
|
||||
# #8038: cheap single-locale glossary/protected-terms consistency gate —
|
||||
# complements i18n-ui-coverage (key parity) and the ICU `i18n` job below
|
||||
# without needing app-boot/Playwright infra. Same gating as i18n-ui-coverage.
|
||||
i18n-glossary-zhcn:
|
||||
name: i18n Glossary (zh-CN)
|
||||
runs-on: ubuntu-latest
|
||||
needs: changes
|
||||
if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
- uses: ./.github/actions/npm-ci-retry
|
||||
- run: node scripts/i18n/check-glossary-consistency.mjs --locale=zh-CN
|
||||
- run: node scripts/i18n/check-glossary-consistency.mjs --locale=zh-TW
|
||||
|
||||
# D4 (plano mestre testes+CI): a matrix de ~40 jobs de <1min por idioma saturava sozinha
|
||||
# a concorrência de jobs da conta (Free = 20 slots, compartilhados entre TODOS os repos)
|
||||
@@ -477,7 +508,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-python@v6
|
||||
- uses: actions/setup-python@v7
|
||||
with:
|
||||
python-version: "3.12"
|
||||
- name: Validate all languages
|
||||
@@ -515,7 +546,7 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
fetch-depth: 0
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
- name: Fetch base branch
|
||||
@@ -554,7 +585,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -602,7 +633,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -649,7 +680,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -710,7 +741,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -741,6 +772,23 @@ jobs:
|
||||
path: coverage-shard/*.json
|
||||
if-no-files-found: error
|
||||
|
||||
test-bun-sqlite:
|
||||
name: Bun SQLite Compatibility
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
needs: changes
|
||||
if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
- uses: ./.github/actions/npm-ci-retry
|
||||
- run: npm run test:bun:db
|
||||
|
||||
test-vitest:
|
||||
name: Vitest (MCP / autoCombo / UI components)
|
||||
# Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
|
||||
@@ -757,7 +805,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -802,7 +850,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -871,7 +919,7 @@ jobs:
|
||||
# (if-no-files-found: warn) — Sonar consumes the same file.
|
||||
- name: Upload coverage to Codecov (informational)
|
||||
if: always()
|
||||
uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
|
||||
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
|
||||
with:
|
||||
files: coverage/lcov.info
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
@@ -1045,7 +1093,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -1078,7 +1126,8 @@ jobs:
|
||||
if FILES=$(node scripts/quality/balance-e2e-shards.mjs "$SHARD" 9); then
|
||||
if [ -z "$FILES" ]; then echo "[e2e-balance] shard $SHARD has no files"; exit 0; fi
|
||||
echo "[e2e-balance] shard $SHARD runs:"; echo "$FILES"
|
||||
# shellcheck disable=SC2086 — FILES is our own newline-separated path list
|
||||
# FILES is our own newline-separated path list, so word-splitting is intended
|
||||
# shellcheck disable=SC2086,SC2046
|
||||
npx playwright test $(echo "$FILES" | tr '\n' ' ') --reporter=line,junit
|
||||
else
|
||||
echo "[e2e-balance] balancer unavailable — plain --shard fallback"
|
||||
@@ -1115,7 +1164,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -1138,7 +1187,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -1155,6 +1204,7 @@ jobs:
|
||||
- lint
|
||||
- docs-sync-strict
|
||||
- i18n-ui-coverage
|
||||
- i18n-glossary-zhcn
|
||||
- i18n
|
||||
- pr-test-policy
|
||||
- build
|
||||
@@ -1200,6 +1250,7 @@ jobs:
|
||||
echo "| Lint | $(status '${{ needs.lint.result }}') |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Docs Sync (Strict) | $(status '${{ needs.docs-sync-strict.result }}') |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| i18n UI Coverage | $(status '${{ needs.i18n-ui-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| i18n Glossary (zh-CN) | $(status '${{ needs.i18n-glossary-zhcn.result }}') |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| PR Test Policy | $(status '${{ needs.pr-test-policy.result }}') |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| SonarQube | $(status '${{ needs.sonarqube.result }}') |" >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
|
||||
6
.github/workflows/codeql.yml
vendored
6
.github/workflows/codeql.yml
vendored
@@ -19,13 +19,13 @@ jobs:
|
||||
actions: read
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
|
||||
- uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
|
||||
with:
|
||||
languages: javascript-typescript
|
||||
queries: security-extended
|
||||
- uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
|
||||
- uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
|
||||
with:
|
||||
category: "/language:javascript-typescript"
|
||||
|
||||
26
.github/workflows/dast-smoke.yml
vendored
26
.github/workflows/dast-smoke.yml
vendored
@@ -2,8 +2,20 @@ name: DAST smoke (PR)
|
||||
on:
|
||||
pull_request:
|
||||
branches: ["main", "release/**"]
|
||||
# Runner-cost guard (#8084): the CLI-bundle build alone is 6-11min; a docs-only PR
|
||||
# cannot change DAST behavior, so skip the whole workflow for pure docs/markdown
|
||||
# changes. Any code path in the diff still runs the full smoke.
|
||||
paths-ignore:
|
||||
- "docs/**"
|
||||
- "**/*.md"
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
# Superseded runs on the same PR must not stack 25-minute advisory builds
|
||||
# (force-push storms were holding 2-3 runners each). Same group rule as quality.yml.
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
jobs:
|
||||
dast-smoke:
|
||||
runs-on: ubuntu-latest
|
||||
@@ -18,15 +30,17 @@ jobs:
|
||||
JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
|
||||
API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
|
||||
steps:
|
||||
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
- run: npm ci
|
||||
- name: Build CLI bundle
|
||||
env:
|
||||
OMNIROUTE_BUILD_BACKEND_ONLY: "1"
|
||||
run: npm run build:cli
|
||||
- name: Start OmniRoute
|
||||
env:
|
||||
@@ -39,14 +53,20 @@ jobs:
|
||||
if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
|
||||
sleep 2
|
||||
done
|
||||
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
||||
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
||||
with:
|
||||
python-version: "3.12"
|
||||
- run: pip install schemathesis
|
||||
- name: Schemathesis smoke (high-risk endpoints, blocking)
|
||||
run: |
|
||||
# /api/auth/oidc/* is a BROWSER redirect flow (302 to the IdP, 302 back to
|
||||
# /login?oidc_error=... on every failure), not a REST endpoint: Schemathesis reads
|
||||
# those 302s as "the API accepted a schema-violating request" and the configured-off
|
||||
# 400 as "rejected a schema-compliant request". Documenting the flow in the spec is
|
||||
# still right (operators need it); fuzzing it is not what this smoke is for.
|
||||
schemathesis run docs/openapi.yaml --url http://localhost:20128 \
|
||||
--include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
|
||||
--exclude-path-regex '^/api/auth/oidc/' \
|
||||
--max-examples 8 --workers 4 --checks all --max-response-time 30 \
|
||||
--request-timeout 20 --suppress-health-check all --no-color
|
||||
- name: promptfoo injection-guard (blocking)
|
||||
|
||||
2
.github/workflows/electron-release.yml
vendored
2
.github/workflows/electron-release.yml
vendored
@@ -88,7 +88,7 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v6
|
||||
uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: 24
|
||||
cache: npm
|
||||
|
||||
2
.github/workflows/mutation-redundancy.yml
vendored
2
.github/workflows/mutation-redundancy.yml
vendored
@@ -44,7 +44,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
|
||||
17
.github/workflows/nightly-compat.yml
vendored
17
.github/workflows/nightly-compat.yml
vendored
@@ -66,12 +66,25 @@ jobs:
|
||||
with:
|
||||
ref: ${{ needs.resolve-branch.outputs.target }}
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "26"
|
||||
cache: npm
|
||||
- uses: ./.github/actions/npm-ci-retry
|
||||
# #8090 — this is the ONLY Node 26 build in the whole CI matrix (ci.yml pins
|
||||
# CI_NODE_VERSION=24). It failed every nightly with the runner-reclaimed
|
||||
# signature ("The runner has received a shutdown signal" / "The operation was
|
||||
# canceled", no exit code) always at the same Turbopack compile phase — a
|
||||
# classic OOM kill on the memory-constrained ubuntu-latest runner. Turbopack's
|
||||
# native (Rust, off-V8-heap) allocation is NOT bounded by --max-old-space-size
|
||||
# and peaks far higher than webpack on this large module graph (#6409), and is
|
||||
# heavier still under Node 26. Use the documented webpack fallback here: it still
|
||||
# validates that the app *builds* on Node 26 (the point of this compat job) at a
|
||||
# much lower memory peak. Turbopack-on-Node-24 stays covered by ci.yml's build
|
||||
# job. See docs/reference/ENVIRONMENT.md (OMNIROUTE_USE_TURBOPACK) and #6409.
|
||||
- run: npm run build
|
||||
env:
|
||||
OMNIROUTE_USE_TURBOPACK: "0"
|
||||
|
||||
compat-tests:
|
||||
name: Node ${{ matrix.node }} Compat Tests (${{ matrix.shard }}/4)
|
||||
@@ -93,7 +106,7 @@ jobs:
|
||||
with:
|
||||
ref: ${{ needs.resolve-branch.outputs.target }}
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ matrix.node }}
|
||||
cache: npm
|
||||
|
||||
14
.github/workflows/nightly-llm-security.yml
vendored
14
.github/workflows/nightly-llm-security.yml
vendored
@@ -15,11 +15,13 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with: { node-version: "24", cache: npm }
|
||||
- run: npm ci
|
||||
- name: Build CLI bundle
|
||||
env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
|
||||
env:
|
||||
JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
|
||||
OMNIROUTE_BUILD_BACKEND_ONLY: "1"
|
||||
run: npm run build:cli
|
||||
- name: Start OmniRoute (block mode)
|
||||
env:
|
||||
@@ -65,14 +67,16 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
if: steps.gate.outputs.run == 'true'
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
if: steps.gate.outputs.run == 'true'
|
||||
with: { node-version: "24", cache: npm }
|
||||
- run: npm ci
|
||||
if: steps.gate.outputs.run == 'true'
|
||||
- name: Build CLI bundle
|
||||
if: steps.gate.outputs.run == 'true'
|
||||
env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
|
||||
env:
|
||||
JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
|
||||
OMNIROUTE_BUILD_BACKEND_ONLY: "1"
|
||||
run: npm run build:cli
|
||||
- name: Start OmniRoute
|
||||
if: steps.gate.outputs.run == 'true'
|
||||
@@ -86,7 +90,7 @@ jobs:
|
||||
if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
|
||||
sleep 2
|
||||
done
|
||||
- uses: actions/setup-python@v6
|
||||
- uses: actions/setup-python@v7
|
||||
if: steps.gate.outputs.run == 'true'
|
||||
with: { python-version: "3.12" }
|
||||
- run: pip install garak
|
||||
|
||||
6
.github/workflows/nightly-mutation.yml
vendored
6
.github/workflows/nightly-mutation.yml
vendored
@@ -107,7 +107,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
@@ -148,10 +148,10 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
- name: Download all mutation reports
|
||||
|
||||
2
.github/workflows/nightly-property.yml
vendored
2
.github/workflows/nightly-property.yml
vendored
@@ -13,7 +13,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
|
||||
152
.github/workflows/nightly-release-green.yml
vendored
152
.github/workflows/nightly-release-green.yml
vendored
@@ -116,7 +116,7 @@ jobs:
|
||||
git checkout "$TARGET"
|
||||
git log -1 --oneline
|
||||
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
@@ -143,7 +143,8 @@ jobs:
|
||||
MODE="--with-build --full-ci"
|
||||
fi
|
||||
echo "[release-green] mode: $MODE (event: $EVENT_NAME)"
|
||||
# shellcheck disable=SC2086 — MODE is an intentional flag list
|
||||
# MODE is an intentional flag list, so word-splitting is wanted here
|
||||
# shellcheck disable=SC2086
|
||||
node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
|
||||
1> release-green.json 2> release-green.log
|
||||
echo "exit=$?" >> "$GITHUB_OUTPUT"
|
||||
@@ -228,7 +229,7 @@ jobs:
|
||||
fetch-depth: 0
|
||||
persist-credentials: false
|
||||
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
@@ -248,7 +249,8 @@ jobs:
|
||||
MODE="--with-build --full-ci"
|
||||
fi
|
||||
echo "[main-green] mode: $MODE (event: $EVENT_NAME)"
|
||||
# shellcheck disable=SC2086 — MODE is an intentional flag list
|
||||
# MODE is an intentional flag list, so word-splitting is wanted here
|
||||
# shellcheck disable=SC2086
|
||||
node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
|
||||
1> main-green.json 2> main-green.log
|
||||
echo "exit=$?" >> "$GITHUB_OUTPUT"
|
||||
@@ -301,3 +303,145 @@ jobs:
|
||||
main-green.json
|
||||
main-green.log
|
||||
if-no-files-found: ignore
|
||||
|
||||
# ── Banking lane (#8584) ──────────────────────────────────────────────────
|
||||
# The ratchet is asymmetric: RAISING a cap is a ten-second manual JSON edit made
|
||||
# under merge pressure, LOWERING one requires someone to run `--update` and commit
|
||||
# — which no workflow does. Grep `.github/workflows/` for `--update`: only
|
||||
# wiki-sync.yml (unrelated) and ci.yml's check-quality-ratchet.mjs --require-tighten
|
||||
# (a different script, a different metric). So a cap outlives the code that earned
|
||||
# it and every completed decomposition silently becomes a growth allowance for
|
||||
# whoever touches the file next. Measured on 2026-07-25: 18 frozen files already at
|
||||
# or under the 800-line new-file cap, up to 132x (schemas.ts, 19 lines / 2523 cap),
|
||||
# and 31 unfulfilled "tighten via --update next cycle" notes honoured exactly once
|
||||
# (-1 unit) in six weeks.
|
||||
#
|
||||
# This job closes that loop by making the DOWNWARD direction as automatic as the
|
||||
# upward one is easy. It measures the active release branch, runs the shrink-only
|
||||
# `--update` paths, and opens ONE always-current PR with the result. It never
|
||||
# pushes to release/* — a human still merges, so a bad measurement cannot land
|
||||
# unreviewed. verify-ratchet-bank.mjs is the hard guarantee that the automation can
|
||||
# only ever write in the shrink direction; if anything was raised, added, or a
|
||||
# rebaseline note was touched, the job aborts and opens nothing.
|
||||
#
|
||||
# Schedule/dispatch only, deliberately NOT on push: banking has no latency
|
||||
# requirement (a shrink banked within 8h is fine) and a per-merge run would rebuild
|
||||
# the PR branch repeatedly during merge campaigns while paying for a full ESLint
|
||||
# walk each time. Detection stays on push (release-green above); banking is batched.
|
||||
bank-ratchet-shrinks:
|
||||
name: Bank ratchet shrinks
|
||||
if: ${{ github.event_name != 'push' }}
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Resolve active release branch
|
||||
id: branch
|
||||
env:
|
||||
INPUT_BRANCH: ${{ github.event.inputs.branch }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -n "${INPUT_BRANCH:-}" ]; then
|
||||
TARGET="$INPUT_BRANCH"
|
||||
else
|
||||
TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
|
||||
| sed 's#origin/##' \
|
||||
| sort -t/ -k2 -V \
|
||||
| tail -1)
|
||||
fi
|
||||
if [ -z "$TARGET" ]; then echo "No release/v* branch found"; exit 1; fi
|
||||
# Same strict guard as the validation job — blocks ref/command injection
|
||||
# through the workflow_dispatch input.
|
||||
if ! printf '%s' "$TARGET" | grep -qE '^release/v[0-9]+\.[0-9]+\.[0-9]+$'; then
|
||||
echo "Refusing non-canonical branch name: $TARGET"; exit 1
|
||||
fi
|
||||
echo "target=$TARGET" >> "$GITHUB_OUTPUT"
|
||||
echo "bank_branch=chore/bank-ratchet-${TARGET#release/}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Checkout the release branch
|
||||
env:
|
||||
TARGET: ${{ steps.branch.outputs.target }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
git checkout "$TARGET"
|
||||
git log -1 --oneline
|
||||
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
|
||||
- uses: ./.github/actions/npm-ci-retry
|
||||
|
||||
- name: Ratchet the baselines down
|
||||
run: |
|
||||
# Both --update paths are shrink-only by construction (file-size writes only
|
||||
# on `improvements`, complexity-ratchets only when `.improved`), and both exit
|
||||
# non-zero while the branch is over baseline — which is exactly when there is
|
||||
# nothing to bank. Their exit code is not the signal; the verifier below is.
|
||||
set +e
|
||||
node scripts/check/check-file-size.mjs --update
|
||||
node scripts/check/check-complexity-ratchets.mjs --update
|
||||
exit 0
|
||||
|
||||
- name: Verify the write only went downward
|
||||
id: verify
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# Exits 1 if ANYTHING was raised/added or a rebaseline note was touched.
|
||||
# `set -e` then aborts the job before a commit exists — no PR is opened.
|
||||
node scripts/quality/verify-ratchet-bank.mjs > bank-summary.md
|
||||
if [ -n "$(git status --porcelain config/quality/)" ]; then
|
||||
echo "changed=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "changed=false" >> "$GITHUB_OUTPUT"
|
||||
echo "Nothing to bank — baselines already match the code."
|
||||
fi
|
||||
|
||||
- name: Open / update the banking PR
|
||||
if: steps.verify.outputs.changed == 'true'
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
TARGET: ${{ steps.branch.outputs.target }}
|
||||
BANK_BRANCH: ${{ steps.branch.outputs.bank_branch }}
|
||||
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
||||
git checkout -B "$BANK_BRANCH"
|
||||
git add config/quality/
|
||||
git commit -m "chore(quality): bank ratchet shrinks measured on ${TARGET}"
|
||||
git push --force origin "$BANK_BRANCH"
|
||||
|
||||
{
|
||||
echo "Automated banking of quality-ratchet **shrinks** already present in"
|
||||
echo "\`${TARGET}\` — the downward half of the ratchet, which nothing else runs (#8584)."
|
||||
echo ""
|
||||
echo "Produced by \`check:file-size --update\` + \`check:complexity-ratchets --update\`,"
|
||||
echo "then verified by \`scripts/quality/verify-ratchet-bank.mjs\`: **nothing was raised,"
|
||||
echo "nothing was added, no rebaseline note was touched** — the job aborts without"
|
||||
echo "opening a PR if any of those is violated."
|
||||
echo ""
|
||||
echo "No product code changes. Merging retires growth allowances that the code no"
|
||||
echo "longer needs; not merging leaves them available to whoever edits those files next."
|
||||
echo ""
|
||||
cat bank-summary.md
|
||||
echo ""
|
||||
echo "**Run:** ${RUN_URL}"
|
||||
} > pr-body.md
|
||||
|
||||
EXISTING=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BANK_BRANCH" \
|
||||
--state open --json number --jq '.[0].number' 2>/dev/null || echo "")
|
||||
if [ -n "$EXISTING" ]; then
|
||||
gh pr edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file pr-body.md
|
||||
echo "Updated existing PR #$EXISTING"
|
||||
else
|
||||
gh pr create --repo "$GITHUB_REPOSITORY" --base "$TARGET" --head "$BANK_BRANCH" \
|
||||
--title "chore(quality): bank ratchet shrinks (${TARGET})" --body-file pr-body.md
|
||||
fi
|
||||
|
||||
9
.github/workflows/nightly-resilience.yml
vendored
9
.github/workflows/nightly-resilience.yml
vendored
@@ -15,7 +15,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
@@ -29,7 +29,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
@@ -43,7 +43,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
@@ -51,6 +51,7 @@ jobs:
|
||||
- name: Build CLI bundle
|
||||
env:
|
||||
JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
|
||||
OMNIROUTE_BUILD_BACKEND_ONLY: "1"
|
||||
run: npm run build:cli
|
||||
- name: Start OmniRoute (background)
|
||||
env:
|
||||
@@ -94,7 +95,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
cache: npm
|
||||
|
||||
8
.github/workflows/nightly-schemathesis.yml
vendored
8
.github/workflows/nightly-schemathesis.yml
vendored
@@ -16,11 +16,13 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with: { node-version: "24", cache: npm }
|
||||
- run: npm ci
|
||||
- name: Build CLI bundle
|
||||
env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
|
||||
env:
|
||||
JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
|
||||
OMNIROUTE_BUILD_BACKEND_ONLY: "1"
|
||||
run: npm run build:cli
|
||||
- name: Start OmniRoute (background)
|
||||
env:
|
||||
@@ -33,7 +35,7 @@ jobs:
|
||||
if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo "server up"; break; fi
|
||||
sleep 2
|
||||
done
|
||||
- uses: actions/setup-python@v6
|
||||
- uses: actions/setup-python@v7
|
||||
with: { python-version: "3.12" }
|
||||
- name: Install schemathesis
|
||||
run: pip install schemathesis
|
||||
|
||||
4
.github/workflows/npm-publish.yml
vendored
4
.github/workflows/npm-publish.yml
vendored
@@ -71,7 +71,7 @@ jobs:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v6
|
||||
uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
|
||||
registry-url: https://registry.npmjs.org
|
||||
@@ -265,7 +265,7 @@ jobs:
|
||||
# Full history needed for auto-bump: git diff against previous release tag
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v6
|
||||
uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
|
||||
registry-url: https://registry.npmjs.org
|
||||
|
||||
4
.github/workflows/opencode-plugin-ci.yml
vendored
4
.github/workflows/opencode-plugin-ci.yml
vendored
@@ -35,7 +35,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ matrix.node }}
|
||||
cache: npm
|
||||
@@ -52,7 +52,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: npm
|
||||
|
||||
4
.github/workflows/opencode-provider-ci.yml
vendored
4
.github/workflows/opencode-provider-ci.yml
vendored
@@ -35,7 +35,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ matrix.node }}
|
||||
cache: npm
|
||||
@@ -51,7 +51,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "20"
|
||||
cache: npm
|
||||
|
||||
62
.github/workflows/quality.yml
vendored
62
.github/workflows/quality.yml
vendored
@@ -36,7 +36,7 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
fetch-depth: 0
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
- id: classify
|
||||
@@ -57,6 +57,31 @@ jobs:
|
||||
git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
|
||||
node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
|
||||
|
||||
build:
|
||||
name: Build (advisory)
|
||||
needs: changes
|
||||
if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
|
||||
# Dynamic runner — same fork-safe rule as ci.yml / fast-gates.
|
||||
runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
|
||||
# #7307: advisory for the first week of release-PR runs; remove
|
||||
# continue-on-error after the production-build signal is stable.
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
- uses: ./.github/actions/npm-ci-retry
|
||||
- run: npm run check:node-runtime
|
||||
- run: npm run build
|
||||
env:
|
||||
OMNIROUTE_USE_TURBOPACK: "1"
|
||||
# No artifact upload here: the PR-to-release quality workflow has no
|
||||
# downstream package/e2e jobs that consume the Next.js build output.
|
||||
|
||||
# Docs/OpenAPI contract gates only — existence reason is doc accuracy + route refs.
|
||||
# Split out of fast-gates so pure-docs PRs skip typecheck/unit while still validating docs.
|
||||
docs-gates:
|
||||
@@ -68,7 +93,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -99,7 +124,7 @@ jobs:
|
||||
with:
|
||||
fetch-depth: 0
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -177,17 +202,26 @@ jobs:
|
||||
git fetch --no-tags origin "$GITHUB_BASE_REF" || true
|
||||
node scripts/quality/build-test-impact-map.mjs
|
||||
SEL="$(node scripts/quality/select-impacted-tests.mjs)"
|
||||
if [ -z "$SEL" ]; then echo "No source/test changes — skipping unit tests"; exit 0; fi
|
||||
# Shadow evidence (#8084): persist every selection so TIA false negatives can
|
||||
# be measured against fast-unit's full-suite verdict across releases BEFORE
|
||||
# any gate authority moves off ordinary PRs. Artifact uploaded below.
|
||||
printf '%s\n' "$SEL" > tia-selection.txt
|
||||
if [ -z "$SEL" ]; then
|
||||
echo "TIA selection: empty (no source/test changes)" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "No source/test changes — skipping unit tests"; exit 0
|
||||
fi
|
||||
# CI runners are 4-vCPU; run at --test-concurrency=4 (matching the ci.yml unit
|
||||
# job) rather than test:unit's local-tuned concurrency=20. Oversubscribing the
|
||||
# runner makes timing-sensitive tests (db-backup, upstream-timeout, ...) flake,
|
||||
# which must not happen on a blocking gate. DATA_DIR isolation keeps the parallel
|
||||
# run race-free regardless of concurrency.
|
||||
if echo "$SEL" | grep -q "__RUN_ALL__"; then
|
||||
echo "TIA selection: __RUN_ALL__ (fail-safe) — full-suite authority stays with fast-unit" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "Fail-safe: __RUN_ALL__ — deferring FULL unit suite to fast-unit (4-shard)."
|
||||
echo "Not re-running unsharded test:unit:ci here (duplicate of fast-unit coverage)."
|
||||
exit 0
|
||||
fi
|
||||
echo "TIA selection: $(grep -c . tia-selection.txt) impacted test file(s) — full suite still runs in fast-unit (shadow-evidence phase, #8084)" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "Running impacted tests:"; echo "$SEL"
|
||||
mapfile -t FILES <<< "$SEL"
|
||||
# Loader parity with test:unit:ci:shard (#6787): tests/unit/dashboard/** runs
|
||||
@@ -210,6 +244,16 @@ jobs:
|
||||
node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
|
||||
fi
|
||||
exit $RC
|
||||
# #8084 shadow evidence: keep the raw selection downloadable so TIA misses can be
|
||||
# audited against fast-unit failures on the same run (gate moves need this data).
|
||||
- name: Upload TIA selection (shadow evidence)
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: tia-selection
|
||||
path: tia-selection.txt
|
||||
if-no-files-found: ignore
|
||||
retention-days: 30
|
||||
|
||||
fast-vitest:
|
||||
name: Vitest (fast-path)
|
||||
@@ -225,7 +269,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -265,7 +309,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -299,7 +343,7 @@ jobs:
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v6
|
||||
- uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
@@ -339,11 +383,11 @@ jobs:
|
||||
API_KEY_SECRET: ci-lint-api-key-secret-long
|
||||
DISABLE_SQLITE_AUTO_BACKUP: "true"
|
||||
steps:
|
||||
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
|
||||
with:
|
||||
node-version: ${{ env.CI_NODE_VERSION }}
|
||||
cache: npm
|
||||
|
||||
2
.github/workflows/scorecard.yml
vendored
2
.github/workflows/scorecard.yml
vendored
@@ -26,7 +26,7 @@ jobs:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Run analysis
|
||||
uses: ossf/scorecard-action@v2.4.3
|
||||
uses: ossf/scorecard-action@v2.4.4
|
||||
with:
|
||||
results_file: results.sarif
|
||||
results_format: sarif
|
||||
|
||||
8
.github/workflows/semgrep.yml
vendored
8
.github/workflows/semgrep.yml
vendored
@@ -6,13 +6,19 @@ on:
|
||||
branches: ["main"]
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
# Cancel superseded PR runs (same rule as quality.yml). No paths filter on purpose:
|
||||
# p/secrets must keep scanning docs-only diffs too — credentials leak in .md files.
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
jobs:
|
||||
semgrep:
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
image: semgrep/semgrep
|
||||
steps:
|
||||
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Run semgrep (advisory)
|
||||
|
||||
2
.github/workflows/wiki-sync.yml
vendored
2
.github/workflows/wiki-sync.yml
vendored
@@ -40,7 +40,7 @@ jobs:
|
||||
uses: actions/checkout@v7
|
||||
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v6
|
||||
uses: actions/setup-node@v7
|
||||
with:
|
||||
node-version: "24"
|
||||
|
||||
|
||||
5
.gitignore
vendored
5
.gitignore
vendored
@@ -233,7 +233,7 @@ omniroute.md
|
||||
|
||||
# mise configuration
|
||||
mise.toml
|
||||
_artifacts/
|
||||
_artifacts/ # release-green artifacts
|
||||
.claude-flow/
|
||||
|
||||
# ESLint file cache (npm run lint --cache / complexity ratchets)
|
||||
@@ -241,7 +241,7 @@ _artifacts/
|
||||
.eslintcache-complexity
|
||||
|
||||
|
||||
# CI/local quality artifacts (eslint-results.json, etc.)
|
||||
# CI/local quality artifacts (eslint-results.json, quality-ratchet.md, etc.)
|
||||
.artifacts/
|
||||
|
||||
# Homologation E2E suite (npm run homolog) — real-environment credentials + report output
|
||||
@@ -249,3 +249,4 @@ _artifacts/
|
||||
tests/homolog/.auth/
|
||||
tests/homolog/ui/.auth/
|
||||
homolog-report/
|
||||
docker-compose.yml.bak
|
||||
|
||||
@@ -86,4 +86,10 @@
|
||||
regexes = [
|
||||
'''latencyP\d{2}Ms''',
|
||||
'''interleaved-thinking-2025-05-14''',
|
||||
# v3.8.49 pre-flight (2026-07-28). Nenhum dos dois e credencial:
|
||||
# - chave de localStorage do banner de patrocinio (#8723), so um identificador de UI;
|
||||
# - x-api-key PUBLICO do Firefly web (documentado em open-sse/utils/publicCreds.ts:207);
|
||||
# as duas ocorrencias sinalizadas estao em COMENTARIOS JSDoc, o runtime le de resolvePublicCred().
|
||||
'''omniroute-kimi-sponsor-banner-dismissed-v1''',
|
||||
'''SunbreakWebUI1''',
|
||||
]
|
||||
|
||||
@@ -3,3 +3,9 @@ docs/reference/ENVIRONMENT.md
|
||||
|
||||
# Dense auto-generated free-tier budget rows (one object per line) — prettier multi-line expand blows past file-size cap 800.
|
||||
open-sse/config/freeModelCatalog.data.ts
|
||||
|
||||
# Generated by scripts/skills/generate-agent-skills.mjs; the generator is their
|
||||
# formatter of record and check:agent-skills-sync diffs its output byte-for-byte.
|
||||
# Prettier reformats the frontmatter (blank line after ---), which makes the gate
|
||||
# fail on any skill that happens to pass through lint-staged.
|
||||
skills/*/SKILL.md
|
||||
|
||||
@@ -10,7 +10,8 @@ This plugin solves that by:
|
||||
|
||||
- Fetching `/v1/models` and `/api/combos` **at OpenCode startup, in Node.js** — no CORS, no WebView restrictions
|
||||
- Emitting the provider block **dynamically** in the plugin's `config`/`provider` hook — so `opencode.json` only needs the plugin entry, not a static `provider.omniroute`
|
||||
- Re-fetching on a configurable TTL (default 5 min), so new models / combo changes in the OmniRoute UI appear without restarting OpenCode
|
||||
- Re-fetching on a configurable TTL (default 5 min) **and** background auto-discovery while OpenCode is running (`autoSyncIntervalMs`, default 5 min), so new models / combo changes appear without restarting OpenCode
|
||||
- Exposing a force-refresh path (`omniroute_sync_models` tool + `/omni-sync` command template) equivalent to Pi `/omni sync`
|
||||
- Computing `limit.context` for combos as `min(member.context_length)` from the live catalog (no more `null` values that cause 4K-token truncation)
|
||||
- **Auto-pickup of `interleaved` capability** for thinking models (merged via PR #3138)
|
||||
|
||||
@@ -73,6 +74,9 @@ Peer dep: `@opencode-ai/plugin` (managed by your OpenCode install).
|
||||
{
|
||||
"providerId": "omniroute",
|
||||
"baseURL": "https://or.example.com",
|
||||
// Background re-discovery while OpenCode is running (Pi parity).
|
||||
// Default 300000 (5 min). Minimum 60000. Set 0 to disable.
|
||||
"autoSyncIntervalMs": 300000,
|
||||
},
|
||||
],
|
||||
],
|
||||
@@ -88,6 +92,27 @@ opencode auth login --provider omniroute
|
||||
|
||||
Restart OpenCode. `/models` lists the full live catalog. Variants (`-low`, `-medium`, `-high`, `-thinking`) and combos appear as first-class IDs — OmniRoute is the source of truth, no client-side synthesis.
|
||||
|
||||
### Live catalog refresh (auto + force)
|
||||
|
||||
While OpenCode is running, the plugin keeps the model catalog fresh in two ways:
|
||||
|
||||
| Mechanism | Default | What it does |
|
||||
| --- | --- | --- |
|
||||
| `modelCacheTtl` | `300000` (5 min) | On-demand TTL: next provider/models hook after expiry re-fetches `/v1/models` |
|
||||
| `autoSyncIntervalMs` | `300000` (5 min) | Background timer: proactively invalidates + re-fetches while the harness is running. Min `60000`. Set `0` to disable background polling (TTL still applies) |
|
||||
|
||||
**Force sync now** (Pi `/omni sync` equivalent) — OpenCode has no Pi-style slash-command registration API, so the plugin wires both a tool and command templates:
|
||||
|
||||
1. **Tool:** `omniroute_sync_models` — invalidates in-memory + disk caches, re-fetches `GET /v1/models` (and combos/enrichment when enabled), returns `{ ok, count, ... }`.
|
||||
2. **Command templates** (type these in OpenCode):
|
||||
- `/omni-sync` — asks the agent to call `omniroute_sync_models` and report the result
|
||||
- `/omni-autosync` — asks the agent to report current `autoSyncIntervalMs` / `modelCacheTtl` status
|
||||
|
||||
```text
|
||||
/omni-sync
|
||||
/omni-autosync
|
||||
```
|
||||
|
||||
## Multi-instance (prod + preprod side-by-side)
|
||||
|
||||
> ⚠ OC ≤1.15.5 dedupes plugin loads by absolute module path. Two `plugin:` entries pointing at the same `dist/index.js` collapse into one (last-listed options win). Workaround: install the plugin twice into separate directories so each entry resolves to a distinct module file. v0.2.x will introduce an `instances: [...]` shape that registers N providers from a single load.
|
||||
@@ -165,7 +190,7 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
|
||||
| Dynamic `/v1/models` | Pulls live catalog (455+ entries on prod) on each refresh, TTL-cached | `provider.models` |
|
||||
| Variants pass-through | `-low`/`-medium`/`-high`/`-thinking` ship as first-class IDs from OmniRoute (no client synthesis) | `provider.models` |
|
||||
| Combo LCD aggregation | Combos appear with intersected capabilities + min context/output across members | `provider.models` + `config` |
|
||||
| `combo/<slug>` namespace + `Combo: ` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs | both hooks |
|
||||
| `combo/<slug>` namespace + `Combo:` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs | both hooks |
|
||||
| Nice names + cost | `/api/pricing/models` display names AND `/api/pricing` per-million-token cost overlaid onto the live catalog | both hooks |
|
||||
| Canonical-twin dedup + alias-fallback | `/v1/models` exposes the same upstream model under both short alias (`cc/claude-opus-4-7`) and canonical name (`claude/claude-opus-4-7`); the plugin drops the canonical twin when an alias twin exists (no duplicate rows in the picker) and reverse-maps canonical → alias to pick up enrichment for short aliases (`dg/nova-3 → Deepgram - Nova 3`) that `/api/pricing/models` only indexes by canonical | both hooks |
|
||||
| Compression pipeline tags | Combo names get tagged with their compression pipeline (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) when `features.compressionMetadata: true`. Intensity tokens render as a traffic-light emoji: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra | both hooks |
|
||||
@@ -179,30 +204,33 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
|
||||
|
||||
## Plugin options
|
||||
|
||||
| Option | Type | Default | Description |
|
||||
| --------------- | -------- | ------------------------------------------ | ---------------------------------------------------------- |
|
||||
| `providerId` | `string` | `"omniroute"` | OpenCode provider id; must be unique across plugin entries |
|
||||
| `displayName` | `string` | `"OmniRoute"` or `OmniRoute (<id>)` | Label in the OC UI |
|
||||
| `modelCacheTtl` | `number` | `300000` (5 min) | `/v1/models` TTL in ms |
|
||||
| `baseURL` | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL |
|
||||
| `features` | `object` | see below | Feature toggles (all opt-in/out, defaults preserve v0.1.0) |
|
||||
| Option | Type | Default | Description |
|
||||
| --------------------- | -------- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
|
||||
| `providerId` | `string` | `"omniroute"` | OpenCode provider id; must be unique across plugin entries |
|
||||
| `displayName` | `string` | `"OmniRoute"` or `OmniRoute (<id>)` | Label in the OC UI |
|
||||
| `modelCacheTtl` | `number` | `300000` (5 min) | `/v1/models` TTL in ms |
|
||||
| `baseURL` | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL |
|
||||
| `managementReadToken` | `string` | falls back to `apiKey` | Optional read-only token for management catalog GETs; `/v1` inference stays on the connected `apiKey` |
|
||||
| `features` | `object` | see below | Feature toggles (all opt-in/out, defaults preserve v0.1.0) |
|
||||
|
||||
For least-privilege deployments, set top-level `managementReadToken` to a read-only management token. It is sent only to catalog reads (`/api/combos`, `/api/combos/auto`, `/api/pricing/models`, `/api/pricing`, `/api/context/combos`, and `/api/providers`). Inference requests under `/v1`, including chat, continue to use the `apiKey` stored by OpenCode. `features.mcpToken` remains independent. If `managementReadToken` is omitted, catalog reads retain the previous `apiKey` behavior.
|
||||
|
||||
### `features` block
|
||||
|
||||
Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.json` files do not need to change.
|
||||
|
||||
| Feature | Type | Default | What it does |
|
||||
| --------------------- | --------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `combos` | `boolean` | `true` | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs. |
|
||||
| `enrichment` | `boolean` | `true` | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost). |
|
||||
| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance. |
|
||||
| `providerTag` | `boolean` | `true` | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
|
||||
| `usableOnly` | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog. |
|
||||
| `diskCache` | `boolean` | `true` | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing. |
|
||||
| `geminiSanitization` | `boolean` | `true` | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini` |
|
||||
| `mcpAutoEmit` | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token |
|
||||
| `mcpToken` | `string` | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset |
|
||||
| `fetchInterceptor` | `boolean` | `true` | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded) |
|
||||
| Feature | Type | Default | What it does |
|
||||
| --------------------- | --------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `combos` | `boolean` | `true` | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs. |
|
||||
| `enrichment` | `boolean` | `true` | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost). |
|
||||
| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance. |
|
||||
| `providerTag` | `boolean` | `true` | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo:` prefix already conveys multi-upstream). |
|
||||
| `usableOnly` | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog. |
|
||||
| `diskCache` | `boolean` | `true` | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing. |
|
||||
| `geminiSanitization` | `boolean` | `true` | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini` |
|
||||
| `mcpAutoEmit` | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token |
|
||||
| `mcpToken` | `string` | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset |
|
||||
| `fetchInterceptor` | `boolean` | `true` | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded) |
|
||||
|
||||
#### Example — enrichment + compression tags + MCP auto-emit
|
||||
|
||||
@@ -214,6 +242,7 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
|
||||
{
|
||||
"providerId": "omniroute",
|
||||
"baseURL": "https://or.example.com",
|
||||
"managementReadToken": "<read-only-management-token>",
|
||||
"features": {
|
||||
"combos": true,
|
||||
"enrichment": true,
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "@omniroute/opencode-plugin",
|
||||
"version": "0.2.0",
|
||||
"version": "0.2.1",
|
||||
"description": "OpenCode plugin for the OmniRoute AI Gateway. Drives dynamic model discovery, /connect auth flow, and multi-instance OmniRoute providers via the official @opencode-ai/plugin contract.",
|
||||
"type": "module",
|
||||
"main": "./dist/index.js",
|
||||
@@ -23,7 +23,7 @@
|
||||
"scripts": {
|
||||
"build": "tsup",
|
||||
"clean": "rm -rf dist",
|
||||
"test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts",
|
||||
"test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts",
|
||||
"prepublishOnly": "npm run clean && npm run build && npm test"
|
||||
},
|
||||
"keywords": [
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
130
@omniroute/opencode-plugin/tests/auto-sync.test.ts
Normal file
130
@omniroute/opencode-plugin/tests/auto-sync.test.ts
Normal file
@@ -0,0 +1,130 @@
|
||||
/**
|
||||
* Auto-discovery + force-sync (OpenCode parity with Pi `/omni sync`).
|
||||
*/
|
||||
import test from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import {
|
||||
sanitizeAutoSyncIntervalMs,
|
||||
DEFAULT_AUTO_SYNC_INTERVAL_MS,
|
||||
MIN_AUTO_SYNC_INTERVAL_MS,
|
||||
parseOmniRoutePluginOptions,
|
||||
resolveOmniRoutePluginOptions,
|
||||
invalidateOmniRouteFetchCache,
|
||||
forceSyncOmniRouteModels,
|
||||
type OmniRouteFetchCache,
|
||||
} from "../src/index.js";
|
||||
|
||||
test("sanitizeAutoSyncIntervalMs: unset → default 300000", () => {
|
||||
assert.equal(sanitizeAutoSyncIntervalMs(undefined), DEFAULT_AUTO_SYNC_INTERVAL_MS);
|
||||
assert.equal(sanitizeAutoSyncIntervalMs(null), DEFAULT_AUTO_SYNC_INTERVAL_MS);
|
||||
});
|
||||
|
||||
test("sanitizeAutoSyncIntervalMs: 0 disables", () => {
|
||||
assert.equal(sanitizeAutoSyncIntervalMs(0), 0);
|
||||
});
|
||||
|
||||
test("sanitizeAutoSyncIntervalMs: clamps below min to 60000", () => {
|
||||
assert.equal(sanitizeAutoSyncIntervalMs(1), MIN_AUTO_SYNC_INTERVAL_MS);
|
||||
assert.equal(sanitizeAutoSyncIntervalMs(59_999), MIN_AUTO_SYNC_INTERVAL_MS);
|
||||
});
|
||||
|
||||
test("sanitizeAutoSyncIntervalMs: keeps valid values", () => {
|
||||
assert.equal(sanitizeAutoSyncIntervalMs(60_000), 60_000);
|
||||
assert.equal(sanitizeAutoSyncIntervalMs(300_000), 300_000);
|
||||
});
|
||||
|
||||
test("parseOmniRoutePluginOptions accepts autoSyncIntervalMs including 0", () => {
|
||||
assert.equal(parseOmniRoutePluginOptions({ autoSyncIntervalMs: 0 }).autoSyncIntervalMs, 0);
|
||||
assert.equal(parseOmniRoutePluginOptions({ autoSyncIntervalMs: 120_000 }).autoSyncIntervalMs, 120_000);
|
||||
});
|
||||
|
||||
test("resolveOmniRoutePluginOptions defaults autoSyncIntervalMs to 300000", () => {
|
||||
const r = resolveOmniRoutePluginOptions({});
|
||||
assert.equal(r.autoSyncIntervalMs, DEFAULT_AUTO_SYNC_INTERVAL_MS);
|
||||
});
|
||||
|
||||
test("resolveOmniRoutePluginOptions clamps low positive autoSyncIntervalMs", () => {
|
||||
const r = resolveOmniRoutePluginOptions({ autoSyncIntervalMs: 5000 });
|
||||
assert.equal(r.autoSyncIntervalMs, MIN_AUTO_SYNC_INTERVAL_MS);
|
||||
});
|
||||
|
||||
test("invalidateOmniRouteFetchCache clears by baseURL prefix", () => {
|
||||
const cache: OmniRouteFetchCache = new Map();
|
||||
cache.set("https://a.example/v1::abc", {
|
||||
rawModels: [],
|
||||
rawCombos: [],
|
||||
rawAutoCombos: [],
|
||||
rawEnrichment: new Map(),
|
||||
rawCompressionCombos: [],
|
||||
rawConnections: [],
|
||||
expiresAt: Date.now() + 1000,
|
||||
});
|
||||
cache.set("https://b.example/v1::def", {
|
||||
rawModels: [],
|
||||
rawCombos: [],
|
||||
rawAutoCombos: [],
|
||||
rawEnrichment: new Map(),
|
||||
rawCompressionCombos: [],
|
||||
rawConnections: [],
|
||||
expiresAt: Date.now() + 1000,
|
||||
});
|
||||
const removed = invalidateOmniRouteFetchCache(cache, "https://a.example/v1");
|
||||
assert.equal(removed, 1);
|
||||
assert.equal(cache.size, 1);
|
||||
assert.equal(cache.has("https://b.example/v1::def"), true);
|
||||
});
|
||||
|
||||
test("forceSyncOmniRouteModels: fetches, populates cache, returns count", async () => {
|
||||
const cache: OmniRouteFetchCache = new Map();
|
||||
const resolved = resolveOmniRoutePluginOptions({
|
||||
providerId: "omniroute",
|
||||
baseURL: "https://omniroute.example/v1",
|
||||
autoSyncIntervalMs: 0,
|
||||
features: {
|
||||
combos: false,
|
||||
autoCombos: false,
|
||||
enrichment: false,
|
||||
compressionMetadata: false,
|
||||
usableOnly: false,
|
||||
diskCache: false,
|
||||
},
|
||||
});
|
||||
|
||||
const result = await forceSyncOmniRouteModels({
|
||||
resolved,
|
||||
cache,
|
||||
readAuthJson: async () => ({
|
||||
omniroute: { type: "api", key: "test-key" },
|
||||
}),
|
||||
fetcher: async () => [
|
||||
{ id: "model-a", object: "model" },
|
||||
{ id: "model-b", object: "model" },
|
||||
],
|
||||
now: () => 1_000_000,
|
||||
});
|
||||
|
||||
assert.equal(result.ok, true);
|
||||
assert.equal(result.count, 2);
|
||||
assert.equal(result.provider, "omniroute");
|
||||
assert.equal(cache.size, 1);
|
||||
const entry = [...cache.values()][0];
|
||||
assert.equal(entry.rawModels.length, 2);
|
||||
assert.equal(entry.expiresAt, 1_000_000 + resolved.modelCacheTtl);
|
||||
});
|
||||
|
||||
test("forceSyncOmniRouteModels: missing auth returns error", async () => {
|
||||
const cache: OmniRouteFetchCache = new Map();
|
||||
const resolved = resolveOmniRoutePluginOptions({
|
||||
providerId: "omniroute",
|
||||
baseURL: "https://omniroute.example/v1",
|
||||
autoSyncIntervalMs: 0,
|
||||
features: { diskCache: false },
|
||||
});
|
||||
const result = await forceSyncOmniRouteModels({
|
||||
resolved,
|
||||
cache,
|
||||
readAuthJson: async () => ({}),
|
||||
});
|
||||
assert.equal(result.ok, false);
|
||||
assert.match(result.error ?? "", /credentials|baseURL|connect/i);
|
||||
});
|
||||
@@ -248,7 +248,7 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
|
||||
|
||||
// Combo surfaces under bare key + LCD'd
|
||||
// (gemini's reasoning=false → combo reasoning=false).
|
||||
const combo = entry.models["opencode-omniroute/claude-tier"];
|
||||
const combo = entry.models["omniroute/claude-tier"];
|
||||
assert.ok(combo, "combo surfaced under bare key");
|
||||
assert.equal(combo.name, "Claude Tier");
|
||||
assert.equal(combo.reasoning, false, "LCD: any member reasoning=false → combo reasoning=false");
|
||||
@@ -474,7 +474,7 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m
|
||||
"opencode-omniroute/claude-sonnet-4-6",
|
||||
"opencode-omniroute/gemini-3-flash",
|
||||
]);
|
||||
assert.equal(entry.models["opencode-omniroute/claude-tier"], undefined, "no combo entry");
|
||||
assert.equal(entry.models["omniroute/claude-tier"], undefined, "no combo entry");
|
||||
assert.ok(
|
||||
logger.entries.some((e) => String(e[0]).includes("/api/combos fetch failed")),
|
||||
"combos-fetch breadcrumb emitted"
|
||||
@@ -748,7 +748,7 @@ test("buildStaticProviderEntry: hidden combos are excluded", () => {
|
||||
"https://or.example/v1",
|
||||
"sk-test"
|
||||
);
|
||||
assert.equal(block.models["opencode-omniroute/claude-tier"], undefined);
|
||||
assert.equal(block.models["omniroute/claude-tier"], undefined);
|
||||
assert.ok(block.models["opencode-omniroute/claude-sonnet-4-6"]);
|
||||
});
|
||||
|
||||
@@ -858,7 +858,7 @@ test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)
|
||||
"https://or.example/v1",
|
||||
"sk-test"
|
||||
);
|
||||
const combo = block.models["opencode-omniroute/mixed-tier"];
|
||||
const combo = block.models["omniroute/mixed-tier"];
|
||||
assert.ok(combo, "combo emitted under slug key");
|
||||
// claude has text+image, text-only has text → intersection drops image.
|
||||
assert.deepEqual(combo.modalities?.input, ["text"]);
|
||||
@@ -970,7 +970,7 @@ test("config: enrichment fetched + name overlaid on raw-model entries", async ()
|
||||
assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
|
||||
assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini 3 Flash");
|
||||
// Combo names still come from /api/combos — enrichment overlay does NOT touch combos.
|
||||
assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
|
||||
assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
|
||||
assert.equal(enrichmentFetcher.callCount(), 1);
|
||||
});
|
||||
|
||||
@@ -1337,7 +1337,7 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
|
||||
);
|
||||
assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
|
||||
// Combos stay untouched — `Combo: ` prefix already conveys multi-upstream.
|
||||
assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
|
||||
assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
|
||||
});
|
||||
|
||||
test("config: providerTag=false suppresses the suffix", async () => {
|
||||
@@ -1516,7 +1516,7 @@ test("buildStaticProviderEntry: nested combo-ref context is the bottleneck acros
|
||||
);
|
||||
// Pre-fix: Parent would advertise 200_000 (only raw-big counted).
|
||||
// Post-fix: Parent should advertise 8_000 (TinyCombo bottleneck).
|
||||
const parent = block.models["opencode-omniroute/parent"];
|
||||
const parent = block.models["omniroute/parent"];
|
||||
assert.ok(parent, "Parent combo must be in the static catalog");
|
||||
assert.equal(parent.limit?.context, 8_000);
|
||||
});
|
||||
|
||||
@@ -40,7 +40,7 @@ test("defaultDiskSnapshotWriter writes an owner-only (no group/other) snapshot",
|
||||
process.env.OPENCODE_DATA_DIR = tmp;
|
||||
|
||||
try {
|
||||
await defaultDiskSnapshotWriter("perm-test", makeEntry());
|
||||
await defaultDiskSnapshotWriter("perm-test", makeEntry(), "test-snapshot-identity");
|
||||
|
||||
const file = diskSnapshotPath("perm-test");
|
||||
assert.ok(fs.existsSync(file), "snapshot file should be written");
|
||||
|
||||
95
@omniroute/opencode-plugin/tests/feature-defaults.test.ts
Normal file
95
@omniroute/opencode-plugin/tests/feature-defaults.test.ts
Normal file
@@ -0,0 +1,95 @@
|
||||
/**
|
||||
* #7624 — explicit feature-flag defaults.
|
||||
*
|
||||
* The `features` block in opencode.json marks every toggle `.optional()` with
|
||||
* no default. The effective value was previously only knowable by tracing the
|
||||
* implicit `features.X !== false` (default-ON) / `features.X === true`
|
||||
* (default-OFF) convention scattered across each read site, which left
|
||||
* operators unsure whether combos / autoCombos / enrichment were enabled when
|
||||
* they omitted the block.
|
||||
*
|
||||
* `OMNIROUTE_FEATURE_DEFAULTS` declares those defaults explicitly and
|
||||
* `resolveEffectiveFeatureFlags(features)` derives the effective state for any
|
||||
* (possibly-undefined) features object, mirroring the read-site conventions
|
||||
* exactly. These are purely derived — runtime routing behaviour is unchanged.
|
||||
*/
|
||||
|
||||
import test from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
|
||||
import {
|
||||
OMNIROUTE_FEATURE_DEFAULTS,
|
||||
resolveEffectiveFeatureFlags,
|
||||
} from "../src/index.js";
|
||||
|
||||
const DEFAULT_ON = [
|
||||
"combos",
|
||||
"autoCombos",
|
||||
"enrichment",
|
||||
"diskCache",
|
||||
"providerTag",
|
||||
"fetchInterceptor",
|
||||
"geminiSanitization",
|
||||
] as const;
|
||||
|
||||
const DEFAULT_OFF = [
|
||||
"compressionMetadata",
|
||||
"usableOnly",
|
||||
"mcpAutoEmit",
|
||||
"debugLog",
|
||||
"startupDebug",
|
||||
] as const;
|
||||
|
||||
test("OMNIROUTE_FEATURE_DEFAULTS: declares each flag with its documented default", () => {
|
||||
for (const key of DEFAULT_ON) {
|
||||
assert.equal(OMNIROUTE_FEATURE_DEFAULTS[key], true, `${key} defaults ON`);
|
||||
}
|
||||
for (const key of DEFAULT_OFF) {
|
||||
assert.equal(OMNIROUTE_FEATURE_DEFAULTS[key], false, `${key} defaults OFF`);
|
||||
}
|
||||
});
|
||||
|
||||
test("resolveEffectiveFeatureFlags: undefined features → full declared default set", () => {
|
||||
const flags = resolveEffectiveFeatureFlags(undefined);
|
||||
for (const key of DEFAULT_ON) {
|
||||
assert.equal(flags[key], true, `${key} effective ON when features omitted`);
|
||||
}
|
||||
for (const key of DEFAULT_OFF) {
|
||||
assert.equal(flags[key], false, `${key} effective OFF when features omitted`);
|
||||
}
|
||||
});
|
||||
|
||||
test("resolveEffectiveFeatureFlags: empty features object → same as omitted", () => {
|
||||
assert.deepEqual(
|
||||
resolveEffectiveFeatureFlags({}),
|
||||
resolveEffectiveFeatureFlags(undefined)
|
||||
);
|
||||
});
|
||||
|
||||
test("resolveEffectiveFeatureFlags: explicit false disables a default-ON flag", () => {
|
||||
const flags = resolveEffectiveFeatureFlags({ autoCombos: false });
|
||||
assert.equal(flags.autoCombos, false, "explicit autoCombos:false honoured");
|
||||
// Untouched flags keep their declared defaults.
|
||||
assert.equal(flags.combos, true);
|
||||
assert.equal(flags.enrichment, true);
|
||||
});
|
||||
|
||||
test("resolveEffectiveFeatureFlags: explicit true enables a default-OFF flag", () => {
|
||||
const flags = resolveEffectiveFeatureFlags({ compressionMetadata: true });
|
||||
assert.equal(flags.compressionMetadata, true, "explicit compressionMetadata:true honoured");
|
||||
assert.equal(flags.usableOnly, false, "other opt-in flags stay OFF");
|
||||
});
|
||||
|
||||
test("resolveEffectiveFeatureFlags: non-boolean sibling keys do not leak into flags", () => {
|
||||
// features may also carry mcpToken/logLevel/apiFormat — the resolver must
|
||||
// only ever return the boolean toggle keys.
|
||||
const flags = resolveEffectiveFeatureFlags({
|
||||
mcpAutoEmit: true,
|
||||
mcpToken: "sk-mcp-token-abc",
|
||||
logLevel: "debug",
|
||||
});
|
||||
assert.equal(flags.mcpAutoEmit, true);
|
||||
assert.equal(Object.keys(flags).length, Object.keys(OMNIROUTE_FEATURE_DEFAULTS).length);
|
||||
assert.equal("mcpToken" in flags, false);
|
||||
assert.equal("logLevel" in flags, false);
|
||||
});
|
||||
@@ -50,6 +50,52 @@ test("createOmniRouteFetchInterceptor: targets baseURL → Authorization header
|
||||
}
|
||||
});
|
||||
|
||||
test("createOmniRouteFetchInterceptor: path-prefixed baseURL scopes auth to its normalized inference paths", async () => {
|
||||
const { calls, restore } = installFetchRecorder();
|
||||
try {
|
||||
const prefixedBase = "https://or.example.com/tenant-a/v1";
|
||||
const f = createOmniRouteFetchInterceptor({
|
||||
apiKey: KEY,
|
||||
baseURL: `${prefixedBase}///`,
|
||||
});
|
||||
const streamingBody = '{"stream":true}';
|
||||
|
||||
await f(`${prefixedBase}/chat/completions?trace=1`, {
|
||||
method: "POST",
|
||||
body: streamingBody,
|
||||
headers: { Accept: "text/event-stream" },
|
||||
});
|
||||
await f(`${prefixedBase}/models/?refresh=1`);
|
||||
await f("https://or.example.com/v1/chat/completions", { method: "POST", body: "{}" });
|
||||
await f("https://or.example.com/v1/models");
|
||||
await f("https://or.example.com/tenant-b/v1/chat/completions", {
|
||||
method: "POST",
|
||||
body: "{}",
|
||||
});
|
||||
await f(`${prefixedBase}/chat/completions/batch`, { method: "POST", body: "{}" });
|
||||
|
||||
const headers = calls.map(({ init }) => new Headers(init?.headers));
|
||||
assert.equal(headers[0]?.get("Authorization"), `Bearer ${KEY}`);
|
||||
assert.equal(headers[1]?.get("Authorization"), `Bearer ${KEY}`);
|
||||
for (const index of [2, 3, 4, 5]) {
|
||||
assert.equal(headers[index]?.get("Authorization"), null);
|
||||
}
|
||||
assert.equal(calls[0]?.input, `${prefixedBase}/chat/completions?trace=1`);
|
||||
assert.equal(calls[0]?.init?.body, streamingBody);
|
||||
assert.equal(headers[0]?.get("Accept"), "text/event-stream");
|
||||
|
||||
const suffixingInterceptor = createOmniRouteFetchInterceptor({
|
||||
apiKey: KEY,
|
||||
baseURL: "https://or.example.com/tenant-a/",
|
||||
});
|
||||
await suffixingInterceptor(`${prefixedBase}/models`);
|
||||
const suffixedHeaders = new Headers(calls[6]?.init?.headers);
|
||||
assert.equal(suffixedHeaders.get("Authorization"), `Bearer ${KEY}`);
|
||||
} finally {
|
||||
restore();
|
||||
}
|
||||
});
|
||||
|
||||
test("createOmniRouteFetchInterceptor: targets baseURL → Authorization OVERRIDES caller-supplied Bearer", async () => {
|
||||
const { calls, restore } = installFetchRecorder();
|
||||
try {
|
||||
@@ -259,7 +305,7 @@ test("loader integration: wired interceptor actually injects Bearer when invoked
|
||||
{} as never
|
||||
);
|
||||
const wiredFetch = (result as { fetch: typeof fetch }).fetch;
|
||||
await wiredFetch(`${BASE}/v1/models`, {});
|
||||
await wiredFetch(`${BASE}/models`, {});
|
||||
assert.equal(calls.length, 1);
|
||||
const sentHeaders = new Headers((calls[0]!.init as RequestInit).headers);
|
||||
assert.equal(sentHeaders.get("Authorization"), `Bearer ${KEY}`);
|
||||
|
||||
271
@omniroute/opencode-plugin/tests/management-read-token.test.ts
Normal file
271
@omniroute/opencode-plugin/tests/management-read-token.test.ts
Normal file
@@ -0,0 +1,271 @@
|
||||
import test from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import fs from "node:fs";
|
||||
import os from "node:os";
|
||||
import path from "node:path";
|
||||
|
||||
import {
|
||||
createOmniRouteAuthHook,
|
||||
createOmniRouteConfigHook,
|
||||
createOmniRouteProviderHook,
|
||||
parseOmniRoutePluginOptions,
|
||||
type OmniRouteCompressionMetaFetcher,
|
||||
type OmniRouteEnrichmentFetcher,
|
||||
type OmniRouteProvidersFetcher,
|
||||
type OmniRouteRawModelEntry,
|
||||
} from "../src/index.js";
|
||||
|
||||
const BASE_URL = "https://or.example.com/v1";
|
||||
const API_KEY = "sk-inference-only";
|
||||
const MANAGEMENT_READ_TOKEN = "sk-management-read-only";
|
||||
|
||||
const RAW_MODELS: OmniRouteRawModelEntry[] = [
|
||||
{
|
||||
id: "openai/gpt-test",
|
||||
context_length: 16_000,
|
||||
max_output_tokens: 4_000,
|
||||
capabilities: {
|
||||
tool_calling: true,
|
||||
reasoning: false,
|
||||
vision: false,
|
||||
thinking: false,
|
||||
temperature: true,
|
||||
},
|
||||
input_modalities: ["text"],
|
||||
output_modalities: ["text"],
|
||||
},
|
||||
];
|
||||
|
||||
function apiAuth(key: string) {
|
||||
return { type: "api" as const, key };
|
||||
}
|
||||
|
||||
test("options: managementReadToken is accepted and preserved", () => {
|
||||
const parsed = parseOmniRoutePluginOptions({ managementReadToken: MANAGEMENT_READ_TOKEN });
|
||||
assert.equal(parsed.managementReadToken, MANAGEMENT_READ_TOKEN);
|
||||
});
|
||||
|
||||
test("provider hook: management GET fetchers use managementReadToken while /v1 uses apiKey", async () => {
|
||||
const calls: Array<[string, string]> = [];
|
||||
const enrichmentFetcher: OmniRouteEnrichmentFetcher = async (_baseURL, token) => {
|
||||
calls.push(["pricing", token]);
|
||||
return new Map();
|
||||
};
|
||||
const compressionMetaFetcher: OmniRouteCompressionMetaFetcher = async (_baseURL, token) => {
|
||||
calls.push(["context", token]);
|
||||
return [];
|
||||
};
|
||||
const providersFetcher: OmniRouteProvidersFetcher = async (_baseURL, token) => {
|
||||
calls.push(["providers", token]);
|
||||
return [];
|
||||
};
|
||||
|
||||
const hook = createOmniRouteProviderHook(
|
||||
{
|
||||
baseURL: BASE_URL,
|
||||
managementReadToken: MANAGEMENT_READ_TOKEN,
|
||||
features: { compressionMetadata: true, usableOnly: true },
|
||||
},
|
||||
{
|
||||
fetcher: async (_baseURL, token) => {
|
||||
calls.push(["models", token]);
|
||||
return RAW_MODELS;
|
||||
},
|
||||
combosFetcher: async (_baseURL, token) => {
|
||||
calls.push(["combos", token]);
|
||||
return [];
|
||||
},
|
||||
autoCombosFetcher: async (_baseURL, token) => {
|
||||
calls.push(["auto-combos", token]);
|
||||
return [];
|
||||
},
|
||||
enrichmentFetcher,
|
||||
compressionMetaFetcher,
|
||||
providersFetcher,
|
||||
}
|
||||
);
|
||||
|
||||
await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
|
||||
|
||||
assert.deepEqual(calls, [
|
||||
["models", API_KEY],
|
||||
["combos", MANAGEMENT_READ_TOKEN],
|
||||
["auto-combos", MANAGEMENT_READ_TOKEN],
|
||||
["pricing", MANAGEMENT_READ_TOKEN],
|
||||
["context", MANAGEMENT_READ_TOKEN],
|
||||
["providers", MANAGEMENT_READ_TOKEN],
|
||||
]);
|
||||
});
|
||||
|
||||
test("provider hook: absent managementReadToken preserves apiKey fallback", async () => {
|
||||
const calls: Array<[string, string]> = [];
|
||||
const hook = createOmniRouteProviderHook(
|
||||
{ baseURL: BASE_URL, features: { enrichment: false, autoCombos: false } },
|
||||
{
|
||||
fetcher: async (_baseURL, token) => {
|
||||
calls.push(["models", token]);
|
||||
return RAW_MODELS;
|
||||
},
|
||||
combosFetcher: async (_baseURL, token) => {
|
||||
calls.push(["combos", token]);
|
||||
return [];
|
||||
},
|
||||
}
|
||||
);
|
||||
|
||||
await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
|
||||
|
||||
assert.deepEqual(calls, [
|
||||
["models", API_KEY],
|
||||
["combos", API_KEY],
|
||||
]);
|
||||
});
|
||||
|
||||
test("config hook: managementReadToken stays out of provider inference and MCP config", async () => {
|
||||
const calls: Array<[string, string]> = [];
|
||||
const hook = createOmniRouteConfigHook(
|
||||
{
|
||||
baseURL: BASE_URL,
|
||||
managementReadToken: MANAGEMENT_READ_TOKEN,
|
||||
features: { enrichment: false, autoCombos: false, diskCache: false, mcpAutoEmit: true },
|
||||
},
|
||||
{
|
||||
readAuthJson: async () => ({
|
||||
"opencode-omniroute": { type: "api" as const, key: API_KEY },
|
||||
}),
|
||||
fetcher: async (_baseURL, token) => {
|
||||
calls.push(["models", token]);
|
||||
return RAW_MODELS;
|
||||
},
|
||||
combosFetcher: async (_baseURL, token) => {
|
||||
calls.push(["combos", token]);
|
||||
return [];
|
||||
},
|
||||
logger: { warn: () => {} },
|
||||
}
|
||||
);
|
||||
const input: { provider?: Record<string, any>; mcp?: Record<string, any> } = {};
|
||||
|
||||
await hook(input as never);
|
||||
|
||||
assert.deepEqual(calls, [
|
||||
["models", API_KEY],
|
||||
["combos", MANAGEMENT_READ_TOKEN],
|
||||
]);
|
||||
assert.equal(input.provider?.["opencode-omniroute"]?.options?.apiKey, API_KEY);
|
||||
assert.equal(
|
||||
input.mcp?.["opencode-omniroute"]?.headers?.Authorization,
|
||||
`Bearer ${API_KEY}`,
|
||||
"mcpAutoEmit remains independent of managementReadToken"
|
||||
);
|
||||
});
|
||||
|
||||
test("auth fetch: only intended same-origin inference paths receive apiKey", async () => {
|
||||
const calls: Array<{ input: RequestInfo | URL; init?: RequestInit }> = [];
|
||||
const originalFetch = globalThis.fetch;
|
||||
globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
|
||||
calls.push({ input, init });
|
||||
return new Response("ok");
|
||||
}) as typeof fetch;
|
||||
|
||||
try {
|
||||
const hook = createOmniRouteAuthHook({
|
||||
baseURL: `${BASE_URL}/`,
|
||||
managementReadToken: MANAGEMENT_READ_TOKEN,
|
||||
});
|
||||
const loaded = await hook.loader!(async () => apiAuth(API_KEY) as never, {} as never);
|
||||
const interceptedFetch = (loaded as { fetch: typeof fetch }).fetch;
|
||||
|
||||
const streamingBody = '{"stream":true}';
|
||||
await interceptedFetch(`${BASE_URL}/chat/completions?trace=1`, {
|
||||
method: "POST",
|
||||
body: streamingBody,
|
||||
headers: { Accept: "text/event-stream" },
|
||||
});
|
||||
await interceptedFetch(`${BASE_URL}/models/?refresh=1`);
|
||||
await interceptedFetch("https://or.example.com/api/combos");
|
||||
await interceptedFetch("https://or.example.com/api/mcp/stream");
|
||||
await interceptedFetch("https://or.example.com/v1/embeddings");
|
||||
await interceptedFetch("https://third-party.example/v1/chat/completions", {
|
||||
method: "POST",
|
||||
body: "{}",
|
||||
});
|
||||
|
||||
const headers = calls.map(({ init }) => new Headers(init?.headers));
|
||||
assert.equal(headers[0]?.get("Authorization"), `Bearer ${API_KEY}`);
|
||||
assert.equal(headers[1]?.get("Authorization"), `Bearer ${API_KEY}`);
|
||||
for (const index of [2, 3, 4, 5]) {
|
||||
assert.equal(headers[index]?.get("Authorization"), null);
|
||||
}
|
||||
assert.equal(calls[0]?.input, `${BASE_URL}/chat/completions?trace=1`);
|
||||
assert.equal(calls[0]?.init?.body, streamingBody);
|
||||
assert.equal(headers[0]?.get("Accept"), "text/event-stream");
|
||||
assert.equal(
|
||||
calls.some(({ init }) =>
|
||||
[...new Headers(init?.headers).values()].some((value) =>
|
||||
value.includes(MANAGEMENT_READ_TOKEN)
|
||||
)
|
||||
),
|
||||
false,
|
||||
"managementReadToken must never enter inference fetch headers"
|
||||
);
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test("disk cache: snapshot written under management token A is rejected under token B", async () => {
|
||||
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-token-snapshot-"));
|
||||
const previousDataDir = process.env.OPENCODE_DATA_DIR;
|
||||
process.env.OPENCODE_DATA_DIR = tmp;
|
||||
|
||||
try {
|
||||
const commonDeps = {
|
||||
readAuthJson: async () => ({
|
||||
"opencode-omniroute": {
|
||||
type: "api" as const,
|
||||
key: API_KEY,
|
||||
baseURL: BASE_URL,
|
||||
},
|
||||
}),
|
||||
combosFetcher: async () => [],
|
||||
logger: { warn: () => {} },
|
||||
};
|
||||
const features = {
|
||||
enrichment: false,
|
||||
autoCombos: false,
|
||||
diskCache: true,
|
||||
} as const;
|
||||
|
||||
const tokenAHook = createOmniRouteConfigHook(
|
||||
{ managementReadToken: "token-A", features },
|
||||
{
|
||||
...commonDeps,
|
||||
fetcher: async () => RAW_MODELS,
|
||||
}
|
||||
);
|
||||
await tokenAHook({} as never);
|
||||
|
||||
const tokenBHook = createOmniRouteConfigHook(
|
||||
{ managementReadToken: "token-B", features },
|
||||
{
|
||||
...commonDeps,
|
||||
fetcher: async () => {
|
||||
throw new Error("offline");
|
||||
},
|
||||
}
|
||||
);
|
||||
const input: { provider?: Record<string, { models: Record<string, unknown> }> } = {};
|
||||
await tokenBHook(input as never);
|
||||
|
||||
assert.deepEqual(
|
||||
input.provider?.["opencode-omniroute"]?.models,
|
||||
{},
|
||||
"catalog from token A must not hydrate after switching to token B"
|
||||
);
|
||||
} finally {
|
||||
if (previousDataDir === undefined) delete process.env.OPENCODE_DATA_DIR;
|
||||
else process.env.OPENCODE_DATA_DIR = previousDataDir;
|
||||
fs.rmSync(tmp, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
@@ -22,9 +22,11 @@
|
||||
import test from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import {
|
||||
buildStaticProviderEntry,
|
||||
createOmniRouteProviderHook,
|
||||
mapRawModelToModelV2,
|
||||
resolveOmniRoutePluginOptions,
|
||||
type OmniRouteRawCombo,
|
||||
} from "../src/index.js";
|
||||
|
||||
/**
|
||||
@@ -97,3 +99,43 @@ test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID
|
||||
"the OC-gate prefix must never leak into ModelV2.providerID"
|
||||
);
|
||||
});
|
||||
|
||||
// #7976: buildStaticProviderEntry (the STATIC provider() config-hook path,
|
||||
// exercised when the plugin writes `opencode.json` up front rather than
|
||||
// registering the dynamic `provider.models()` hook) never received the
|
||||
// #6859 fix. OC dispatches a static-catalog `models` map key verbatim as
|
||||
// the `model` field of the outbound request — only the top-level
|
||||
// `provider["<id>"]` segment is stripped for routing — so a bare-slug combo
|
||||
// key built with the OC-gated `providerId` reaches OmniRoute's server
|
||||
// doubled and fails credential lookup for the nonexistent provider
|
||||
// `opencode-omniroute`. Confirmed against the issue's own curl repro
|
||||
// (`model: "opencode-omniroute/hermes-smart-stack"` → "No active
|
||||
// credentials for provider: opencode-omniroute").
|
||||
test("#7976: buildStaticProviderEntry keys bare-slug combo ids with the unprefixed omnirouteProviderId (no double OC-gate prefix)", () => {
|
||||
const resolved = resolveOmniRoutePluginOptions({ providerId: "omniroute" });
|
||||
assert.equal(resolved.providerId, "opencode-omniroute");
|
||||
assert.equal(resolved.omnirouteProviderId, "omniroute");
|
||||
|
||||
const combo = {
|
||||
id: "combo-abc123",
|
||||
name: "Hermes Smart Stack",
|
||||
isHidden: false,
|
||||
models: [],
|
||||
} as unknown as OmniRouteRawCombo;
|
||||
|
||||
const block = buildStaticProviderEntry(
|
||||
[],
|
||||
[combo],
|
||||
resolved,
|
||||
"https://or.example/v1",
|
||||
"sk-test"
|
||||
);
|
||||
|
||||
assert.deepEqual(Object.keys(block.models), ["omniroute/hermes-smart-stack"]);
|
||||
assert.equal(
|
||||
block.models["opencode-omniroute/hermes-smart-stack"],
|
||||
undefined,
|
||||
"combo key must not carry the OC-gate-prefixed providerId — it doubles up once " +
|
||||
"OC dispatches it verbatim as the `model` field"
|
||||
);
|
||||
});
|
||||
|
||||
22
AGENTS.md
22
AGENTS.md
@@ -3,12 +3,12 @@
|
||||
## Project
|
||||
|
||||
Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
|
||||
with **250 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
|
||||
with **290 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
|
||||
Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
|
||||
SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
|
||||
with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
|
||||
with **MCP Server** (104 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
|
||||
|
||||
> **Live counts (v3.8.47)**: providers 250 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
|
||||
> **Live counts (v3.8.49)**: providers 290 · MCP tools 104 · MCP scopes 30 · A2A skills 6 ·
|
||||
> open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 ·
|
||||
> DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 ·
|
||||
> i18n locales 42. **Refresh with `npm run check:docs-all`.**
|
||||
@@ -267,8 +267,8 @@ Zod schemas, and unit tests aligned when editing.
|
||||
|
||||
### Provider Categories
|
||||
|
||||
- **Free** (3): Qoder AI, Qwen Code, Kiro AI
|
||||
- **OAuth** (14): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Qwen (⚠️ free tier discontinued 2026-04-15), Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
|
||||
- **Free** (2): Qoder AI, Kiro AI
|
||||
- **OAuth** (13): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
|
||||
- **API Key** (120+): OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Perplexity,
|
||||
Together, Fireworks, Cerebras, Cohere, NVIDIA, Nebius, SiliconFlow, Hyperbolic,
|
||||
HuggingFace, OpenRouter, Vertex AI, Cloudflare AI, Scaleway, AI/ML API, Pollinations,
|
||||
@@ -391,7 +391,7 @@ Policy engine modules: `policyEngine.ts`, `comboResolver.ts`, `costRules.ts`,
|
||||
|
||||
### MCP Server (`open-sse/mcp-server/`)
|
||||
|
||||
**94 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 34-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
|
||||
**104 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 42-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (31 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
|
||||
|
||||
**Core tools** (20): get_health, list_combos, get_combo_metrics, switch_combo, check_quota,
|
||||
route_request, cost_report, list_models_catalog, web_search, simulate_route, set_budget_guard,
|
||||
@@ -570,12 +570,16 @@ This repository is a fork of `diegosouzapw/OmniRoute`. Keep fork-only operationa
|
||||
changes (for example GHCR image publishing, personal deployment workflows, or local
|
||||
automation) out of upstream contribution PRs.
|
||||
|
||||
When preparing a PR for upstream, always start the work branch from `upstream/main`,
|
||||
not from this fork's `main`:
|
||||
When preparing a PR for upstream, always start the work branch from the upstream
|
||||
**default branch** — the active `release/vX.Y.Z` line (today `release/v3.8.49`).
|
||||
Never branch from `main`: `main` only receives release squash-merges, so a branch
|
||||
cut there is weeks behind and produces conflict-heavy PRs
|
||||
(see `CONTRIBUTING.md` and `docs/ops/BRANCHING_MODEL.md`):
|
||||
|
||||
```bash
|
||||
git fetch upstream
|
||||
git switch -c <branch-name> upstream/main
|
||||
# the default branch is the active release line, e.g. release/v3.8.49
|
||||
git switch -c <branch-name> upstream/release/vX.Y.Z
|
||||
```
|
||||
|
||||
Only cherry-pick or reapply the changes intended for the upstream PR.
|
||||
|
||||
1613
CHANGELOG.md
1613
CHANGELOG.md
File diff suppressed because it is too large
Load Diff
34
CLAUDE.md
34
CLAUDE.md
@@ -35,22 +35,22 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
|
||||
|
||||
## Project at a Glance
|
||||
|
||||
**OmniRoute** — unified AI proxy/router. One endpoint, 250 LLM providers, auto-fallback.
|
||||
**OmniRoute** — unified AI proxy/router. One endpoint, 290 LLM providers, auto-fallback.
|
||||
|
||||
| Layer | Location | Purpose |
|
||||
| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| API Routes | `src/app/api/v1/` | Next.js App Router — entry points |
|
||||
| Handlers | `open-sse/handlers/` | Request processing (chat, embeddings, etc) |
|
||||
| Executors | `open-sse/executors/` | Provider-specific HTTP dispatch |
|
||||
| Translators | `open-sse/translator/` | Format conversion (OpenAI↔Claude↔Gemini) |
|
||||
| Transformer | `open-sse/transformer/` | Responses API ↔ Chat Completions |
|
||||
| Services | `open-sse/services/` | Combo routing, rate limits, caching, etc |
|
||||
| Database | `src/lib/db/` | SQLite domain modules (95 files, 110 migrations) |
|
||||
| Domain/Policy | `src/domain/` | Policy engine, cost rules, fallback logic |
|
||||
| MCP Server | `open-sse/mcp-server/` | 94 tools (34 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
|
||||
| A2A Server | `src/lib/a2a/` | JSON-RPC 2.0 agent protocol |
|
||||
| Skills | `src/lib/skills/` | Extensible skill framework |
|
||||
| Memory | `src/lib/memory/` | Persistent conversational memory |
|
||||
| Layer | Location | Purpose |
|
||||
| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| API Routes | `src/app/api/v1/` | Next.js App Router — entry points |
|
||||
| Handlers | `open-sse/handlers/` | Request processing (chat, embeddings, etc) |
|
||||
| Executors | `open-sse/executors/` | Provider-specific HTTP dispatch |
|
||||
| Translators | `open-sse/translator/` | Format conversion (OpenAI↔Claude↔Gemini) |
|
||||
| Transformer | `open-sse/transformer/` | Responses API ↔ Chat Completions |
|
||||
| Services | `open-sse/services/` | Combo routing, rate limits, caching, etc |
|
||||
| Database | `src/lib/db/` | SQLite domain modules (95 files, 110 migrations) |
|
||||
| Domain/Policy | `src/domain/` | Policy engine, cost rules, fallback logic |
|
||||
| MCP Server | `open-sse/mcp-server/` | 104 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
|
||||
| A2A Server | `src/lib/a2a/` | JSON-RPC 2.0 agent protocol |
|
||||
| Skills | `src/lib/skills/` | Extensible skill framework |
|
||||
| Memory | `src/lib/memory/` | Persistent conversational memory |
|
||||
|
||||
Monorepo: `src/` (Next.js 16 app), `open-sse/` (streaming engine workspace), `electron/` (desktop app), `tests/`, `bin/` (CLI entry point).
|
||||
|
||||
@@ -482,8 +482,8 @@ list` shows worktrees you didn't create, leave them alone. End every session wit
|
||||
|
||||
## Environment
|
||||
|
||||
- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun.
|
||||
- **Bun (build/dev script runner only)**: Bun `1.3.10` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression`. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the published runtime, or the test runners — those stay on Node. Any new Bun-invoking script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those 5 scripts with `bun: not found`).
|
||||
- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only supported** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun. A **best-effort `bun:sqlite` compatibility path** exists so a global Bun install (`bun install -g omniroute`) can start without `better-sqlite3` (driver adapter + Bun-aware process spawning); it is **not** a supported runtime — no support guarantees — and every Bun-specific runtime change MUST preserve the Node driver/fallback chain and ship a Bun test (`test:bun:db`) or an explicit reason why the path is Node-only.
|
||||
- **Bun (build/dev script runner + compatibility smoke only)**: Bun `1.3.14` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression` — plus the focused `test:bun:db` compatibility smoke suite for the best-effort `bun:sqlite` path. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the supported published runtime, or the main test runners — those stay on Node. Any new Bun-invoking gate/generator script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those scripts with `bun: not found`).
|
||||
- **TypeScript**: 6.0+, target ES2022, module esnext, resolution bundler
|
||||
- **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
|
||||
- **Default port**: 20128 (API + dashboard on same port)
|
||||
|
||||
@@ -103,13 +103,19 @@ Default URLs:
|
||||
## Git Workflow
|
||||
|
||||
> ⚠️ **NEVER commit directly to `main`.** Always use feature branches.
|
||||
>
|
||||
> **PR base:** target the active `release/vX.Y.Z` branch (not `main`). See
|
||||
> [`docs/ops/BRANCHING_MODEL.md`](docs/ops/BRANCHING_MODEL.md) for the
|
||||
> release-per-branch + tag-at-ship model.
|
||||
|
||||
```bash
|
||||
git checkout -b feat/your-feature-name
|
||||
# Branch from the active release tip (example: release/v3.8.49)
|
||||
git fetch origin
|
||||
git checkout -b feat/your-feature-name origin/release/v3.8.49
|
||||
# ... make changes ...
|
||||
git commit -m "feat: describe your change"
|
||||
git push -u origin feat/your-feature-name
|
||||
# Open a Pull Request on GitHub
|
||||
# Open a Pull Request with base = release/v3.8.49
|
||||
```
|
||||
|
||||
### Branch Naming
|
||||
@@ -192,11 +198,14 @@ Coverage notes:
|
||||
|
||||
### Pull Request Requirements
|
||||
|
||||
Before opening or merging a PR:
|
||||
Before opening a PR, run the focused loop for what you changed. The full unit suite
|
||||
(4 CI shards), Vitest, the **60%+** coverage gate, and the production build are CI's
|
||||
responsibility — running them locally adds no signal the PR checks will not already
|
||||
give you, and on smaller machines it can saturate the host (#8084):
|
||||
|
||||
- Run `npm run test:unit`
|
||||
- Run `npm run test:coverage`
|
||||
- Ensure the coverage gate stays at **60%+** statements/lines/functions/branches
|
||||
- Run the test files that cover your change: `node --import tsx/esm --test tests/unit/<file>.test.ts`
|
||||
- Run `npm run lint`
|
||||
- Include or update automated tests in the same PR whenever production code changes
|
||||
- Include the changed or added test files in the PR description when production code changed
|
||||
- Check the SonarQube result on the PR when the project secrets are configured in CI
|
||||
|
||||
@@ -222,6 +231,31 @@ Current test status: **122 unit test files** covering:
|
||||
- **Zod validation** — Use Zod v4 schemas for all API input validation
|
||||
- **Naming**: Files = camelCase/kebab-case, components = PascalCase, constants = UPPER_SNAKE
|
||||
|
||||
### Error handling / empty catch blocks
|
||||
|
||||
Never leave a `catch` unexplained. Classify it into one of two buckets (operationalizes
|
||||
the hard rule "never silently swallow errors in SSE streams"):
|
||||
|
||||
- **Intentional (our own best-effort cleanup/telemetry)** — a failure here is expected and
|
||||
harmless; add a one-line rationale comment, no logging (logging on every request is the
|
||||
noise this convention avoids).
|
||||
|
||||
```ts
|
||||
} catch {} // closing an already-closed controller after client disconnect is expected
|
||||
```
|
||||
|
||||
- **Should log (external/caller-supplied code, or the swallow changes control flow)** — keep
|
||||
the catch (never let it break the stream) but emit a contextual `console.debug`/`warn` so the
|
||||
failure is discoverable.
|
||||
|
||||
```ts
|
||||
} catch (e) {
|
||||
console.debug("[STREAM] onFailure callback error:", e);
|
||||
}
|
||||
```
|
||||
|
||||
See `open-sse/utils/stream.ts` and `open-sse/utils/streamHandler.ts` for applied examples.
|
||||
|
||||
---
|
||||
|
||||
## Project Structure
|
||||
|
||||
31
Dockerfile
31
Dockerfile
@@ -1,5 +1,5 @@
|
||||
# ── Common base with runtime deps ──────────────────────────────────────────
|
||||
FROM node:24-trixie-slim AS base
|
||||
FROM node:26-trixie-slim AS base
|
||||
WORKDIR /app
|
||||
|
||||
# `apt-get upgrade` pulls the security-patched versions of the Debian (trixie)
|
||||
@@ -8,8 +8,8 @@ WORKDIR /app
|
||||
# that already have a fix published in trixie. CVEs without an upstream fix yet
|
||||
# (local-only TOCTOU, etc.) remain until the distro patches them and the image
|
||||
# is rebuilt; none are reachable from the proxy's request surface at runtime.
|
||||
RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
|
||||
--mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
|
||||
RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
|
||||
--mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
|
||||
apt-get update \
|
||||
&& apt-get upgrade -y \
|
||||
&& apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
|
||||
@@ -29,8 +29,8 @@ FROM base AS builder
|
||||
|
||||
# Build tools for native module compilation
|
||||
# apt-get update needed here because base's rm -rf clears the shared cache
|
||||
RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
|
||||
--mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
|
||||
RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
|
||||
--mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
|
||||
apt-get update \
|
||||
&& apt-get install -y --no-install-recommends python3 make g++ \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
@@ -65,11 +65,25 @@ RUN test -f package-lock.json \
|
||||
# node-gyp comes from npm's own bundled copy (deterministic, already in the image)
|
||||
# instead of `npx --yes`, which would install an arbitrary registry version
|
||||
# on-demand and run its lifecycle scripts (Sonar docker:S6505).
|
||||
#
|
||||
# tls-client-node (chatgpt-web/claude-web/grok-web/lmarena/perplexity-web TLS
|
||||
# impersonation) hits the same --ignore-scripts wall: its own postinstall.js
|
||||
# fetches a platform .so/.dylib/.dll from the bogdanfinn/tls-client GitHub
|
||||
# Releases API and is never invoked when npm ci skips lifecycle scripts. Unlike
|
||||
# better-sqlite3 above, that script never throws on failure — it only
|
||||
# `console.warn`s and exits 0 — so a rate-limited or offline build would
|
||||
# otherwise succeed silently with an empty bin/ and only fail at first request
|
||||
# in production (TlsClientUnavailableError, #7802). Run it explicitly here so
|
||||
# a broken/rate-limited fetch fails the BUILD loudly instead of shipping a
|
||||
# broken image.
|
||||
RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
|
||||
npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
|
||||
&& (cd node_modules/better-sqlite3 \
|
||||
&& node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
|
||||
&& node -e "require('better-sqlite3')(':memory:').close()"
|
||||
&& node -e "require('better-sqlite3')(':memory:').close()" \
|
||||
&& node node_modules/tls-client-node/scripts/postinstall.js \
|
||||
&& (test -n "$(find node_modules/tls-client-node/bin -mindepth 1 -print -quit 2>/dev/null)" \
|
||||
|| (echo "tls-client-node native binary missing after postinstall — GitHub API fetch likely rate-limited or failed (#7802)" >&2 && exit 1))
|
||||
|
||||
# Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
|
||||
# TurbopackInternalError panic ("entered unreachable code: there must be a path to a
|
||||
@@ -81,6 +95,11 @@ RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
|
||||
# See docs/ops/QUALITY_GATE_PLAYBOOK.md Parte 6.
|
||||
ENV OMNIROUTE_USE_TURBOPACK=1
|
||||
|
||||
# Next.js basePath is fixed at build time; pass OMNIROUTE_BASE_PATH here when the
|
||||
# image should serve under a reverse-proxy subpath without a runtime patch.
|
||||
ARG OMNIROUTE_BASE_PATH=""
|
||||
ENV OMNIROUTE_BASE_PATH=$OMNIROUTE_BASE_PATH
|
||||
|
||||
# Docker containers cannot run the MITM/Agent-Bridge stack (no host DNS/cert
|
||||
# access), so keep @/mitm/manager on the graceful stub (#3390). This flag is
|
||||
# Docker-only: npm/Electron/VPS builds must bundle the REAL manager (#6344).
|
||||
|
||||
@@ -27,7 +27,7 @@ When creating _any_ validation tests or one-off logic scripts, default to using
|
||||
7. **Never bypass Husky hooks** (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
|
||||
8. **Always validate inputs with Zod schemas** from `src/shared/validation/schemas.ts`.
|
||||
9. **Always include tests when changing production code** (`src/`, `open-sse/`, `electron/`, `bin/`).
|
||||
10. **Coverage must stay** ≥ 75 % statements / 75 % lines / 75 % functions / 70 % branches (real measured: ~82 %).
|
||||
10. **Coverage must stay** ≥ 60 % statements / lines / functions / branches — the official CI gate (`npm run test:coverage`). The ratchet baseline in `quality-baseline.json` may freeze a higher floor; never regress it.
|
||||
|
||||
## 3. Codebase navigation
|
||||
|
||||
|
||||
24
SECURITY.md
24
SECURITY.md
@@ -42,7 +42,7 @@ Request → CORS → Authz pipeline (classify → policies → enforce)
|
||||
| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| **Dashboard Login** | Password-based auth with JWT tokens (HttpOnly cookies) |
|
||||
| **API Key Auth** | HMAC-signed keys with CRC validation |
|
||||
| **OAuth 2.0 + PKCE** | 14 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Qwen, Kiro, Qoder, Windsurf, GitLab Duo) |
|
||||
| **OAuth 2.0 + PKCE** | 13 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Windsurf, GitLab Duo) |
|
||||
| **Token Refresh** | Automatic OAuth token refresh before expiry |
|
||||
| **Secure Cookies** | `AUTH_COOKIE_SECURE=true` for HTTPS environments |
|
||||
| **Authz Pipeline** | Route classification (PUBLIC / CLIENT_API / MANAGEMENT) — see `docs/architecture/AUTHZ_GUIDE.md` |
|
||||
@@ -77,21 +77,28 @@ Custom guardrails register via `registerGuardrail(new MyGuardrail())`. The model
|
||||
|
||||
### 🧠 Prompt Injection Guard
|
||||
|
||||
Middleware that detects and blocks prompt injection attacks in LLM requests:
|
||||
Best-effort heuristic middleware that detects prompt injection patterns in LLM requests.
|
||||
**Not a complete prompt-injection firewall** — can produce false positives (benign
|
||||
persona/RPG prompts) and false negatives (leetspeak, spacing, non-English patterns).
|
||||
|
||||
| Pattern Type | Severity | Example |
|
||||
| ------------------- | -------- | ---------------------------------------------- |
|
||||
| System Override | High | "ignore all previous instructions" |
|
||||
| Role Hijack | High | "you are now DAN, you can do anything" |
|
||||
| Delimiter Injection | Medium | Encoded separators to break context boundaries |
|
||||
| DAN/Jailbreak | High | Known jailbreak prompt patterns |
|
||||
| Instruction Leak | Medium | "show me your system prompt" |
|
||||
| Role Hijack | Medium | "you are now DAN, you can do anything" |
|
||||
| Delimiter Injection | High | Encoded separators to break context boundaries |
|
||||
| DAN/Jailbreak | Medium | Known jailbreak prompt patterns |
|
||||
| Instruction Leak | High | "show me your system prompt" |
|
||||
| Encoding Evasion | Medium | base64/rot13/hex decode + instruction keywords |
|
||||
|
||||
Only **High** severity detections are blocked in `block` mode. Medium-severity
|
||||
families are logged but never blocked by `sanitizeRequest`.
|
||||
|
||||
Configure via dashboard (Settings → Security) or `.env`:
|
||||
|
||||
```env
|
||||
INPUT_SANITIZER_ENABLED=true
|
||||
INPUT_SANITIZER_MODE=block # warn | block | redact
|
||||
INPUT_SANITIZER_MODE=block # warn | block (injection policy; legacy "redact" does not strip injection text)
|
||||
INPUT_SANITIZER_BLOCK_THRESHOLD=high # high (default) | medium | low — severities at/above this are blocked in block mode
|
||||
```
|
||||
|
||||
### 🔒 PII Redaction
|
||||
@@ -108,7 +115,8 @@ Automatic detection and optional redaction of personally identifiable informatio
|
||||
| SSN (US) | `123-45-6789` | `[SSN_REDACTED]` |
|
||||
|
||||
```env
|
||||
PII_REDACTION_ENABLED=true
|
||||
PII_REDACTION_ENABLED=true # request PII rewrite; independent of INPUT_SANITIZER_MODE
|
||||
PII_RESPONSE_SANITIZATION=true # optional: redact PII in provider responses returned to clients
|
||||
```
|
||||
|
||||
### 🌐 Network Security
|
||||
|
||||
230
bin/aliasResolver.mjs
Normal file
230
bin/aliasResolver.mjs
Normal file
@@ -0,0 +1,230 @@
|
||||
/**
|
||||
* ESM path-alias resolver for global installs.
|
||||
*
|
||||
* Problem (#7791): when OmniRoute is installed via `npm i -g omniroute`, the
|
||||
* package files live under `node_modules/omniroute/`. tsx's tsconfig-path
|
||||
* resolution does not apply there, so specifiers like `@/shared/utils/featureFlags`
|
||||
* (declared in tsconfig.json `paths` as `@/* → ./src/*`) or
|
||||
* `@omniroute/open-sse/services/usage` fail with `ERR_MODULE_NOT_FOUND`.
|
||||
* The CLI crashes before any command can run.
|
||||
*
|
||||
* Fix: register a Node ESM `resolve` hook that rewrites alias specifiers to
|
||||
* absolute file URLs. Covers all tsconfig.json `paths` entries:
|
||||
* - `@/*` → `./src/*`
|
||||
* - `@omniroute/open-sse` → `./open-sse/index.ts`
|
||||
* - `@omniroute/open-sse/*` → `./open-sse/*`
|
||||
* The hook runs after tsx so `.ts` extensions are already handled, and only
|
||||
* intercepts matched prefixes — everything else falls through to Node's
|
||||
* default resolver.
|
||||
*
|
||||
* Exposed as pure functions so the mapping logic is unit-testable without a
|
||||
* running module loader.
|
||||
*/
|
||||
|
||||
import { existsSync, statSync } from "node:fs";
|
||||
import { dirname, join, relative, isAbsolute } from "node:path";
|
||||
import { fileURLToPath, pathToFileURL } from "node:url";
|
||||
|
||||
/**
|
||||
* Alias mapping table — mirrors tsconfig.json `paths`.
|
||||
* Processed top-to-bottom; first matching prefix wins.
|
||||
*
|
||||
* Each entry:
|
||||
* prefix — specifier prefix to match (e.g. `"@/"`, `"@omniroute/open-sse/"`)
|
||||
* target — directory name under the package root (e.g. `"src"`, `"open-sse"`)
|
||||
* exact — if true, the prefix also matches when the specifier equals the
|
||||
* prefix *without* a trailing slash (e.g. `@omniroute/open-sse` →
|
||||
* `<root>/open-sse/index.ts`).
|
||||
*
|
||||
* Exported for tests/consumers.
|
||||
*/
|
||||
export const ALIAS_MAP = [
|
||||
{ prefix: "@/", target: "src", exact: false },
|
||||
{ prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
|
||||
{ prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
|
||||
];
|
||||
|
||||
/** @deprecated Use ALIAS_MAP instead. Kept for backward compat. */
|
||||
export const ALIAS_PREFIX = "@/";
|
||||
|
||||
// This file is ESM (no CJS __dirname global) — derive it from import.meta.url
|
||||
// so the pathToFileURL(join(__dirname, ...)) call below resolves correctly
|
||||
// regardless of the caller's cwd.
|
||||
const __dirname = dirname(fileURLToPath(import.meta.url));
|
||||
|
||||
/**
|
||||
* Resolve an alias specifier to an absolute file URL.
|
||||
*
|
||||
* Rules mirror tsconfig.json `paths` via `ALIAS_MAP`:
|
||||
* "@/..." → <root>/src/...
|
||||
* "@omniroute/open-sse/..." → <root>/open-sse/...
|
||||
* "@omniroute/open-sse" → <root>/open-sse/index.*
|
||||
*
|
||||
* - Strips the matched alias prefix and joins the remainder against the
|
||||
* corresponding target directory.
|
||||
* - Probes the underlying filesystem for the actual source file: the specifier
|
||||
* itself, then with common source extensions (`.ts`, `.tsx`, `.js`, `.mjs`,
|
||||
* `.cjs`, `.json`), then `<dir>/index.*`. Returns the first existing match
|
||||
* as a `file://` URL.
|
||||
* - Returns `null` for specifiers that do not match any alias, for malformed
|
||||
* escapes, for path-traversal attempts, or when no corresponding source
|
||||
* file exists on disk. The caller treats `null` as "defer to the default
|
||||
* resolver".
|
||||
*
|
||||
* @param {string} specifier Module specifier from an `import` statement.
|
||||
* @param {string} root Absolute path to the package root.
|
||||
* @returns {string|null} Absolute `file://` URL, or `null` when unresolved.
|
||||
*/
|
||||
const SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
|
||||
|
||||
export function resolveAlias(specifier, root) {
|
||||
if (typeof specifier !== "string" || !root || typeof root !== "string") {
|
||||
return null;
|
||||
}
|
||||
|
||||
// Find the first matching alias entry (top-to-bottom order).
|
||||
let matchedEntry = null;
|
||||
let rest = null;
|
||||
for (const entry of ALIAS_MAP) {
|
||||
if (specifier.startsWith(entry.prefix)) {
|
||||
// For non-exact entries, require at least one char after the prefix
|
||||
// to avoid matching bare "@/" as "nothing".
|
||||
const after = specifier.slice(entry.prefix.length);
|
||||
if (after.length === 0 && !entry.exact) continue;
|
||||
matchedEntry = entry;
|
||||
rest = after;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!matchedEntry) return null;
|
||||
|
||||
const targetDir = join(root, matchedEntry.target);
|
||||
|
||||
// Exact match (e.g. `@omniroute/open-sse` with no trailing path) →
|
||||
// resolve to `<target>/index.*`.
|
||||
if (rest === "" || rest === undefined) {
|
||||
return probeIndex(targetDir);
|
||||
}
|
||||
|
||||
// Guard against absolute-ish escapes (`@//etc/passwd`, `@/\x00`).
|
||||
if (rest.startsWith("/") || rest.startsWith("\\")) {
|
||||
return null;
|
||||
}
|
||||
// Guard against path-traversal escapes (`@/../../../etc/hostname`).
|
||||
const segments = rest.split(/[\\\/]+/);
|
||||
if (segments.includes("..")) {
|
||||
return null;
|
||||
}
|
||||
const base = join(targetDir, rest);
|
||||
if (!isWithinRoot(targetDir, base)) {
|
||||
return null;
|
||||
}
|
||||
return probeFile(base) ?? probeIndex(base) ?? null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Probe a bare path and its extension variants. Returns the first existing
|
||||
* match as a `file://` URL, or `null`.
|
||||
*/
|
||||
function probeFile(base) {
|
||||
// Try extension variants first — a bare `base` that happens to be a directory
|
||||
// would match existsSync() but should NOT be returned as a file URL (the
|
||||
// caller expects a file, not a directory). Extension-probing avoids this
|
||||
// false positive (e.g. `usage` vs `usage.ts` vs `usage/`).
|
||||
for (const ext of SOURCE_EXTENSIONS) {
|
||||
const candidate = base + ext;
|
||||
if (existsSync(candidate)) return pathToFileURL(candidate).href;
|
||||
}
|
||||
// Only accept the bare path if it is NOT a directory.
|
||||
if (existsSync(base)) {
|
||||
try {
|
||||
const st = statSync(base);
|
||||
if (!st.isDirectory()) return pathToFileURL(base).href;
|
||||
} catch {}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Probe a directory for an `index.*` entry. Returns the first existing
|
||||
* match as a `file://` URL, or `null`.
|
||||
*/
|
||||
function probeIndex(dir) {
|
||||
const indexBase = join(dir, "index");
|
||||
for (const ext of SOURCE_EXTENSIONS) {
|
||||
const candidate = indexBase + ext;
|
||||
if (existsSync(candidate)) return pathToFileURL(candidate).href;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* True when `candidate` resolves to a location inside `ancestor` (or is
|
||||
* `ancestor` itself). Used as a second, path-normalization-aware layer of
|
||||
* defense against traversal beyond the literal `..` segment check above.
|
||||
*
|
||||
* @param {string} ancestor
|
||||
* @param {string} candidate
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function isWithinRoot(ancestor, candidate) {
|
||||
const rel = relative(ancestor, candidate);
|
||||
return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
|
||||
}
|
||||
|
||||
/**
|
||||
* Register the ESM resolve hook for the current process. Safe to call multiple
|
||||
* times — subsequent calls are no-ops once the hook is installed.
|
||||
*
|
||||
* Uses Node's stable `module.register()` API (available since Node 20.6,
|
||||
* required Node 22+ here). The hook runs in a worker thread but only reads the
|
||||
* captured `root`, so no shared-state hazards.
|
||||
*
|
||||
* @param {string} root Absolute path to the package root.
|
||||
* @returns {Promise<boolean>} Resolves `true` once registered (or if already
|
||||
* registered), `false` on environments where `module.register` is unavailable.
|
||||
*/
|
||||
let _registered = false;
|
||||
export async function registerAliasResolver(root) {
|
||||
// Validate input FIRST, before the _registered short-circuit. Otherwise the
|
||||
// second call in the same process (e.g. a test suite that already registered
|
||||
// once) would silently return `true` for invalid input instead of rejecting,
|
||||
// masking programmer errors. Input validation must be unconditional.
|
||||
if (!root || typeof root !== "string") {
|
||||
throw new TypeError("registerAliasResolver: root must be a non-empty string");
|
||||
}
|
||||
if (_registered) return true;
|
||||
// if the directory does not exist we would only mask a real misconfiguration
|
||||
// by installing a hook that rewrites to nowhere.
|
||||
if (!existsSync(join(root, "src"))) {
|
||||
return false;
|
||||
}
|
||||
|
||||
try {
|
||||
const { register } = await import("node:module");
|
||||
// #7808: load the hook from a real file on disk via pathToFileURL() instead
|
||||
// of building a `data:text/javascript,...` URL dynamically. CodeQL's
|
||||
// `js/incomplete-url-substring-sanitization` flagged the interpolated
|
||||
// `new URL(...)` call; a file URL produced by pathToFileURL() is a trusted,
|
||||
// fully-parsed URL — no sanitization ambiguity. The hook source lives in
|
||||
// `bin/aliasResolverHook.mjs` (sibling of this file), shipped via
|
||||
// package.json "files": ["bin/"].
|
||||
const hookPath = join(__dirname, "aliasResolverHook.mjs");
|
||||
const hookUrl = pathToFileURL(hookPath);
|
||||
register(hookUrl, { data: { root } });
|
||||
_registered = true;
|
||||
return true;
|
||||
} catch {
|
||||
// Older Node or sandboxed env without module.register — fall back to the
|
||||
// default resolver. The bug will resurface only in the exact global-install
|
||||
// scenario, which is what we explicitly patched; other entry points still
|
||||
// work because they import via relative paths.
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// #7808: the ESM loader hook source now lives in `bin/aliasResolverHook.mjs`,
|
||||
// loaded via `pathToFileURL()` above. The previous inline `HOOK_SOURCE` template
|
||||
// literal was removed because its `new URL(\`data:text/javascript,...\`)` wrapper
|
||||
// triggered CodeQL `js/incomplete-url-substring-sanitization`. The hook logic
|
||||
// itself is unchanged — see aliasResolverHook.mjs for the resolver behaviour.
|
||||
126
bin/aliasResolverHook.mjs
Normal file
126
bin/aliasResolverHook.mjs
Normal file
@@ -0,0 +1,126 @@
|
||||
/**
|
||||
* ESM loader hook for path-alias resolution (#7791 + #7808).
|
||||
*
|
||||
* This file runs in Node's loader worker thread after being registered via
|
||||
* `module.register(url, data)` from `bin/aliasResolver.mjs`. It MUST NOT import
|
||||
* anything from the parent module — all inputs arrive through `initialize(data)`.
|
||||
*
|
||||
* Behaviour:
|
||||
* - Rewrites alias specifiers to absolute filesystem paths, mirroring
|
||||
* tsconfig.json `paths`:
|
||||
* - `@/*` → <root>/src/*
|
||||
* - `@omniroute/open-sse` → <root>/open-sse/index.*
|
||||
* - `@omniroute/open-sse/*` → <root>/open-sse/*
|
||||
* - Probes the usual source extensions (`.ts`, `.tsx`, `.js`, `.mjs`, `.cjs`,
|
||||
* `.json`) plus `index.*` for directory imports.
|
||||
* - Returns `shortCircuit: true` only when a candidate file exists on disk;
|
||||
* otherwise delegates to the next resolver (tsx/Node) so unrelated imports
|
||||
* and legitimate "module not found" errors pass through unchanged.
|
||||
*
|
||||
* Why a separate file instead of an inline `data:` URL?
|
||||
* CodeQL's `js/incomplete-url-substring-sanitization` flags dynamic `new URL(...)`
|
||||
* construction with interpolated strings. A real file URL produced by
|
||||
* `pathToFileURL()` is a trusted, fully-parsed URL — no sanitization ambiguity.
|
||||
*/
|
||||
import { pathToFileURL } from "node:url";
|
||||
import { join, relative, isAbsolute } from "node:path";
|
||||
import { existsSync, statSync } from "node:fs";
|
||||
|
||||
let ROOT = "";
|
||||
|
||||
export function initialize(data) {
|
||||
ROOT = (data && data.root) || "";
|
||||
}
|
||||
|
||||
const EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
|
||||
|
||||
/**
|
||||
* Alias prefix table — mirrors ALIAS_MAP in aliasResolver.mjs and
|
||||
* tsconfig.json `paths`. Processed top-to-bottom; first match wins.
|
||||
*
|
||||
* @type {Array<{prefix: string, target: string, exact: boolean}>}
|
||||
*/
|
||||
const ALIAS_TABLE = [
|
||||
{ prefix: "@/", target: "src", exact: false },
|
||||
{ prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
|
||||
{ prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
|
||||
];
|
||||
|
||||
function tryResolveAliasFsPath(specifier) {
|
||||
if (!ROOT || typeof specifier !== "string") return null;
|
||||
|
||||
// Find the first matching alias entry.
|
||||
let matchedEntry = null;
|
||||
let rest = null;
|
||||
for (const entry of ALIAS_TABLE) {
|
||||
if (specifier.startsWith(entry.prefix)) {
|
||||
const after = specifier.slice(entry.prefix.length);
|
||||
if (after.length === 0 && !entry.exact) continue;
|
||||
matchedEntry = entry;
|
||||
rest = after;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!matchedEntry) return null;
|
||||
|
||||
const targetDir = join(ROOT, matchedEntry.target);
|
||||
|
||||
// Exact match (e.g. `@omniroute/open-sse`) → resolve to `<target>/index.*`.
|
||||
if (rest === "" || rest === undefined) {
|
||||
return probeIndex(targetDir);
|
||||
}
|
||||
|
||||
// Guard against absolute-ish escapes.
|
||||
if (rest.startsWith("/") || rest.startsWith("\\")) return null;
|
||||
// Guard against path-traversal escapes.
|
||||
const segments = rest.split(/[\\\/]+/);
|
||||
if (segments.includes("..")) return null;
|
||||
|
||||
const base = join(targetDir, rest);
|
||||
if (!isWithinRoot(targetDir, base)) return null;
|
||||
return probeFile(base) ?? probeIndex(base) ?? null;
|
||||
}
|
||||
|
||||
function probeFile(base) {
|
||||
// Extension variants first — avoids matching a bare directory name.
|
||||
for (const ext of EXTENSIONS) {
|
||||
const candidate = base + ext;
|
||||
if (existsSync(candidate)) return candidate;
|
||||
}
|
||||
if (existsSync(base)) {
|
||||
try {
|
||||
const st = statSync(base);
|
||||
if (!st.isDirectory()) return base;
|
||||
} catch {}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function probeIndex(dir) {
|
||||
const indexBase = join(dir, "index");
|
||||
for (const ext of EXTENSIONS) {
|
||||
const candidate = indexBase + ext;
|
||||
if (existsSync(candidate)) return candidate;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* True when `candidate` resolves to a location inside `ancestor` (or is
|
||||
* `ancestor` itself). Path-normalization-aware defense against traversal.
|
||||
*/
|
||||
function isWithinRoot(ancestor, candidate) {
|
||||
const rel = relative(ancestor, candidate);
|
||||
return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
|
||||
}
|
||||
|
||||
export function resolve(specifier, context, nextResolve) {
|
||||
const fsPath = tryResolveAliasFsPath(specifier);
|
||||
if (fsPath) {
|
||||
return {
|
||||
url: pathToFileURL(fsPath).href,
|
||||
shortCircuit: true,
|
||||
};
|
||||
}
|
||||
return nextResolve(specifier, context);
|
||||
}
|
||||
163
bin/cli/commands/auth-export.mjs
Normal file
163
bin/cli/commands/auth-export.mjs
Normal file
@@ -0,0 +1,163 @@
|
||||
import { chmodSync, existsSync, writeFileSync } from "node:fs";
|
||||
import { decryptCredential } from "../encryption.mjs";
|
||||
import { findProviderConnection, listProviderConnections } from "../provider-store.mjs";
|
||||
import { openOmniRouteDb } from "../sqlite.mjs";
|
||||
import { t } from "../i18n.mjs";
|
||||
|
||||
/**
|
||||
* Local-only, operator-invoked command that dumps DECRYPTED provider credentials
|
||||
* (apiKey/accessToken/refreshToken/idToken). This never runs inside the HTTP server
|
||||
* process and must never be reachable over the network — no src/app/api/ route wraps
|
||||
* this. See docs/security/ for the threat-model writeup referenced in issue #6683.
|
||||
*/
|
||||
|
||||
const CREDENTIAL_FIELDS = [
|
||||
{ key: "apiKey", envSuffix: "API_KEY" },
|
||||
{ key: "accessToken", envSuffix: "ACCESS_TOKEN" },
|
||||
{ key: "refreshToken", envSuffix: "REFRESH_TOKEN" },
|
||||
{ key: "idToken", envSuffix: "ID_TOKEN" },
|
||||
];
|
||||
|
||||
const VALID_FORMATS = new Set(["json", "env"]);
|
||||
const SECURE_FILE_MODE = 0o600;
|
||||
|
||||
export function registerAuthExport(program) {
|
||||
program
|
||||
.command("auth export")
|
||||
.description(t("authExport.description"))
|
||||
.option("--id <id>", t("authExport.idOpt"))
|
||||
.option("--format <format>", t("authExport.formatOpt"), "json")
|
||||
.option("--out <file>", t("authExport.outOpt"))
|
||||
.option("--force", t("authExport.forceOpt"))
|
||||
.action(async (opts, cmd) => {
|
||||
const globalOpts = cmd.optsWithGlobals();
|
||||
const exitCode = await runAuthExportCommand({ ...opts, ...globalOpts });
|
||||
if (exitCode !== 0) process.exit(exitCode);
|
||||
});
|
||||
}
|
||||
|
||||
export async function runAuthExportCommand(opts = {}) {
|
||||
// Security control (a): confirmation gate BEFORE any DB access — a dry invocation
|
||||
// never opens the database and never decrypts anything.
|
||||
if (!opts.force) {
|
||||
printConfirmationGate();
|
||||
return 0;
|
||||
}
|
||||
|
||||
const format = opts.format || "json";
|
||||
if (!VALID_FORMATS.has(format)) {
|
||||
console.error(t("authExport.invalidFormat", { format }));
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (!process.env.STORAGE_ENCRYPTION_KEY) {
|
||||
console.error(t("authExport.missingKey"));
|
||||
return 1;
|
||||
}
|
||||
|
||||
// Security control (b): stderr warning banner BEFORE any plaintext is emitted.
|
||||
process.stderr.write(t("authExport.warning") + "\n");
|
||||
|
||||
const rows = await loadTargetConnections(opts.id);
|
||||
if (rows === null) {
|
||||
console.error(t("authExport.notFound", { id: opts.id }));
|
||||
return 1;
|
||||
}
|
||||
|
||||
const exported = rows.map(exportConnection);
|
||||
const content = format === "env" ? formatAsEnv(exported) : formatAsJson(exported);
|
||||
|
||||
if (opts.out) {
|
||||
writeSecureFile(opts.out, content);
|
||||
} else {
|
||||
console.log(content);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
function printConfirmationGate() {
|
||||
console.log(
|
||||
`\n${t("authExport.confirmHeading")}\n\n${t("authExport.confirmBody")}\n\n${t("authExport.confirmFooter")}\n`
|
||||
);
|
||||
}
|
||||
|
||||
async function loadTargetConnections(id) {
|
||||
const { db } = await openOmniRouteDb();
|
||||
try {
|
||||
if (!id) return listProviderConnections(db);
|
||||
const connection = findProviderConnection(db, id);
|
||||
return connection ? [connection] : null;
|
||||
} finally {
|
||||
db.close();
|
||||
}
|
||||
}
|
||||
|
||||
function decryptField(rawValue) {
|
||||
// Security control (d): a per-field decrypt failure surfaces as a boolean flag,
|
||||
// never the caught error text. Security control (e): the caught error is never
|
||||
// interpolated into any message.
|
||||
try {
|
||||
return { value: decryptCredential(rawValue), failed: false };
|
||||
} catch {
|
||||
return { value: null, failed: true };
|
||||
}
|
||||
}
|
||||
|
||||
function exportConnection(connection) {
|
||||
const result = {
|
||||
id: connection.id,
|
||||
provider: connection.provider,
|
||||
name: connection.name,
|
||||
authType: connection.authType,
|
||||
};
|
||||
|
||||
for (const { key } of CREDENTIAL_FIELDS) {
|
||||
const rawValue = connection[key];
|
||||
if (!rawValue) {
|
||||
result[key] = null;
|
||||
result[`${key}DecryptFailed`] = false;
|
||||
continue;
|
||||
}
|
||||
const { value, failed } = decryptField(rawValue);
|
||||
result[key] = value;
|
||||
result[`${key}DecryptFailed`] = failed;
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
function formatAsJson(rows) {
|
||||
return JSON.stringify(rows, null, 2);
|
||||
}
|
||||
|
||||
function envSafeSegment(value) {
|
||||
return String(value || "")
|
||||
.toUpperCase()
|
||||
.replace(/[^A-Z0-9]+/g, "_")
|
||||
.replace(/^_+|_+$/g, "");
|
||||
}
|
||||
|
||||
function formatAsEnv(rows) {
|
||||
const lines = [];
|
||||
for (const row of rows) {
|
||||
lines.push(`# ${row.provider} (${row.id})`);
|
||||
const providerSegment = envSafeSegment(row.provider);
|
||||
for (const { key, envSuffix } of CREDENTIAL_FIELDS) {
|
||||
const value = row[key];
|
||||
if (!value) continue;
|
||||
lines.push(`OMNIROUTE_${providerSegment}_${envSuffix}=${value}`);
|
||||
}
|
||||
}
|
||||
return lines.join("\n");
|
||||
}
|
||||
|
||||
function writeSecureFile(filePath, content) {
|
||||
// Security control (c): file output written with mode 0o600 (plus chmodSync if the
|
||||
// file pre-existed, belt-and-suspenders against an already world-readable file).
|
||||
const preExisted = existsSync(filePath);
|
||||
writeFileSync(filePath, content, { mode: SECURE_FILE_MODE });
|
||||
if (preExisted) {
|
||||
chmodSync(filePath, SECURE_FILE_MODE);
|
||||
}
|
||||
}
|
||||
@@ -78,18 +78,15 @@ export function registerBackup(program) {
|
||||
if (exitCode !== 0) process.exit(exitCode);
|
||||
});
|
||||
|
||||
// Legacy: `omniroute backup` without subcommand still creates a backup
|
||||
// Legacy: `omniroute backup` without a subcommand still creates a backup
|
||||
// (documented as the canonical usage in USER_GUIDE.md / CLI-TOOLS.md /
|
||||
// AGENT-SKILLS.md). No flags are declared here — declaring the same
|
||||
// option names as `create`/`auto enable` here previously shadowed them
|
||||
// (#8512), and no doc shows `omniroute backup` invoked with flags.
|
||||
backup.action(async (opts) => {
|
||||
const exitCode = await runBackupCommand(opts);
|
||||
if (exitCode !== 0) process.exit(exitCode);
|
||||
});
|
||||
backup
|
||||
.option("--name <name>", t("backup.nameOpt"))
|
||||
.option("--cloud", t("backup.cloudOpt"))
|
||||
.option("--encrypt", t("backup.encryptOpt"))
|
||||
.option("--key-file <path>", t("backup.keyFileOpt"))
|
||||
.option("--exclude <pattern>", t("backup.excludeOpt"), (v, prev = []) => [...prev, v], [])
|
||||
.option("--retention <n>", t("backup.retentionOpt"), parseInt);
|
||||
}
|
||||
|
||||
export function registerRestore(program) {
|
||||
|
||||
@@ -1,17 +1,22 @@
|
||||
import { execFile } from "node:child_process";
|
||||
import { t } from "../i18n.mjs";
|
||||
|
||||
function parsePort(value, fallback) {
|
||||
const parsed = parseInt(String(value), 10);
|
||||
return Number.isFinite(parsed) && parsed > 0 && parsed <= 65535 ? parsed : fallback;
|
||||
}
|
||||
|
||||
export function registerDashboard(program) {
|
||||
program
|
||||
.command("dashboard")
|
||||
.description(t("dashboard.description"))
|
||||
.option("--url", t("dashboard.urlOnly"))
|
||||
.option("--port <port>", "Port the server is running on", "20128")
|
||||
.option("--port <port>", "Port the server is running on")
|
||||
.option("--tui", t("dashboard.tui") || "Open interactive TUI dashboard (terminal UI)")
|
||||
.action(async (opts, cmd) => {
|
||||
if (opts.tui) {
|
||||
const globalOpts = cmd.optsWithGlobals();
|
||||
const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
|
||||
const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
|
||||
const baseUrl = globalOpts.baseUrl ?? `http://localhost:${port}`;
|
||||
const apiKey = globalOpts.apiKey ?? null;
|
||||
const { startInteractiveTui } = await import("../tui/Dashboard.jsx");
|
||||
@@ -24,7 +29,7 @@ export function registerDashboard(program) {
|
||||
}
|
||||
|
||||
export async function runDashboardCommand(opts = {}) {
|
||||
const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
|
||||
const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
|
||||
const dashboardUrl = `http://localhost:${port}`;
|
||||
|
||||
if (opts.url) {
|
||||
@@ -44,22 +49,22 @@ export async function runDashboardCommand(opts = {}) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the command and args to open a URL in the default browser
|
||||
* for a given platform. Exported for testing — callers should use openFallback().
|
||||
* @param {"darwin"|"win32"|string} platform
|
||||
* @param {string} url
|
||||
* @returns {{ cmd: string, args: string[] }}
|
||||
*/
|
||||
export function resolveOpenCommand(platform, url) {
|
||||
if (platform === "darwin") return { cmd: "open", args: [url] };
|
||||
if (platform === "win32") return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
|
||||
return { cmd: "xdg-open", args: [url] };
|
||||
}
|
||||
|
||||
function openFallback(url) {
|
||||
return new Promise((resolve) => {
|
||||
const { platform } = process;
|
||||
let cmd, args;
|
||||
|
||||
if (platform === "darwin") {
|
||||
cmd = "open";
|
||||
args = [url];
|
||||
} else if (platform === "win32") {
|
||||
cmd = "cmd";
|
||||
args = ["/c", "start", "", url];
|
||||
} else {
|
||||
cmd = "xdg-open";
|
||||
args = [url];
|
||||
}
|
||||
|
||||
const { cmd, args } = resolveOpenCommand(process.platform, url);
|
||||
execFile(cmd, args, { stdio: "ignore" }, () => resolve());
|
||||
});
|
||||
}
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
import { spawn } from "node:child_process";
|
||||
import { t } from "../i18n.mjs";
|
||||
import { resolveActiveContext } from "../contexts.mjs";
|
||||
import { quoteShellArgs } from "../utils/winShellArgs.mjs";
|
||||
|
||||
/** OpenAI/Codex env keys stripped from the child so a stale OpenAI key/base-url
|
||||
* in the shell can't shadow the omniroute provider (defense-in-depth). Mirrors
|
||||
@@ -29,6 +30,23 @@ export function resolveCodexSpawn(platform) {
|
||||
return { command: "codex", shell: undefined };
|
||||
}
|
||||
|
||||
/**
|
||||
* `shell: true` makes Node join argv with plain spaces and no escaping (the
|
||||
* DEP0190 warning). That mangles every launch-codex invocation on Windows, not
|
||||
* just the ones with a multi-word user argument: the injected `-c` provider
|
||||
* flags carry TOML values whose quotes cmd.exe strips
|
||||
* (`model_providers.omniroute.name="OmniRoute"` arrives unquoted and no longer
|
||||
* parses as TOML). Quote the args ourselves on that path; off Windows there is
|
||||
* no shell, so argv is passed through untouched. Same fix as `launch` (#8837).
|
||||
*
|
||||
* @param {string[]} args
|
||||
* @param {NodeJS.Platform|string} platform
|
||||
* @returns {string[]}
|
||||
*/
|
||||
export function quoteCodexArgs(args, platform) {
|
||||
return quoteShellArgs(args, platform);
|
||||
}
|
||||
|
||||
function stripTrailingSlash(value) {
|
||||
let s = String(value);
|
||||
let end = s.length;
|
||||
@@ -153,7 +171,7 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
|
||||
|
||||
return await new Promise((resolve) => {
|
||||
const { command: codexLaunch, shell: shellValue } = resolveCodexSpawn(process.platform);
|
||||
const child = spawn(codexLaunch, extraArgs, {
|
||||
const child = spawn(codexLaunch, quoteCodexArgs(extraArgs, process.platform), {
|
||||
env,
|
||||
stdio: "inherit",
|
||||
shell: shellValue,
|
||||
@@ -195,7 +213,10 @@ export function registerLaunchCodex(program) {
|
||||
.argument("[codexArgs...]", "arguments passed through to the codex binary")
|
||||
.action(async (codexArgs, opts) => {
|
||||
const merged = { ...opts, profile: opts.profile ?? opts.p };
|
||||
const exitCode = await runLaunchCodexCommand(merged, codexArgs ?? []);
|
||||
if (exitCode !== 0) process.exit(exitCode);
|
||||
// process.exit() here aborted the process with a libuv assertion on
|
||||
// Windows (`!(handle->flags & UV_HANDLE_CLOSING)`, async.c:94): it tears
|
||||
// the loop down while the inherited stdio handles of the just-exited
|
||||
// child are still closing. Setting exitCode lets the loop drain first.
|
||||
process.exitCode = await runLaunchCodexCommand(merged, codexArgs ?? []);
|
||||
});
|
||||
}
|
||||
|
||||
@@ -3,6 +3,7 @@ import { join } from "node:path";
|
||||
import os from "node:os";
|
||||
import { t } from "../i18n.mjs";
|
||||
import { resolveActiveContext } from "../contexts.mjs";
|
||||
import { quoteShellArgs } from "../utils/winShellArgs.mjs";
|
||||
|
||||
function stripTrailingSlash(value) {
|
||||
let s = String(value);
|
||||
@@ -90,6 +91,34 @@ export function resolveLaunchTarget(opts = {}) {
|
||||
return { baseUrl, authToken };
|
||||
}
|
||||
|
||||
/**
|
||||
* #8246: on Windows, npm installs claude as a `.cmd` shim — spawn() without a
|
||||
* shell cannot resolve PATHEXT shims (and Node refuses to exec `.cmd` directly
|
||||
* since CVE-2024-27980), so the Windows path must go through cmd.exe.
|
||||
*
|
||||
* @param {NodeJS.Platform|string} platform
|
||||
* @returns {{ command: string, shell: true|undefined }}
|
||||
*/
|
||||
export function resolveClaudeSpawn(platform) {
|
||||
return platform === "win32"
|
||||
? { command: "claude.cmd", shell: true }
|
||||
: { command: "claude", shell: undefined };
|
||||
}
|
||||
|
||||
/**
|
||||
* `shell: true` makes Node join argv with plain spaces and no escaping (the
|
||||
* DEP0190 warning), so `-p "two words"` used to reach claude as `-p two` plus
|
||||
* three stray positional arguments. Quote the args ourselves on that path.
|
||||
* Off Windows there is no shell, so argv is passed through untouched.
|
||||
*
|
||||
* @param {string[]} args
|
||||
* @param {NodeJS.Platform|string} platform
|
||||
* @returns {string[]}
|
||||
*/
|
||||
export function quoteClaudeArgs(args, platform) {
|
||||
return quoteShellArgs(args, platform);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {{port?:string, remote?:string, token?:string, apiKey?:string, profile?:string, claudeHome?:string}} opts
|
||||
* @param {string[]} claudeArgs pass-through args for the claude binary
|
||||
@@ -106,10 +135,10 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
|
||||
if (!res.ok) throw new Error(`status ${res.status}`);
|
||||
} catch {
|
||||
console.error(
|
||||
(t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
|
||||
"{port}",
|
||||
baseUrl
|
||||
)
|
||||
(
|
||||
t("launch.notRunning") ||
|
||||
"OmniRoute is not reachable at {port}. Start it with 'omniroute serve'."
|
||||
).replace("{port}", baseUrl)
|
||||
);
|
||||
return 1;
|
||||
}
|
||||
@@ -120,7 +149,13 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
|
||||
const env = buildClaudeEnv(process.env, baseUrl, authToken, { configDir });
|
||||
|
||||
return await new Promise((resolve) => {
|
||||
const child = spawn("claude", claudeArgs, { env, stdio: "inherit" });
|
||||
const { command, shell } = resolveClaudeSpawn(process.platform);
|
||||
const child = spawn(command, quoteClaudeArgs(claudeArgs, process.platform), {
|
||||
env,
|
||||
stdio: "inherit",
|
||||
shell,
|
||||
...(process.platform === "win32" ? { windowsHide: true } : {}),
|
||||
});
|
||||
child.on("error", (err) => {
|
||||
if (err && err.code === "ENOENT") {
|
||||
console.error(t("launch.notFound") || "The 'claude' CLI was not found in PATH.");
|
||||
@@ -142,14 +177,20 @@ export function registerLaunch(program) {
|
||||
)
|
||||
.option("--port <port>", t("serve.port") || "Proxy port", "20128")
|
||||
.option("--remote <url>", "Remote OmniRoute base URL (overrides --port and the active context)")
|
||||
.option("--profile <name>", "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)")
|
||||
.option(
|
||||
"--profile <name>",
|
||||
"Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)"
|
||||
)
|
||||
.option("--token <token>", t("launch.token") || "Token Claude sends (ANTHROPIC_AUTH_TOKEN)")
|
||||
.option("--api-key <key>", "Alias for --token (OmniRoute access token / API key)")
|
||||
.allowUnknownOption(true)
|
||||
.allowExcessArguments(true)
|
||||
.argument("[claudeArgs...]", "arguments passed through to the claude binary")
|
||||
.action(async (claudeArgs, opts) => {
|
||||
const exitCode = await runLaunchCommand(opts, claudeArgs ?? []);
|
||||
if (exitCode !== 0) process.exit(exitCode);
|
||||
// process.exit() here aborted the process with a libuv assertion on
|
||||
// Windows (`!(handle->flags & UV_HANDLE_CLOSING)`, async.c:94): it tears
|
||||
// the loop down while the inherited stdio handles of the just-exited
|
||||
// child are still closing. Setting exitCode lets the loop drain first.
|
||||
process.exitCode = await runLaunchCommand(opts, claudeArgs ?? []);
|
||||
});
|
||||
}
|
||||
|
||||
@@ -7,7 +7,6 @@ const PROVIDERS_WITH_OAUTH = [
|
||||
{ id: "gemini", name: "Google Gemini", flow: "browser" },
|
||||
{ id: "antigravity", name: "Antigravity", flow: "browser" },
|
||||
{ id: "windsurf", name: "Windsurf", flow: "browser" },
|
||||
{ id: "qwen", name: "Qwen Code", flow: "browser" },
|
||||
{ id: "cursor", name: "Cursor", flow: "import" },
|
||||
{ id: "zed", name: "Zed", flow: "import" },
|
||||
{ id: "kiro", name: "Amazon Kiro", flow: "social" },
|
||||
|
||||
@@ -37,6 +37,7 @@ import { registerProviders } from "./providers.mjs";
|
||||
import { registerProvider } from "./provider-cmd.mjs";
|
||||
import { registerConfig } from "./config.mjs";
|
||||
import { registerKeys } from "./keys.mjs";
|
||||
import { registerAuthExport } from "./auth-export.mjs";
|
||||
import { registerModels } from "./models.mjs";
|
||||
import { registerCombo } from "./combo.mjs";
|
||||
import { registerStatus } from "./status.mjs";
|
||||
@@ -69,8 +70,8 @@ import { registerSetupCursor } from "./setup-cursor.mjs";
|
||||
import { registerSetupRoo } from "./setup-roo.mjs";
|
||||
import { registerSetupCrush } from "./setup-crush.mjs";
|
||||
import { registerSetupGoose } from "./setup-goose.mjs";
|
||||
import { registerSetupQwen } from "./setup-qwen.mjs";
|
||||
import { registerSetupAider } from "./setup-aider.mjs";
|
||||
import { registerSetupQwen } from "./setup-qwen.mjs";
|
||||
import { registerConnect } from "./connect.mjs";
|
||||
import { registerContexts } from "./contexts.mjs";
|
||||
import { registerTokens } from "./tokens.mjs";
|
||||
@@ -118,6 +119,7 @@ export function registerCommands(program) {
|
||||
registerProvider(program);
|
||||
registerConfig(program);
|
||||
registerKeys(program);
|
||||
registerAuthExport(program);
|
||||
registerModels(program);
|
||||
registerCombo(program);
|
||||
registerStatus(program);
|
||||
@@ -151,8 +153,8 @@ export function registerCommands(program) {
|
||||
registerSetupRoo(program);
|
||||
registerSetupCrush(program);
|
||||
registerSetupGoose(program);
|
||||
registerSetupQwen(program);
|
||||
registerSetupAider(program);
|
||||
registerSetupQwen(program);
|
||||
registerConnect(program);
|
||||
registerContexts(program);
|
||||
registerTokens(program);
|
||||
|
||||
@@ -7,6 +7,11 @@ import { t } from "../i18n.mjs";
|
||||
import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
|
||||
import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
|
||||
import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
|
||||
import {
|
||||
ensureAndroidCacheDir,
|
||||
isFatalInstrumentationHookFailure,
|
||||
formatAndroidInstrumentationFailureHint,
|
||||
} from "../utils/ensureAndroidCacheDir.mjs";
|
||||
import {
|
||||
resolveMaxOldSpaceMb,
|
||||
calibrateHeapFallbackMb,
|
||||
@@ -62,9 +67,37 @@ export function registerServe(program) {
|
||||
});
|
||||
}
|
||||
|
||||
/** Once-per-process guard so the Android/Termux cache hint is not spammed. */
|
||||
let instrumentationFailureHintPrinted = false;
|
||||
|
||||
/**
|
||||
* If child output looks like Next.js failed to load its instrumentation hook
|
||||
* on Android/Termux, print a clear operator-facing fix hint.
|
||||
* Exported for unit tests.
|
||||
*
|
||||
* @param {string} text
|
||||
* @returns {boolean} true when a hint was printed
|
||||
*/
|
||||
export function maybeReportInstrumentationHookFailure(text) {
|
||||
if (instrumentationFailureHintPrinted) return false;
|
||||
if (!isFatalInstrumentationHookFailure(text)) return false;
|
||||
instrumentationFailureHintPrinted = true;
|
||||
process.stderr.write(formatAndroidInstrumentationFailureHint(process.env.XDG_CACHE_HOME));
|
||||
return true;
|
||||
}
|
||||
|
||||
/** Test-only reset for the once-per-process hint guard. */
|
||||
export function resetInstrumentationFailureHintForTests() {
|
||||
instrumentationFailureHintPrinted = false;
|
||||
}
|
||||
|
||||
export async function runServe(opts = {}) {
|
||||
const startedAt = performance.now();
|
||||
|
||||
// Same prep as bin/omniroute.mjs — keep it here so a direct `runServe()` call
|
||||
// (tests / programmatic) still gets a writable Next.js cache dir before spawn.
|
||||
ensureAndroidCacheDir({ env: process.env });
|
||||
|
||||
const { isNativeBinaryCompatible } =
|
||||
await import("../../../scripts/build/native-binary-compat.mjs");
|
||||
const { getNodeRuntimeSupport, getNodeRuntimeWarning } =
|
||||
@@ -134,7 +167,11 @@ export async function runServe(opts = {}) {
|
||||
"Release",
|
||||
"better_sqlite3.node"
|
||||
);
|
||||
if (existsSync(sqliteBinary) && !isNativeBinaryCompatible(sqliteBinary)) {
|
||||
if (
|
||||
!process.versions.bun &&
|
||||
existsSync(sqliteBinary) &&
|
||||
!isNativeBinaryCompatible(sqliteBinary)
|
||||
) {
|
||||
console.error(
|
||||
"\x1b[31m✖ better-sqlite3 native module is incompatible with this platform.\x1b[0m"
|
||||
);
|
||||
@@ -230,12 +267,16 @@ export async function runServe(opts = {}) {
|
||||
function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
|
||||
// #5238: skip the explicit CLI --max-old-space-size when the user pinned the
|
||||
// heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
|
||||
const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
|
||||
cwd: APP_DIR,
|
||||
env,
|
||||
stdio: "ignore",
|
||||
detached: true,
|
||||
});
|
||||
const server = spawn(
|
||||
process.versions.bun ? process.execPath : "node",
|
||||
[...(process.versions.bun ? [] : buildNodeHeapArgs(process.env, memoryLimit)), serverJs],
|
||||
{
|
||||
cwd: APP_DIR,
|
||||
env,
|
||||
stdio: "ignore",
|
||||
detached: true,
|
||||
}
|
||||
);
|
||||
writePidFile("server", server.pid);
|
||||
server.unref();
|
||||
console.log(`\x1b[32m✔ OmniRoute started in background (PID: ${server.pid})\x1b[0m`);
|
||||
@@ -246,11 +287,15 @@ function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
|
||||
function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen, startedAt) {
|
||||
// #5238: skip the explicit CLI --max-old-space-size when the user pinned the
|
||||
// heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
|
||||
const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
|
||||
cwd: APP_DIR,
|
||||
env,
|
||||
stdio: "pipe",
|
||||
});
|
||||
const server = spawn(
|
||||
process.versions.bun ? process.execPath : "node",
|
||||
[...(process.versions.bun ? [] : buildNodeHeapArgs(process.env, memoryLimit)), serverJs],
|
||||
{
|
||||
cwd: APP_DIR,
|
||||
env,
|
||||
stdio: "pipe",
|
||||
}
|
||||
);
|
||||
|
||||
writePidFile("server", server.pid);
|
||||
|
||||
@@ -259,6 +304,7 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
|
||||
server.stdout.on("data", (data) => {
|
||||
const text = data.toString();
|
||||
process.stdout.write(text);
|
||||
maybeReportInstrumentationHookFailure(text);
|
||||
if (
|
||||
!started &&
|
||||
(text.includes("Ready") || text.includes("started") || text.includes("listening"))
|
||||
@@ -268,7 +314,11 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
|
||||
}
|
||||
});
|
||||
|
||||
server.stderr.on("data", (data) => process.stderr.write(data));
|
||||
server.stderr.on("data", (data) => {
|
||||
const text = data.toString();
|
||||
process.stderr.write(text);
|
||||
maybeReportInstrumentationHookFailure(text);
|
||||
});
|
||||
|
||||
server.on("error", (err) => {
|
||||
console.error("\x1b[31m✖ Failed to start server:\x1b[0m", err.message);
|
||||
@@ -377,6 +427,9 @@ export function reportReadinessTimeout(dashboardPort, supervisor) {
|
||||
console.error("--- Recent server output ---");
|
||||
recentLog.forEach((l) => console.error(l));
|
||||
console.error("--- End recent output ---\n");
|
||||
// If the buffered log already shows the Android instrumentation failure,
|
||||
// print the actionable hint even when --log was off (default).
|
||||
maybeReportInstrumentationHookFailure(recentLog.join("\n"));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -218,13 +218,29 @@ function registerPluginInOpenCodeConfig({
|
||||
* a clear "could not run opencode" message instead of a hard import
|
||||
* failure.
|
||||
*/
|
||||
function runOpenCodeAuth(providerId) {
|
||||
const isWin = process.platform === "win32";
|
||||
const opencodeBin = isWin ? "opencode.cmd" : "opencode";
|
||||
const res = spawnSync(opencodeBin, ["auth", "login", "--provider", providerId], {
|
||||
stdio: "inherit",
|
||||
shell: false,
|
||||
});
|
||||
/**
|
||||
* Pure resolver for the `opencode auth login` spawn descriptor. Extracted so the
|
||||
* platform-branching logic is unit-testable without mocking child_process or
|
||||
* mutating process.platform.
|
||||
*
|
||||
* On Windows the `opencode` binary is an npm `.cmd` shim that Node's hardened
|
||||
* spawnSync (post CVE-2024-27980) refuses to run without a shell — spawning it
|
||||
* with shell:false throws EINVAL (#7913). Mirror the same fix already applied to
|
||||
* codex (resolveCodexSpawn in launch-codex.mjs, crediting #6263) and
|
||||
* qodercli/Auggie (#6263/#6304): shell:true on win32, shell:false everywhere else.
|
||||
*/
|
||||
export function resolveOpenCodeAuthSpawn(providerId, platform = process.platform) {
|
||||
const isWin = platform === "win32";
|
||||
return {
|
||||
command: isWin ? "opencode.cmd" : "opencode",
|
||||
args: ["auth", "login", "--provider", providerId],
|
||||
options: { stdio: "inherit", shell: isWin },
|
||||
};
|
||||
}
|
||||
|
||||
export function runOpenCodeAuth(providerId) {
|
||||
const { command, args, options } = resolveOpenCodeAuthSpawn(providerId);
|
||||
const res = spawnSync(command, args, options);
|
||||
if (res.error) {
|
||||
// ENOENT = opencode is not on PATH
|
||||
if (res.error.code === "ENOENT") {
|
||||
|
||||
@@ -1,156 +1,166 @@
|
||||
/**
|
||||
* omniroute setup-qwen — configure Qwen Code (QwenLM/qwen-code) for OmniRoute.
|
||||
*
|
||||
* Qwen Code is a terminal AI agent with a file-based config at
|
||||
* ~/.qwen/settings.json. For a custom OpenAI-compatible endpoint it uses a
|
||||
* `modelProviders` entry with authType "openai", baseUrl WITH /v1, and an
|
||||
* `envKey` naming the env var holding the key (secret stays in the env, never the
|
||||
* file). Remote-aware; headless test via `qwen -p "..."`.
|
||||
*/
|
||||
/** Configure Qwen Code's OpenAI-compatible provider for OmniRoute. */
|
||||
|
||||
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
||||
import { join } from "node:path";
|
||||
import {
|
||||
chmodSync,
|
||||
existsSync,
|
||||
mkdirSync,
|
||||
readFileSync,
|
||||
renameSync,
|
||||
unlinkSync,
|
||||
writeFileSync,
|
||||
} from "node:fs";
|
||||
import os from "node:os";
|
||||
import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
|
||||
import path from "node:path";
|
||||
|
||||
import {
|
||||
mergeQwenCodeEnv,
|
||||
mergeQwenCodeSettings,
|
||||
normalizeQwenCodeBaseUrl,
|
||||
} from "../../../src/shared/services/qwenCodeConfig.ts";
|
||||
import { resolveActiveContext } from "../contexts.mjs";
|
||||
import { createPrompt, printError, printHeading, printInfo, printSuccess } from "../io.mjs";
|
||||
|
||||
function ensureV1(url) {
|
||||
const s = String(url || "").replace(/\/+$/, "");
|
||||
return s.endsWith("/v1") ? s : `${s}/v1`;
|
||||
}
|
||||
|
||||
/** Resolve baseUrl (WITH /v1) + apiKey from flags → active context → localhost. */
|
||||
/** Resolve base URL and key from flags, active context, then local defaults. */
|
||||
export function resolveQwenTarget(opts = {}) {
|
||||
let root;
|
||||
if (opts.remote) root = String(opts.remote).replace(/\/+$/, "");
|
||||
else {
|
||||
let root = opts.remote ? String(opts.remote) : "";
|
||||
let context;
|
||||
|
||||
if (!root || !(opts.apiKey ?? opts["api-key"])) {
|
||||
try {
|
||||
root = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl;
|
||||
context = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
|
||||
} catch {
|
||||
/* none */
|
||||
}
|
||||
if (!root) root = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
|
||||
}
|
||||
let apiKey = opts.apiKey ?? opts["api-key"];
|
||||
if (!apiKey) {
|
||||
try {
|
||||
const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
|
||||
apiKey = c?.accessToken || c?.apiKey;
|
||||
} catch {
|
||||
/* none */
|
||||
// An active context is optional for local setup.
|
||||
}
|
||||
}
|
||||
if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
|
||||
return { baseUrl: ensureV1(root), apiKey };
|
||||
}
|
||||
|
||||
/** Merge the OmniRoute modelProvider into Qwen's settings.json (preserve rest). */
|
||||
export function buildQwenSettings(existing, { baseUrl, model }) {
|
||||
const s = existing && typeof existing === "object" ? { ...existing } : {};
|
||||
const providers = Array.isArray(s.modelProviders)
|
||||
? s.modelProviders.filter((p) => p?.id !== "omniroute")
|
||||
: [];
|
||||
providers.push({
|
||||
id: "omniroute",
|
||||
name: "OmniRoute",
|
||||
authType: "openai",
|
||||
baseUrl,
|
||||
envKey: "OMNIROUTE_API_KEY",
|
||||
});
|
||||
s.modelProviders = providers;
|
||||
if (model) {
|
||||
s.selectedProvider = "omniroute";
|
||||
s.model = model;
|
||||
if (!root) root = context?.baseUrl || "";
|
||||
if (!root) {
|
||||
const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
|
||||
root = `http://localhost:${port}`;
|
||||
}
|
||||
return s;
|
||||
|
||||
const apiKey =
|
||||
opts.apiKey ??
|
||||
opts["api-key"] ??
|
||||
context?.accessToken ??
|
||||
context?.apiKey ??
|
||||
process.env.OMNIROUTE_API_KEY ??
|
||||
"sk_omniroute";
|
||||
|
||||
return { baseUrl: normalizeQwenCodeBaseUrl(root), apiKey };
|
||||
}
|
||||
|
||||
function readJson(path) {
|
||||
try {
|
||||
if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8"));
|
||||
} catch {
|
||||
/* corrupt/missing */
|
||||
const readSettings = (filePath) => {
|
||||
if (!existsSync(filePath)) return {};
|
||||
const parsed = JSON.parse(readFileSync(filePath, "utf8"));
|
||||
if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
|
||||
throw new Error("Qwen Code settings.json must contain a JSON object");
|
||||
}
|
||||
return {};
|
||||
}
|
||||
return parsed;
|
||||
};
|
||||
|
||||
async function fetchModelIds(baseUrl, apiKey) {
|
||||
const readText = (filePath) => (existsSync(filePath) ? readFileSync(filePath, "utf8") : "");
|
||||
|
||||
const writeAtomic = (filePath, content, mode) => {
|
||||
const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
|
||||
try {
|
||||
const headers = { "Content-Type": "application/json" };
|
||||
if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
|
||||
const res = await fetch(`${baseUrl.replace(/\/v1$/, "")}/v1/models`, {
|
||||
headers,
|
||||
writeFileSync(tempPath, content, { encoding: "utf8", mode });
|
||||
if (mode !== undefined) chmodSync(tempPath, mode);
|
||||
renameSync(tempPath, filePath);
|
||||
} catch (error) {
|
||||
try {
|
||||
unlinkSync(tempPath);
|
||||
} catch {
|
||||
// The temporary file may not have been created.
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
};
|
||||
|
||||
const fetchModelIds = async (baseUrl, apiKey) => {
|
||||
try {
|
||||
const response = await fetch(`${baseUrl}/models`, {
|
||||
headers: { Authorization: `Bearer ${apiKey}` },
|
||||
signal: AbortSignal.timeout(8000),
|
||||
});
|
||||
if (!res.ok) return [];
|
||||
const body = await res.json();
|
||||
const list = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
|
||||
return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
|
||||
if (!response.ok) return [];
|
||||
const body = await response.json();
|
||||
const models = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
|
||||
return models.map((entry) => (typeof entry === "string" ? entry : entry?.id)).filter(Boolean);
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
export async function runSetupQwenCommand(opts = {}) {
|
||||
const { baseUrl, apiKey } = resolveQwenTarget(opts);
|
||||
const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
|
||||
const configPath =
|
||||
opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".qwen", "settings.json");
|
||||
const settingsPath =
|
||||
opts.configPath ?? opts["config-path"] ?? path.join(os.homedir(), ".qwen", "settings.json");
|
||||
const envPath = opts.envPath ?? opts["env-path"] ?? path.join(path.dirname(settingsPath), ".env");
|
||||
|
||||
printHeading("OmniRoute → Qwen Code (openai-compatible)");
|
||||
printHeading("OmniRoute → Qwen Code (OpenAI-compatible)");
|
||||
printInfo(`baseUrl: ${baseUrl}`);
|
||||
|
||||
let model = opts.model;
|
||||
if (!model) {
|
||||
const ids = await fetchModelIds(baseUrl, apiKey);
|
||||
if (ids.length && !opts.yes) {
|
||||
printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
|
||||
const prompt = createPrompt();
|
||||
try {
|
||||
model = await prompt.ask("Model id for Qwen");
|
||||
} finally {
|
||||
prompt.close();
|
||||
}
|
||||
let model = String(opts.model || "").trim();
|
||||
if (!model && !opts.yes) {
|
||||
const modelIds = await fetchModelIds(baseUrl, apiKey);
|
||||
if (modelIds.length > 0) {
|
||||
printInfo(`Examples: ${modelIds.slice(0, 20).join(", ")}${modelIds.length > 20 ? " …" : ""}`);
|
||||
}
|
||||
const prompt = createPrompt();
|
||||
try {
|
||||
model = String(await prompt.ask("Model id for Qwen Code")).trim();
|
||||
} finally {
|
||||
prompt.close();
|
||||
}
|
||||
}
|
||||
|
||||
if (!model) {
|
||||
printError("A model is required. Pass --model <id>.");
|
||||
return 2;
|
||||
}
|
||||
|
||||
const merged = buildQwenSettings(readJson(configPath), { baseUrl, model });
|
||||
const out = JSON.stringify(merged, null, 2) + "\n";
|
||||
try {
|
||||
const settings = mergeQwenCodeSettings(readSettings(settingsPath), { baseUrl, model });
|
||||
const envText = mergeQwenCodeEnv(readText(envPath), apiKey);
|
||||
const settingsText = `${JSON.stringify(settings, null, 2)}\n`;
|
||||
|
||||
if (dryRun) {
|
||||
console.log("\n" + out);
|
||||
printInfo(`[dry-run] → ${configPath}`);
|
||||
} else {
|
||||
mkdirSync(join(configPath, ".."), { recursive: true });
|
||||
writeFileSync(configPath, out, "utf8");
|
||||
printSuccess(`Wrote ${configPath}`);
|
||||
if (dryRun) {
|
||||
console.log(`\n${settingsText}`);
|
||||
printInfo(`[dry-run] settings → ${settingsPath}`);
|
||||
printInfo(`[dry-run] credential → ${envPath} (OMNIROUTE_API_KEY)`);
|
||||
return 0;
|
||||
}
|
||||
|
||||
mkdirSync(path.dirname(settingsPath), { recursive: true, mode: 0o700 });
|
||||
mkdirSync(path.dirname(envPath), { recursive: true, mode: 0o700 });
|
||||
writeAtomic(settingsPath, settingsText);
|
||||
writeAtomic(envPath, envText, 0o600);
|
||||
printSuccess(`Wrote ${settingsPath}`);
|
||||
printSuccess(`Updated ${envPath} (OMNIROUTE_API_KEY only)`);
|
||||
printInfo('Run: qwen (or headless: qwen -p "reply OK")');
|
||||
return 0;
|
||||
} catch (error) {
|
||||
printError(`Failed to configure Qwen Code: ${error?.message || error}`);
|
||||
return 1;
|
||||
}
|
||||
printInfo(
|
||||
"\nProvide the key (settings reference OMNIROUTE_API_KEY): export OMNIROUTE_API_KEY=..."
|
||||
);
|
||||
printInfo('Then run: qwen (or headless: qwen -p "reply OK")');
|
||||
return 0;
|
||||
}
|
||||
|
||||
export function registerSetupQwen(program) {
|
||||
program
|
||||
.command("setup-qwen")
|
||||
.description(
|
||||
"Configure Qwen Code for OmniRoute: write ~/.qwen/settings.json (openai modelProvider)"
|
||||
)
|
||||
.description("Configure Qwen Code's upstream V4 modelProviders format for OmniRoute")
|
||||
.option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
|
||||
.option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
|
||||
.option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
|
||||
.option("--model <id>", "Model id for Qwen (required unless picked interactively)")
|
||||
.option("--config-path <path>", "settings.json path (default: ~/.qwen/settings.json)")
|
||||
.option("--yes", "Non-interactive: do not prompt (requires --model)")
|
||||
.option("--dry-run", "Print what would be written without touching the filesystem")
|
||||
.option("--remote <url>", "Remote OmniRoute URL")
|
||||
.option("--api-key <key>", "OmniRoute API key")
|
||||
.option("--model <id>", "Model id for Qwen Code")
|
||||
.option("--config-path <path>", "Qwen Code settings.json path")
|
||||
.option("--env-path <path>", "Qwen Code .env path")
|
||||
.option("--yes", "Non-interactive; requires --model")
|
||||
.option("--dry-run", "Print settings without writing files or secrets")
|
||||
.action(async (opts) => {
|
||||
const code = await runSetupQwenCommand(opts);
|
||||
if (code !== 0) process.exit(code);
|
||||
if (code !== 0) process.exitCode = code;
|
||||
});
|
||||
}
|
||||
|
||||
@@ -26,6 +26,7 @@ function wantsProviderSetup(opts) {
|
||||
|
||||
async function resolvePassword(opts, prompt, nonInteractive) {
|
||||
if (opts.password) return opts.password;
|
||||
if (process.env.INITIAL_PASSWORD) return process.env.INITIAL_PASSWORD;
|
||||
if (nonInteractive) return "";
|
||||
|
||||
const answer = await prompt.ask("Set an admin password now? [y/N]", "N");
|
||||
|
||||
@@ -8,6 +8,7 @@ import {
|
||||
sleep,
|
||||
} from "../utils/pid.mjs";
|
||||
import { t } from "../i18n.mjs";
|
||||
import { stopProcessGracefully } from "../../../src/shared/platform/windowsProcess.ts";
|
||||
|
||||
const execFileAsync = promisify(execFile);
|
||||
|
||||
@@ -27,18 +28,11 @@ export async function runStopCommand(opts = {}) {
|
||||
if (pid && isPidRunning(pid)) {
|
||||
console.log(t("stop.stopping", { pid }));
|
||||
try {
|
||||
process.kill(pid, "SIGTERM");
|
||||
|
||||
let waited = 0;
|
||||
while (waited < 5000 && isPidRunning(pid)) {
|
||||
await sleep(100);
|
||||
waited += 100;
|
||||
}
|
||||
|
||||
if (isPidRunning(pid)) {
|
||||
process.kill(pid, "SIGKILL");
|
||||
await sleep(500);
|
||||
}
|
||||
// #8045: on win32, process.kill(pid, "SIGTERM") unconditionally force-terminates
|
||||
// the target instead of delivering an interceptable signal, racing (and beating)
|
||||
// the server's own async graceful shutdown / WAL checkpoint. stopProcessGracefully
|
||||
// skips the immediate SIGTERM on win32 and just polls before escalating to SIGKILL.
|
||||
await stopProcessGracefully({ pid, timeoutMs: 5000, isPidRunning, sleep });
|
||||
|
||||
killAllSubprocesses();
|
||||
cleanupPidFile("server");
|
||||
|
||||
@@ -133,6 +133,20 @@
|
||||
"listTitle": "Keys expiring within {days} days:"
|
||||
}
|
||||
},
|
||||
"authExport": {
|
||||
"description": "Export DECRYPTED provider credentials (local-only, plaintext output)",
|
||||
"idOpt": "Export only the connection matching this id/name/provider",
|
||||
"formatOpt": "Output format: json or env",
|
||||
"outOpt": "Write output to a file instead of stdout (written with 0600 permissions)",
|
||||
"forceOpt": "Confirm you understand this prints/writes plaintext secrets",
|
||||
"warning": "⚠ This prints/writes DECRYPTED plaintext API keys and OAuth tokens. Make sure your screen, shell history, and any output file stay private.",
|
||||
"confirmHeading": "⚠ WARNING: this exports DECRYPTED provider credentials in plaintext",
|
||||
"confirmBody": "This command decrypts and prints/writes apiKey, accessToken, refreshToken, and\nidToken for the selected connection(s). Treat the output as a secret.",
|
||||
"confirmFooter": "To confirm, run:\n omniroute auth export --force",
|
||||
"missingKey": "STORAGE_ENCRYPTION_KEY is required to export credentials.",
|
||||
"notFound": "Connection not found: {id}",
|
||||
"invalidFormat": "Invalid format: {format}. Use json or env."
|
||||
},
|
||||
"stream": {
|
||||
"description": "Stream a chat response with SSE inspection modes",
|
||||
"file": "Read prompt from file",
|
||||
|
||||
@@ -132,6 +132,20 @@
|
||||
"listTitle": "Chaves que expiram nos próximos {days} dias:"
|
||||
}
|
||||
},
|
||||
"authExport": {
|
||||
"description": "Exportar credenciais DESCRIPTOGRAFADAS de provedores (somente local, saída em texto puro)",
|
||||
"idOpt": "Exportar apenas a conexão correspondente a este id/nome/provedor",
|
||||
"formatOpt": "Formato de saída: json ou env",
|
||||
"outOpt": "Gravar a saída em um arquivo em vez do stdout (gravado com permissão 0600)",
|
||||
"forceOpt": "Confirma que você entende que isso imprime/grava segredos em texto puro",
|
||||
"warning": "⚠ Isso imprime/grava chaves de API e tokens OAuth DESCRIPTOGRAFADOS em texto puro. Garanta que sua tela, o histórico do shell e qualquer arquivo de saída permaneçam privados.",
|
||||
"confirmHeading": "⚠ AVISO: isso exporta credenciais de provedores DESCRIPTOGRAFADAS em texto puro",
|
||||
"confirmBody": "Este comando descriptografa e imprime/grava apiKey, accessToken, refreshToken e\nidToken da(s) conexão(ões) selecionada(s). Trate a saída como um segredo.",
|
||||
"confirmFooter": "Para confirmar, execute:\n omniroute auth export --force",
|
||||
"missingKey": "STORAGE_ENCRYPTION_KEY é obrigatório para exportar credenciais.",
|
||||
"notFound": "Conexão não encontrada: {id}",
|
||||
"invalidFormat": "Formato inválido: {format}. Use json ou env."
|
||||
},
|
||||
"stream": {
|
||||
"description": "Transmitir resposta de chat com modos de inspeção SSE",
|
||||
"file": "Ler prompt de arquivo",
|
||||
|
||||
@@ -29,16 +29,16 @@
|
||||
"setup": {
|
||||
"title": "OmniRoute 设置",
|
||||
"passwordPrompt": "管理员密码",
|
||||
"providerPrompt": "默认提供商（留空跳过）",
|
||||
"providerPrompt": "默认提供者（留空跳过）",
|
||||
"done": "设置完成",
|
||||
"passwordSet": "管理员密码已配置",
|
||||
"providerSet": "提供商已配置：{name}",
|
||||
"testingProvider": "正在测试提供商连接：{name}",
|
||||
"testPassed": "提供商测试通过",
|
||||
"testFailed": "提供商测试失败：{error}",
|
||||
"providerSet": "提供者已配置：{name}",
|
||||
"testingProvider": "正在测试提供者连接：{name}",
|
||||
"testPassed": "提供者测试通过",
|
||||
"testFailed": "提供者测试失败：{error}",
|
||||
"loginEnabled": "登录：已启用（密码已更新）",
|
||||
"loginDisabled": "登录：已禁用",
|
||||
"providerInfo": "提供商：{info}"
|
||||
"providerInfo": "提供者：{info}"
|
||||
},
|
||||
"doctor": {
|
||||
"title": "OmniRoute 诊断",
|
||||
@@ -52,29 +52,29 @@
|
||||
"warnings": "{count} 个警告 — 见上文。"
|
||||
},
|
||||
"providers": {
|
||||
"title": "提供商",
|
||||
"noProviders": "未配置提供商。运行：omniroute setup",
|
||||
"title": "提供者",
|
||||
"noProviders": "未配置提供者。运行：omniroute setup",
|
||||
"testing": "正在测试 {name}...",
|
||||
"available": "{count} 个提供商可用",
|
||||
"available": "{count} 个提供者可用",
|
||||
"connected": "已连接",
|
||||
"disconnected": "未连接",
|
||||
"validationFailed": "验证失败：{error}",
|
||||
"metrics": {
|
||||
"description": "显示提供商性能指标（延迟、成功率、成本）",
|
||||
"provider": "按提供商 ID 筛选",
|
||||
"description": "显示提供者性能指标（延迟、成功率、成本）",
|
||||
"provider": "按提供者 ID 筛选",
|
||||
"connection_id": "按连接 ID 筛选",
|
||||
"period": "时间范围：1h|6h|24h|7d|30d（默认：24h）",
|
||||
"metric": "关注特定指标字段",
|
||||
"sort": "按字段排序（降序）",
|
||||
"limit": "最大行数（默认：50）",
|
||||
"watch": "每 5 秒刷新（实时模式）",
|
||||
"compare": "逗号分隔的提供商 ID，并排比较"
|
||||
"compare": "逗号分隔的提供者 ID，并排比较"
|
||||
},
|
||||
"metric_single": {
|
||||
"description": "获取特定连接的单个指标值"
|
||||
},
|
||||
"rotate": {
|
||||
"description": "轮换提供商连接的上游 API 密钥",
|
||||
"description": "轮换提供者连接的上游 API 密钥",
|
||||
"newKeyOpt": "新 API 密钥值（避免使用：优先使用 --from-env）",
|
||||
"fromEnvOpt": "从环境变量 VAR 读取新密钥",
|
||||
"oauthOpt": "改为触发 OAuth 重新认证流程",
|
||||
@@ -89,18 +89,18 @@
|
||||
"testFailed": "轮换后测试失败：{error}"
|
||||
},
|
||||
"status": {
|
||||
"description": "显示所有提供商连接的密钥健康状态（期限、过期、冷却）",
|
||||
"providerOpt": "按提供商名称筛选",
|
||||
"header": "ID 提供商 名称 过期状态 测试状态 冷却至",
|
||||
"noData": "没有可用的提供商连接数据。",
|
||||
"description": "显示所有提供者连接的密钥健康状态（期限、过期、冷却）",
|
||||
"providerOpt": "按提供者名称筛选",
|
||||
"header": "ID 提供者 名称 过期状态 测试状态 冷却至",
|
||||
"noData": "没有可用的提供者连接数据。",
|
||||
"requiresServer": "providers status 需要 OmniRoute 服务器正在运行。"
|
||||
}
|
||||
},
|
||||
"keys": {
|
||||
"title": "API 密钥",
|
||||
"addDescription": "为提供商添加或更新 API 密钥",
|
||||
"addDescription": "为提供者添加或更新 API 密钥",
|
||||
"listDescription": "列出所有已配置的 API 密钥",
|
||||
"removeDescription": "移除提供商的 API 密钥",
|
||||
"removeDescription": "移除提供者的 API 密钥",
|
||||
"regenerateDescription": "重新生成 OmniRoute API 密钥",
|
||||
"revokeDescription": "撤销 OmniRoute API 密钥",
|
||||
"revealDescription": "显示未掩码的 API 密钥值",
|
||||
@@ -122,10 +122,10 @@
|
||||
"revoked": "密钥 {id} 已撤销。",
|
||||
"rotated": "密钥 {id} 已轮换。新密钥 ID：{newId}",
|
||||
"revealWarning": "⚠ 这将显示完整的未掩码密钥。请确保您的屏幕不被人看到。",
|
||||
"providerRequired": "需要提供商。",
|
||||
"providerRequired": "需要提供者。",
|
||||
"keyRequired": "需要 API 密钥。",
|
||||
"stdinEmpty": "未通过标准输入提供 API 密钥。",
|
||||
"unknownProvider": "未知提供商：{provider}",
|
||||
"unknownProvider": "未知提供者：{provider}",
|
||||
"policy": {
|
||||
"title": "密钥策略",
|
||||
"showDescription": "显示密钥的速率/成本策略",
|
||||
@@ -165,7 +165,7 @@
|
||||
"analytics": {
|
||||
"description": "显示汇总使用分析",
|
||||
"period": "时间范围：1d|7d|30d|90d|ytd|all（默认：30d）",
|
||||
"provider": "按提供商 ID 筛选"
|
||||
"provider": "按提供者 ID 筛选"
|
||||
},
|
||||
"budget": {
|
||||
"description": "管理成本预算",
|
||||
@@ -175,8 +175,8 @@
|
||||
}
|
||||
},
|
||||
"quota": {
|
||||
"description": "显示提供商配额使用情况",
|
||||
"provider": "按提供商 ID 筛选",
|
||||
"description": "显示提供者配额使用情况",
|
||||
"provider": "按提供者 ID 筛选",
|
||||
"check": "显示新请求是否有可用配额"
|
||||
},
|
||||
"logs": {
|
||||
@@ -201,7 +201,7 @@
|
||||
}
|
||||
},
|
||||
"cost": {
|
||||
"description": "按提供商、模型、组合或 API 密钥显示成本报告",
|
||||
"description": "按提供者、模型、组合或 API 密钥显示成本报告",
|
||||
"period": "时间范围：1d|7d|30d|90d|ytd|all（默认：30d）",
|
||||
"since": "开始日期（ISO 格式，例如 2026-01-01）— 覆盖 --period",
|
||||
"until": "结束日期（ISO 格式）",
|
||||
@@ -210,7 +210,7 @@
|
||||
"limit": "显示的最大行数（默认：100）"
|
||||
},
|
||||
"simulate": {
|
||||
"description": "模拟路由（空运行）— 显示将选择哪些提供商而不调用上游",
|
||||
"description": "模拟路由（空运行）— 显示将选择哪些提供者而不调用上游",
|
||||
"file": "从 JSON 文件加载完整请求体",
|
||||
"model": "模型 ID（默认：auto）",
|
||||
"combo": "强制指定组合名称",
|
||||
@@ -301,7 +301,7 @@
|
||||
"cost": "成本（24h）："
|
||||
},
|
||||
"quota": {
|
||||
"description": "显示提供商配额使用情况",
|
||||
"description": "显示提供者配额使用情况",
|
||||
"noServer": "服务器未运行。启动：omniroute serve",
|
||||
"noData": "没有可用的配额信息。"
|
||||
},
|
||||
@@ -315,12 +315,12 @@
|
||||
"description": "一键启动本地 Redis 容器（Podman 或 Docker），用于 OmniRoute 缓存和配额跟踪"
|
||||
},
|
||||
"test": {
|
||||
"description": "测试提供商连接",
|
||||
"description": "测试提供者连接",
|
||||
"noServer": "服务器未运行。启动：omniroute serve",
|
||||
"testing": "正在测试 {provider} / {model}...",
|
||||
"passed": "连接成功！",
|
||||
"failed": "连接失败：{error}",
|
||||
"allProvidersOpt": "测试所有已配置的提供商",
|
||||
"allProvidersOpt": "测试所有已配置的提供者",
|
||||
"latencyOpt": "显示延迟测量值（平均/最小/最大 毫秒）",
|
||||
"repeatOpt": "重复测试 N 次并汇总结果",
|
||||
"compareOpt": "逗号分隔的要比较的模型（例如 gpt-4o,claude-3-5-sonnet）",
|
||||
@@ -328,7 +328,7 @@
|
||||
"saved": "结果已保存至 {path}",
|
||||
"compareTitle": "模型比较",
|
||||
"compareMinTwo": "--compare 需要至少两个模型（逗号分隔）",
|
||||
"noProviders": "未配置提供商。添加：omniroute keys add"
|
||||
"noProviders": "未配置提供者。添加：omniroute keys add"
|
||||
},
|
||||
"update": {
|
||||
"checking": "正在检查更新...",
|
||||
@@ -509,7 +509,7 @@
|
||||
},
|
||||
"models": {
|
||||
"description": "列出可用模型（需要服务器）",
|
||||
"search": "按 ID、名称、提供商或描述筛选模型",
|
||||
"search": "按 ID、名称、提供者或描述筛选模型",
|
||||
"noServer": "服务器未运行。启动：omniroute serve",
|
||||
"noModels": "未找到模型。"
|
||||
},
|
||||
@@ -656,25 +656,25 @@
|
||||
}
|
||||
},
|
||||
"oauth": {
|
||||
"description": "管理 OAuth 提供商连接",
|
||||
"description": "管理 OAuth 提供者连接",
|
||||
"providers": {
|
||||
"description": "列出支持 OAuth 的提供商及其流程类型"
|
||||
"description": "列出支持 OAuth 的提供者及其流程类型"
|
||||
},
|
||||
"start": {
|
||||
"description": "为提供商启动 OAuth 授权流程",
|
||||
"provider": "提供商 ID（gemini, copilot, cursor, ...）",
|
||||
"description": "为提供者启动 OAuth 授权流程",
|
||||
"provider": "提供者 ID（gemini, copilot, cursor, ...）",
|
||||
"no_browser": "仅打印 URL — 不打开浏览器",
|
||||
"import_system": "从本地系统配置自动导入凭据",
|
||||
"social": "社交登录提供商（google|github）— kiro 需要",
|
||||
"social": "社交登录提供者（google|github）— kiro 需要",
|
||||
"timeout": "等待授权超时时间（毫秒，默认：300000）"
|
||||
},
|
||||
"status": {
|
||||
"description": "列出活动的 OAuth 连接",
|
||||
"provider": "按提供商 ID 筛选"
|
||||
"provider": "按提供者 ID 筛选"
|
||||
},
|
||||
"revoke": {
|
||||
"description": "撤销 OAuth 连接",
|
||||
"provider": "要撤销的提供商 ID",
|
||||
"provider": "要撤销的提供者 ID",
|
||||
"connection_id": "按 ID 撤销特定连接",
|
||||
"yes": "跳过确认提示"
|
||||
}
|
||||
@@ -884,11 +884,11 @@
|
||||
"description": "管理模型定价数据",
|
||||
"sync": {
|
||||
"description": "从上游同步价格",
|
||||
"provider": "按提供商筛选",
|
||||
"provider": "按提供者筛选",
|
||||
"force": "强制重新同步"
|
||||
},
|
||||
"list": {
|
||||
"provider": "按提供商筛选",
|
||||
"provider": "按提供者筛选",
|
||||
"model": "按模型筛选",
|
||||
"limit": "最大结果数"
|
||||
},
|
||||
@@ -907,25 +907,25 @@
|
||||
"resilience": {
|
||||
"description": "检查和管理弹性机制",
|
||||
"status": {
|
||||
"provider": "按提供商筛选"
|
||||
"provider": "按提供者筛选"
|
||||
},
|
||||
"breakers": {
|
||||
"provider": "按提供商筛选"
|
||||
"provider": "按提供者筛选"
|
||||
},
|
||||
"cooldowns": {
|
||||
"provider": "按提供商筛选",
|
||||
"provider": "按提供者筛选",
|
||||
"connectionId": "按连接 ID 筛选"
|
||||
},
|
||||
"lockouts": {
|
||||
"provider": "按提供商筛选",
|
||||
"provider": "按提供者筛选",
|
||||
"model": "按模型筛选"
|
||||
},
|
||||
"reset": {
|
||||
"description": "重置断路器/冷却状态",
|
||||
"provider": "要重置的提供商",
|
||||
"provider": "要重置的提供者",
|
||||
"connectionId": "要重置的连接 ID",
|
||||
"model": "要重置锁定状态的模型",
|
||||
"allCooldowns": "重置提供商的所有冷却",
|
||||
"allCooldowns": "重置提供者的所有冷却",
|
||||
"yes": "跳过确认"
|
||||
},
|
||||
"profile": {
|
||||
@@ -940,13 +940,13 @@
|
||||
}
|
||||
},
|
||||
"nodes": {
|
||||
"description": "管理提供商节点（端点）",
|
||||
"description": "管理提供者节点（端点）",
|
||||
"list": {
|
||||
"provider": "按提供商筛选",
|
||||
"provider": "按提供者筛选",
|
||||
"enabled": "仅显示已启用的节点"
|
||||
},
|
||||
"add": {
|
||||
"provider": "提供商名称",
|
||||
"provider": "提供者名称",
|
||||
"baseUrl": "节点的基础 URL",
|
||||
"name": "节点名称",
|
||||
"weight": "负载均衡权重",
|
||||
@@ -965,7 +965,7 @@
|
||||
},
|
||||
"validate": {
|
||||
"baseUrl": "要验证的 URL",
|
||||
"provider": "要验证的提供商"
|
||||
"provider": "要验证的提供者"
|
||||
},
|
||||
"test": {
|
||||
"description": "向节点发送测试请求"
|
||||
@@ -1091,7 +1091,7 @@
|
||||
"oneproxy": {
|
||||
"description": "管理 OneProxy 上游代理池",
|
||||
"stats": {
|
||||
"provider": "按提供商筛选",
|
||||
"provider": "按提供者筛选",
|
||||
"period": "时间范围（默认：24h）"
|
||||
},
|
||||
"fetch": {
|
||||
@@ -1101,14 +1101,14 @@
|
||||
},
|
||||
"rotate": {
|
||||
"description": "强制轮换代理",
|
||||
"provider": "要轮换的提供商",
|
||||
"provider": "要轮换的提供者",
|
||||
"connectionId": "要轮换的特定连接 ID"
|
||||
},
|
||||
"config": {
|
||||
"description": "显示或更新 OneProxy 配置",
|
||||
"enabled": "启用代理池（true|false）",
|
||||
"poolSize": "池大小",
|
||||
"providerSource": "代理提供商的 URL",
|
||||
"providerSource": "代理提供者的 URL",
|
||||
"rotationPolicy": "轮换策略：sticky|per-request|periodic"
|
||||
},
|
||||
"pool": {
|
||||
@@ -1201,7 +1201,7 @@
|
||||
"bash": "打印 bash 补全脚本",
|
||||
"fish": "打印 fish 补全脚本",
|
||||
"install": "为检测到的 Shell 全局安装补全脚本",
|
||||
"refresh": "刷新组合/提供商/模型缓存"
|
||||
"refresh": "刷新组合/提供者/模型缓存"
|
||||
},
|
||||
"logs": {
|
||||
"description": "流式传输或导出请求日志",
|
||||
|
||||
@@ -29,16 +29,16 @@
|
||||
"setup": {
|
||||
"title": "OmniRoute 設定",
|
||||
"passwordPrompt": "管理員密碼",
|
||||
"providerPrompt": "預設提供商（留空跳過）",
|
||||
"providerPrompt": "預設提供者（留空跳過）",
|
||||
"done": "設定完成",
|
||||
"passwordSet": "管理員密碼已配置",
|
||||
"providerSet": "提供商已配置：{name}",
|
||||
"testingProvider": "正在測試提供商連線：{name}",
|
||||
"testPassed": "提供商測試通過",
|
||||
"testFailed": "提供商測試失敗：{error}",
|
||||
"providerSet": "提供者已配置：{name}",
|
||||
"testingProvider": "正在測試提供者連線：{name}",
|
||||
"testPassed": "提供者測試通過",
|
||||
"testFailed": "提供者測試失敗：{error}",
|
||||
"loginEnabled": "登入：已啟用（密碼已更新）",
|
||||
"loginDisabled": "登入：已停用",
|
||||
"providerInfo": "提供商：{info}"
|
||||
"providerInfo": "提供者：{info}"
|
||||
},
|
||||
"doctor": {
|
||||
"title": "OmniRoute 診斷",
|
||||
@@ -52,29 +52,29 @@
|
||||
"warnings": "{count} 個警告 — 見上文。"
|
||||
},
|
||||
"providers": {
|
||||
"title": "提供商",
|
||||
"noProviders": "未配置提供商。執行：omniroute setup",
|
||||
"title": "提供者",
|
||||
"noProviders": "未配置提供者。執行：omniroute setup",
|
||||
"testing": "正在測試 {name}...",
|
||||
"available": "{count} 個提供商可用",
|
||||
"available": "{count} 個提供者可用",
|
||||
"connected": "已連線",
|
||||
"disconnected": "未連線",
|
||||
"validationFailed": "驗證失敗：{error}",
|
||||
"metrics": {
|
||||
"description": "顯示提供商效能指標（延遲、成功率、成本）",
|
||||
"provider": "按提供商 ID 篩選",
|
||||
"description": "顯示提供者效能指標（延遲、成功率、成本）",
|
||||
"provider": "按提供者 ID 篩選",
|
||||
"connection_id": "按連線 ID 篩選",
|
||||
"period": "時間範圍：1h|6h|24h|7d|30d（預設：24h）",
|
||||
"metric": "關注特定指標欄位",
|
||||
"sort": "按欄位排序（降序）",
|
||||
"limit": "最大行數（預設：50）",
|
||||
"watch": "每 5 秒重新整理（即時模式）",
|
||||
"compare": "逗號分隔的提供商 ID，並排比較"
|
||||
"compare": "逗號分隔的提供者 ID，並排比較"
|
||||
},
|
||||
"metric_single": {
|
||||
"description": "獲取特定連線的單個指標值"
|
||||
},
|
||||
"rotate": {
|
||||
"description": "輪換提供商連線的上游 API 金鑰",
|
||||
"description": "輪換提供者連線的上游 API 金鑰",
|
||||
"newKeyOpt": "新 API 金鑰值（避免使用：優先使用 --from-env）",
|
||||
"fromEnvOpt": "從環境變數 VAR 讀取新金鑰",
|
||||
"oauthOpt": "改為觸發 OAuth 重新認證流程",
|
||||
@@ -89,18 +89,18 @@
|
||||
"testFailed": "輪換後測試失敗：{error}"
|
||||
},
|
||||
"status": {
|
||||
"description": "顯示所有提供商連線的金鑰健康狀態（期限、過期、冷卻）",
|
||||
"providerOpt": "按提供商名稱篩選",
|
||||
"header": "ID 提供商 名稱 過期狀態 測試狀態 冷卻至",
|
||||
"noData": "沒有可用的提供商連線資料。",
|
||||
"description": "顯示所有提供者連線的金鑰健康狀態（期限、過期、冷卻）",
|
||||
"providerOpt": "按提供者名稱篩選",
|
||||
"header": "ID 提供者 名稱 過期狀態 測試狀態 冷卻至",
|
||||
"noData": "沒有可用的提供者連線資料。",
|
||||
"requiresServer": "providers status 需要 OmniRoute 伺服器正在執行。"
|
||||
}
|
||||
},
|
||||
"keys": {
|
||||
"title": "API 金鑰",
|
||||
"addDescription": "為提供商新增或更新 API 金鑰",
|
||||
"addDescription": "為提供者新增或更新 API 金鑰",
|
||||
"listDescription": "列出所有已配置的 API 金鑰",
|
||||
"removeDescription": "移除提供商的 API 金鑰",
|
||||
"removeDescription": "移除提供者的 API 金鑰",
|
||||
"regenerateDescription": "重新生成 OmniRoute API 金鑰",
|
||||
"revokeDescription": "撤銷 OmniRoute API 金鑰",
|
||||
"revealDescription": "顯示未掩碼的 API 金鑰值",
|
||||
@@ -122,10 +122,10 @@
|
||||
"revoked": "金鑰 {id} 已撤銷。",
|
||||
"rotated": "金鑰 {id} 已輪換。新金鑰 ID：{newId}",
|
||||
"revealWarning": "⚠ 這將顯示完整的未掩碼金鑰。請確保您的螢幕不被人看到。",
|
||||
"providerRequired": "需要提供商。",
|
||||
"providerRequired": "需要提供者。",
|
||||
"keyRequired": "需要 API 金鑰。",
|
||||
"stdinEmpty": "未通過標準輸入提供 API 金鑰。",
|
||||
"unknownProvider": "未知提供商：{provider}",
|
||||
"unknownProvider": "未知提供者：{provider}",
|
||||
"policy": {
|
||||
"title": "金鑰策略",
|
||||
"showDescription": "顯示金鑰的速率/成本策略",
|
||||
@@ -151,7 +151,7 @@
|
||||
"model": "模型 ID（預設：auto）",
|
||||
"system": "系統提示",
|
||||
"combo": "強制指定組合名稱",
|
||||
"max_tokens": "響應最大令牌數",
|
||||
"max_tokens": "響應最大權杖數",
|
||||
"responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
|
||||
"raw": "列印接收到的原始 SSE 行",
|
||||
"debug": "在 stderr 中列印每塊的時間資訊",
|
||||
@@ -165,7 +165,7 @@
|
||||
"analytics": {
|
||||
"description": "顯示彙總使用分析",
|
||||
"period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
|
||||
"provider": "按提供商 ID 篩選"
|
||||
"provider": "按提供者 ID 篩選"
|
||||
},
|
||||
"budget": {
|
||||
"description": "管理成本預算",
|
||||
@@ -175,8 +175,8 @@
|
||||
}
|
||||
},
|
||||
"quota": {
|
||||
"description": "顯示提供商配額使用情況",
|
||||
"provider": "按提供商 ID 篩選",
|
||||
"description": "顯示提供者配額使用情況",
|
||||
"provider": "按提供者 ID 篩選",
|
||||
"check": "顯示新請求是否有可用配額"
|
||||
},
|
||||
"logs": {
|
||||
@@ -201,7 +201,7 @@
|
||||
}
|
||||
},
|
||||
"cost": {
|
||||
"description": "按提供商、模型、組合或 API 金鑰顯示成本報告",
|
||||
"description": "按提供者、模型、組合或 API 金鑰顯示成本報告",
|
||||
"period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
|
||||
"since": "開始日期（ISO 格式，例如 2026-01-01）— 覆蓋 --period",
|
||||
"until": "結束日期（ISO 格式）",
|
||||
@@ -210,12 +210,12 @@
|
||||
"limit": "顯示的最大行數（預設：100）"
|
||||
},
|
||||
"simulate": {
|
||||
"description": "模擬路由（空執行）— 顯示將選擇哪些提供商而不呼叫上游",
|
||||
"description": "模擬路由（空執行）— 顯示將選擇哪些提供者而不呼叫上游",
|
||||
"file": "從 JSON 檔案載入完整請求體",
|
||||
"model": "模型 ID（預設：auto）",
|
||||
"combo": "強制指定組合名稱",
|
||||
"reasoning": "推理努力級別（low|medium|high）",
|
||||
"thinking": "擴充套件思維令牌預算",
|
||||
"thinking": "擴充套件思維權杖預算",
|
||||
"explain": "在 stderr 中列印回退樹和成本範圍",
|
||||
"noCombo": "未找到匹配的組合。使用以下命令配置：omniroute combo create"
|
||||
},
|
||||
@@ -225,11 +225,11 @@
|
||||
"stdin": "從標準輸入讀取提示",
|
||||
"system": "系統提示",
|
||||
"model": "模型 ID（預設：auto）",
|
||||
"max_tokens": "響應最大令牌數",
|
||||
"max_tokens": "響應最大權杖數",
|
||||
"temperature": "取樣溫度（0–2）",
|
||||
"top_p": "Top-p 核取樣",
|
||||
"reasoning_effort": "推理努力級別（low|medium|high）",
|
||||
"thinking_budget": "擴充套件思維令牌預算",
|
||||
"thinking_budget": "擴充套件思維權杖預算",
|
||||
"combo": "強制指定組合名稱",
|
||||
"responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
|
||||
"stream": "增量流式傳輸響應",
|
||||
@@ -301,7 +301,7 @@
|
||||
"cost": "成本（24h）："
|
||||
},
|
||||
"quota": {
|
||||
"description": "顯示提供商配額使用情況",
|
||||
"description": "顯示提供者配額使用情況",
|
||||
"noServer": "伺服器未執行。啟動：omniroute serve",
|
||||
"noData": "沒有可用的配額資訊。"
|
||||
},
|
||||
@@ -315,12 +315,12 @@
|
||||
"description": "一鍵啟動本地 Redis 容器（Podman 或 Docker），用於 OmniRoute 快取和配額跟蹤"
|
||||
},
|
||||
"test": {
|
||||
"description": "測試提供商連線",
|
||||
"description": "測試提供者連線",
|
||||
"noServer": "伺服器未執行。啟動：omniroute serve",
|
||||
"testing": "正在測試 {provider} / {model}...",
|
||||
"passed": "連線成功！",
|
||||
"failed": "連線失敗：{error}",
|
||||
"allProvidersOpt": "測試所有已配置的提供商",
|
||||
"allProvidersOpt": "測試所有已配置的提供者",
|
||||
"latencyOpt": "顯示延遲測量值（平均/最小/最大 毫秒）",
|
||||
"repeatOpt": "重複測試 N 次並彙總結果",
|
||||
"compareOpt": "逗號分隔的要比較的模型（例如 gpt-4o,claude-3-5-sonnet）",
|
||||
@@ -328,7 +328,7 @@
|
||||
"saved": "結果已儲存至 {path}",
|
||||
"compareTitle": "模型比較",
|
||||
"compareMinTwo": "--compare 需要至少兩個模型（逗號分隔）",
|
||||
"noProviders": "未配置提供商。新增：omniroute keys add"
|
||||
"noProviders": "未配置提供者。新增：omniroute keys add"
|
||||
},
|
||||
"update": {
|
||||
"checking": "正在檢查更新...",
|
||||
@@ -445,7 +445,7 @@
|
||||
"description": "配置壓縮設定",
|
||||
"engine": "壓縮引擎（caveman|rtk|hybrid|none）",
|
||||
"caveman_agg": "Caveman 激程序度 0.0–1.0",
|
||||
"rtk_budget": "RTK 令牌預算",
|
||||
"rtk_budget": "RTK 權杖預算",
|
||||
"language_pack": "要啟用的語言包"
|
||||
},
|
||||
"engine": {
|
||||
@@ -509,7 +509,7 @@
|
||||
},
|
||||
"models": {
|
||||
"description": "列出可用模型（需要伺服器）",
|
||||
"search": "按 ID、名稱、提供商或描述篩選模型",
|
||||
"search": "按 ID、名稱、提供者或描述篩選模型",
|
||||
"noServer": "伺服器未執行。啟動：omniroute serve",
|
||||
"noModels": "未找到模型。"
|
||||
},
|
||||
@@ -621,7 +621,7 @@
|
||||
"type": "按記憶型別篩選（user|feedback|project|reference）",
|
||||
"limit": "最大結果數（預設：20）",
|
||||
"api_key": "按 API 金鑰篩選",
|
||||
"token_budget": "限制結果中的總令牌數"
|
||||
"token_budget": "限制結果中的總權杖數"
|
||||
},
|
||||
"add": {
|
||||
"description": "新增新的記憶條目",
|
||||
@@ -656,25 +656,25 @@
|
||||
}
|
||||
},
|
||||
"oauth": {
|
||||
"description": "管理 OAuth 提供商連線",
|
||||
"description": "管理 OAuth 提供者連線",
|
||||
"providers": {
|
||||
"description": "列出支援 OAuth 的提供商及其流程型別"
|
||||
"description": "列出支援 OAuth 的提供者及其流程型別"
|
||||
},
|
||||
"start": {
|
||||
"description": "為提供商啟動 OAuth 授權流程",
|
||||
"provider": "提供商 ID（gemini, copilot, cursor, ...）",
|
||||
"description": "為提供者啟動 OAuth 授權流程",
|
||||
"provider": "提供者 ID（gemini, copilot, cursor, ...）",
|
||||
"no_browser": "僅列印 URL — 不開啟瀏覽器",
|
||||
"import_system": "從本地系統配置自動匯入憑據",
|
||||
"social": "社交登入提供商（google|github）— kiro 需要",
|
||||
"social": "社交登入提供者（google|github）— kiro 需要",
|
||||
"timeout": "等待授權超時時間（毫秒，預設：300000）"
|
||||
},
|
||||
"status": {
|
||||
"description": "列出活動的 OAuth 連線",
|
||||
"provider": "按提供商 ID 篩選"
|
||||
"provider": "按提供者 ID 篩選"
|
||||
},
|
||||
"revoke": {
|
||||
"description": "撤銷 OAuth 連線",
|
||||
"provider": "要撤銷的提供商 ID",
|
||||
"provider": "要撤銷的提供者 ID",
|
||||
"connection_id": "按 ID 撤銷特定連線",
|
||||
"yes": "跳過確認提示"
|
||||
}
|
||||
@@ -884,20 +884,20 @@
|
||||
"description": "管理模型定價資料",
|
||||
"sync": {
|
||||
"description": "從上游同步價格",
|
||||
"provider": "按提供商篩選",
|
||||
"provider": "按提供者篩選",
|
||||
"force": "強制重新同步"
|
||||
},
|
||||
"list": {
|
||||
"provider": "按提供商篩選",
|
||||
"provider": "按提供者篩選",
|
||||
"model": "按模型篩選",
|
||||
"limit": "最大結果數"
|
||||
},
|
||||
"defaults": {
|
||||
"description": "管理預設定價",
|
||||
"input": "每 1M 令牌的輸入成本（美元）",
|
||||
"output": "每 1M 令牌的輸出成本（美元）",
|
||||
"cacheRead": "每 1M 令牌的快取讀取成本（美元）",
|
||||
"cacheWrite": "每 1M 令牌的快取寫入成本（美元）"
|
||||
"input": "每 1M 權杖的輸入成本（美元）",
|
||||
"output": "每 1M 權杖的輸出成本（美元）",
|
||||
"cacheRead": "每 1M 權杖的快取讀取成本（美元）",
|
||||
"cacheWrite": "每 1M 權杖的快取寫入成本（美元）"
|
||||
},
|
||||
"diff": {
|
||||
"description": "顯示與上游價格的差異",
|
||||
@@ -907,25 +907,25 @@
|
||||
"resilience": {
|
||||
"description": "檢查和管理彈性機制",
|
||||
"status": {
|
||||
"provider": "按提供商篩選"
|
||||
"provider": "按提供者篩選"
|
||||
},
|
||||
"breakers": {
|
||||
"provider": "按提供商篩選"
|
||||
"provider": "按提供者篩選"
|
||||
},
|
||||
"cooldowns": {
|
||||
"provider": "按提供商篩選",
|
||||
"provider": "按提供者篩選",
|
||||
"connectionId": "按連線 ID 篩選"
|
||||
},
|
||||
"lockouts": {
|
||||
"provider": "按提供商篩選",
|
||||
"provider": "按提供者篩選",
|
||||
"model": "按模型篩選"
|
||||
},
|
||||
"reset": {
|
||||
"description": "重置斷路器/冷卻狀態",
|
||||
"provider": "要重置的提供商",
|
||||
"provider": "要重置的提供者",
|
||||
"connectionId": "要重置的連線 ID",
|
||||
"model": "要重置鎖定狀態的模型",
|
||||
"allCooldowns": "重置提供商的所有冷卻",
|
||||
"allCooldowns": "重置提供者的所有冷卻",
|
||||
"yes": "跳過確認"
|
||||
},
|
||||
"profile": {
|
||||
@@ -940,13 +940,13 @@
|
||||
}
|
||||
},
|
||||
"nodes": {
|
||||
"description": "管理提供商節點（端點）",
|
||||
"description": "管理提供者節點（端點）",
|
||||
"list": {
|
||||
"provider": "按提供商篩選",
|
||||
"provider": "按提供者篩選",
|
||||
"enabled": "僅顯示已啟用的節點"
|
||||
},
|
||||
"add": {
|
||||
"provider": "提供商名稱",
|
||||
"provider": "提供者名稱",
|
||||
"baseUrl": "節點的基礎 URL",
|
||||
"name": "節點名稱",
|
||||
"weight": "負載均衡權重",
|
||||
@@ -965,7 +965,7 @@
|
||||
},
|
||||
"validate": {
|
||||
"baseUrl": "要驗證的 URL",
|
||||
"provider": "要驗證的提供商"
|
||||
"provider": "要驗證的提供者"
|
||||
},
|
||||
"test": {
|
||||
"description": "向節點發送測試請求"
|
||||
@@ -993,7 +993,7 @@
|
||||
"description": "管理 RTK 上下文最佳化器",
|
||||
"config": {
|
||||
"description": "顯示或更新 RTK 配置",
|
||||
"tokenBudget": "RTK 令牌預算",
|
||||
"tokenBudget": "RTK 權杖預算",
|
||||
"reservePct": "保留百分比"
|
||||
},
|
||||
"filters": {
|
||||
@@ -1091,7 +1091,7 @@
|
||||
"oneproxy": {
|
||||
"description": "管理 OneProxy 上游代理池",
|
||||
"stats": {
|
||||
"provider": "按提供商篩選",
|
||||
"provider": "按提供者篩選",
|
||||
"period": "時間範圍（預設：24h）"
|
||||
},
|
||||
"fetch": {
|
||||
@@ -1101,14 +1101,14 @@
|
||||
},
|
||||
"rotate": {
|
||||
"description": "強制輪換代理",
|
||||
"provider": "要輪換的提供商",
|
||||
"provider": "要輪換的提供者",
|
||||
"connectionId": "要輪換的特定連線 ID"
|
||||
},
|
||||
"config": {
|
||||
"description": "顯示或更新 OneProxy 配置",
|
||||
"enabled": "啟用代理池（true|false）",
|
||||
"poolSize": "池大小",
|
||||
"providerSource": "代理提供商的 URL",
|
||||
"providerSource": "代理提供者的 URL",
|
||||
"rotationPolicy": "輪換策略：sticky|per-request|periodic"
|
||||
},
|
||||
"pool": {
|
||||
@@ -1163,11 +1163,11 @@
|
||||
"fromCloud": "從雲備份初始化"
|
||||
},
|
||||
"tokens": {
|
||||
"description": "管理同步令牌",
|
||||
"description": "管理同步權杖",
|
||||
"create": {
|
||||
"name": "令牌名稱",
|
||||
"scope": "令牌作用域",
|
||||
"ttl": "令牌有效期（例如 30d）"
|
||||
"name": "權杖名稱",
|
||||
"scope": "權杖作用域",
|
||||
"ttl": "權杖有效期（例如 30d）"
|
||||
},
|
||||
"revoke": {
|
||||
"yes": "跳過確認"
|
||||
@@ -1201,7 +1201,7 @@
|
||||
"bash": "列印 bash 補全指令碼",
|
||||
"fish": "列印 fish 補全指令碼",
|
||||
"install": "為檢測到的 Shell 全域性安裝補全指令碼",
|
||||
"refresh": "重新整理組合/提供商/模型快取"
|
||||
"refresh": "重新整理組合/提供者/模型快取"
|
||||
},
|
||||
"logs": {
|
||||
"description": "流式傳輸或匯出請求日誌",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { spawn } from "node:child_process";
|
||||
import { dirname } from "node:path";
|
||||
import { writePidFile, cleanupPidFile, killAllSubprocesses } from "../utils/pid.mjs";
|
||||
import { writePidFile, cleanupPidFile, killAllSubprocesses, isPidRunning } from "../utils/pid.mjs";
|
||||
import {
|
||||
RESTART_RESET_MS,
|
||||
DEFAULT_MAX_RESTARTS,
|
||||
@@ -9,11 +9,22 @@ import {
|
||||
waitUntilPortFree,
|
||||
} from "./supervisorPolicy.mjs";
|
||||
import { buildNodeHeapArgs } from "../../../scripts/build/runtime-env.mjs";
|
||||
import { stopProcessGracefully } from "../../../src/shared/platform/windowsProcess.ts";
|
||||
import {
|
||||
isFatalInstrumentationHookFailure,
|
||||
formatAndroidInstrumentationFailureHint,
|
||||
} from "../utils/ensureAndroidCacheDir.mjs";
|
||||
|
||||
const CRASH_LOG_LINES = 50;
|
||||
|
||||
export class ServerSupervisor {
|
||||
constructor({ serverPath, env, maxRestarts = DEFAULT_MAX_RESTARTS, memoryLimit = 512, onCrashCallback }) {
|
||||
constructor({
|
||||
serverPath,
|
||||
env,
|
||||
maxRestarts = DEFAULT_MAX_RESTARTS,
|
||||
memoryLimit = 512,
|
||||
onCrashCallback,
|
||||
}) {
|
||||
this.serverPath = serverPath;
|
||||
this.env = env;
|
||||
this.maxRestarts = maxRestarts;
|
||||
@@ -24,11 +35,13 @@ export class ServerSupervisor {
|
||||
this.crashLog = [];
|
||||
this.child = null;
|
||||
this.isShuttingDown = false;
|
||||
this.instrumentationFailureHintPrinted = false;
|
||||
}
|
||||
|
||||
start() {
|
||||
this.startedAt = Date.now();
|
||||
this.crashLog = [];
|
||||
this.instrumentationFailureHintPrinted = false;
|
||||
|
||||
const showLog = process.env.OMNIROUTE_SHOW_LOG === "1";
|
||||
// #5238: skip the explicit CLI --max-old-space-size when the user pinned the
|
||||
@@ -40,20 +53,35 @@ export class ServerSupervisor {
|
||||
// silently, so a boot that never becomes ready looked like a dead hang with zero
|
||||
// output even at APP_LOG_LEVEL=debug. Pipe stdout too and buffer it alongside
|
||||
// stderr so a readiness timeout can surface what the child actually printed.
|
||||
this.child = spawn("node", [...heapArgs, this.serverPath], {
|
||||
cwd: dirname(this.serverPath),
|
||||
env: this.env,
|
||||
stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
|
||||
});
|
||||
this.child = spawn(
|
||||
process.versions.bun ? process.execPath : "node",
|
||||
[...(process.versions.bun ? [] : heapArgs), this.serverPath],
|
||||
{
|
||||
cwd: dirname(this.serverPath),
|
||||
env: this.env,
|
||||
stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
|
||||
}
|
||||
);
|
||||
|
||||
writePidFile("server", this.child.pid);
|
||||
|
||||
const bufferOutput = (data) => {
|
||||
const lines = data.toString().split("\n").filter(Boolean);
|
||||
const text = data.toString();
|
||||
const lines = text.split("\n").filter(Boolean);
|
||||
this.crashLog.push(...lines);
|
||||
if (this.crashLog.length > CRASH_LOG_LINES) {
|
||||
this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
|
||||
}
|
||||
// Surface Android/Termux instrumentation-hook failures even when --log is
|
||||
// off (output is only buffered otherwise).
|
||||
if (!this.instrumentationFailureHintPrinted && isFatalInstrumentationHookFailure(text)) {
|
||||
this.instrumentationFailureHintPrinted = true;
|
||||
process.stderr.write(
|
||||
formatAndroidInstrumentationFailureHint(
|
||||
this.env?.XDG_CACHE_HOME || process.env.XDG_CACHE_HOME
|
||||
)
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
if (this.child.stdout) {
|
||||
@@ -69,12 +97,32 @@ export class ServerSupervisor {
|
||||
return this.child;
|
||||
}
|
||||
|
||||
handleExit(code) {
|
||||
handleExit(code, err) {
|
||||
// Node.js v24+ requires process.exit() to receive a number. Spawn-error events
|
||||
// deliver err.code (a string like 'ENOENT') via the 'error' listener; normalise here.
|
||||
const exitCode = typeof code === "number" ? code : null;
|
||||
cleanupPidFile("server");
|
||||
|
||||
// #8091: the child's spawn 'error' listener passes `err` through as a second
|
||||
// argument, but it used to be silently dropped — the user only ever saw the
|
||||
// hardcoded "code=-1" with a permanently empty crash log, with no way to
|
||||
// diagnose why the child never started (ENOENT/EACCES/bad path/etc.). Surface
|
||||
// the real reason immediately, both on the console and in the crash-log buffer
|
||||
// so `dumpCrashLog()` shows it too.
|
||||
if (err) {
|
||||
const detail = [
|
||||
err.code && `code=${err.code}`,
|
||||
err.syscall && `syscall=${err.syscall}`,
|
||||
err.path && `path=${err.path}`,
|
||||
err.message,
|
||||
]
|
||||
.filter(Boolean)
|
||||
.join(" ");
|
||||
const line = `⚠ Spawn error: ${detail || String(err)}`;
|
||||
console.error(line);
|
||||
this.crashLog.push(line);
|
||||
}
|
||||
|
||||
// #4425: only exit on an intentional shutdown. A spontaneous code-0 exit (e.g. a
|
||||
// systemd MemoryMax cgroup kill, which reports the process exited cleanly) is anomalous
|
||||
// and must be restarted, not treated as a graceful stop that leaves the gateway dead.
|
||||
@@ -132,14 +180,13 @@ export class ServerSupervisor {
|
||||
stop() {
|
||||
this.isShuttingDown = true;
|
||||
if (this.child?.pid) {
|
||||
try {
|
||||
process.kill(this.child.pid, "SIGTERM");
|
||||
} catch {}
|
||||
setTimeout(() => {
|
||||
try {
|
||||
process.kill(this.child.pid, "SIGKILL");
|
||||
} catch {}
|
||||
}, 5000);
|
||||
// #8045: on win32, process.kill(pid, "SIGTERM") unconditionally force-terminates
|
||||
// the target — it is never a real, interceptable signal there. The child already
|
||||
// receives the real CTRL_C_EVENT/CTRL_CLOSE_EVENT independently (it shares the
|
||||
// console) and runs its own async graceful shutdown (WAL checkpoint). Sending
|
||||
// SIGTERM immediately on win32 races and beats that cleanup. Fire-and-forget:
|
||||
// stop() itself stays sync so callers keep their existing control flow.
|
||||
void stopProcessGracefully({ pid: this.child.pid, timeoutMs: 5000, isPidRunning });
|
||||
}
|
||||
killAllSubprocesses();
|
||||
}
|
||||
|
||||
@@ -3,12 +3,85 @@ import { resolveDataDir, resolveStoragePath } from "./data-dir.mjs";
|
||||
import { ensureProviderSchema } from "./provider-store.mjs";
|
||||
import { ensureSettingsSchema, hashManagementPassword, updateSettings } from "./settings-store.mjs";
|
||||
|
||||
async function loadBetterSqlite() {
|
||||
try {
|
||||
return (await import("better-sqlite3")).default;
|
||||
} catch {
|
||||
throw new Error("better-sqlite3 is not installed. Run npm install before using setup.");
|
||||
async function loadSqlite() {
|
||||
if (process.versions.bun) {
|
||||
return { Database: (await import("bun:sqlite")).Database };
|
||||
}
|
||||
try {
|
||||
return { Database: (await import("better-sqlite3")).default };
|
||||
} catch (error) {
|
||||
return { error };
|
||||
}
|
||||
}
|
||||
|
||||
// #7586: unlike the real server (src/lib/db/adapters/driverFactory.ts::tryOpenSync),
|
||||
// this CLI helper historically had NO fallback beyond better-sqlite3 — so on any
|
||||
// machine where better-sqlite3's native binary is unavailable (Windows without a
|
||||
// prebuilt addon, etc.), every `omniroute doctor` DB check reported a false FAIL
|
||||
// even when the actual server was healthy via its own (correct) driver cascade.
|
||||
// Reuse that same cascade here instead of re-deriving it.
|
||||
async function openWithSyncDriverFallback(dbPath, options, importError) {
|
||||
try {
|
||||
const { tryOpenSync } = await import("../../src/lib/db/adapters/driverFactory.ts");
|
||||
const adapter = tryOpenSync(dbPath, options);
|
||||
if (adapter) {
|
||||
return adapter;
|
||||
}
|
||||
} catch {
|
||||
// fall through to the original better-sqlite3 error below
|
||||
}
|
||||
throw createSqliteNativeError(importError);
|
||||
}
|
||||
|
||||
function openBunSqlite(Database, dbPath, options) {
|
||||
const raw = new Database(dbPath, options);
|
||||
const prepare = (sql) => {
|
||||
const statement = raw.query(sql);
|
||||
return {
|
||||
run: (...params) => statement.run(...normalizeBunSqliteParams(params)),
|
||||
get: (...params) => statement.get(...normalizeBunSqliteParams(params)),
|
||||
all: (...params) => statement.all(...normalizeBunSqliteParams(params)),
|
||||
};
|
||||
};
|
||||
return {
|
||||
prepare,
|
||||
query: (sql) => raw.query(sql),
|
||||
exec: (sql) => raw.exec(sql),
|
||||
transaction: (fn) => raw.transaction(fn),
|
||||
close: () => raw.close(),
|
||||
serialize: () => raw.serialize(),
|
||||
pragma: (pragmaStr, pragmaOptions) => {
|
||||
const statement = raw.query(`PRAGMA ${pragmaStr}`);
|
||||
if (pragmaOptions?.simple) {
|
||||
const row = statement.get();
|
||||
return row ? (Object.values(row)[0] ?? null) : null;
|
||||
}
|
||||
return statement.all();
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export function normalizeBunSqliteParams(params) {
|
||||
if (
|
||||
params.length !== 1 ||
|
||||
params[0] === null ||
|
||||
typeof params[0] !== "object" ||
|
||||
Array.isArray(params[0]) ||
|
||||
params[0] instanceof Uint8Array ||
|
||||
(typeof Buffer !== "undefined" && Buffer.isBuffer(params[0]))
|
||||
) {
|
||||
return params;
|
||||
}
|
||||
const expanded = {};
|
||||
for (const [key, value] of Object.entries(params[0])) {
|
||||
if (/^[:@$]/.test(key)) expanded[key] = value;
|
||||
else {
|
||||
expanded[`@${key}`] = value;
|
||||
expanded[`:${key}`] = value;
|
||||
expanded[`$${key}`] = value;
|
||||
}
|
||||
}
|
||||
return [expanded];
|
||||
}
|
||||
|
||||
export function createSqliteNativeError(error) {
|
||||
@@ -21,13 +94,41 @@ export function createSqliteNativeError(error) {
|
||||
"(rebuilds into a user-writable runtime; works without a C++ toolchain)."
|
||||
);
|
||||
}
|
||||
if (
|
||||
message.includes("Could not locate the bindings file") ||
|
||||
message.includes("MODULE_NOT_FOUND") ||
|
||||
message.includes("Cannot find module 'better-sqlite3'")
|
||||
) {
|
||||
return new Error(
|
||||
"better-sqlite3 native binding could not be found (no prebuilt addon for this platform). " +
|
||||
"This is common under `npx`, which runs a fresh, ephemeral install that never built the addon. " +
|
||||
"Run: omniroute runtime repair " +
|
||||
"(rebuilds into a user-writable runtime; works without a C++ toolchain)."
|
||||
);
|
||||
}
|
||||
return error;
|
||||
}
|
||||
|
||||
async function openSqliteDatabase(dbPath, options = {}) {
|
||||
const Database = await loadBetterSqlite();
|
||||
const loaded = await loadSqlite();
|
||||
if (process.versions.bun) {
|
||||
if (options.fileMustExist && !fs.existsSync(dbPath)) {
|
||||
throw new Error(`SQLite file does not exist: ${dbPath}`);
|
||||
}
|
||||
const bunOptions = options.readonly
|
||||
? { readonly: true }
|
||||
: { readwrite: true, create: options.fileMustExist !== true };
|
||||
try {
|
||||
return openBunSqlite(loaded.Database, dbPath, bunOptions);
|
||||
} catch (error) {
|
||||
throw createSqliteNativeError(error);
|
||||
}
|
||||
}
|
||||
if (loaded.error) {
|
||||
return openWithSyncDriverFallback(dbPath, options, loaded.error);
|
||||
}
|
||||
try {
|
||||
return new Database(dbPath, options);
|
||||
return new loaded.Database(dbPath, options);
|
||||
} catch (error) {
|
||||
throw createSqliteNativeError(error);
|
||||
}
|
||||
@@ -59,7 +160,16 @@ export async function withReadonlySqlite(dbPath, callback) {
|
||||
export async function backupSqliteFile(sourcePath, destPath) {
|
||||
const db = await openSqliteDatabase(sourcePath, { readonly: true });
|
||||
try {
|
||||
await db.backup(destPath);
|
||||
if (typeof db.backup === "function") {
|
||||
await db.backup(destPath);
|
||||
} else if (sourcePath === ":memory:" && typeof db.serialize === "function") {
|
||||
fs.writeFileSync(destPath, Buffer.from(db.serialize()));
|
||||
} else {
|
||||
try {
|
||||
db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
|
||||
} catch {}
|
||||
fs.copyFileSync(sourcePath, destPath);
|
||||
}
|
||||
} finally {
|
||||
db.close();
|
||||
}
|
||||
|
||||
@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
|
||||
|
||||
const APP_LABEL = "com.omniroute.autostart";
|
||||
const WIN_REG_VALUE = "OmniRoute";
|
||||
const WIN_STARTUP_FILE = "OmniRoute.vbs";
|
||||
const LINUX_SERVICE_NAME = "omniroute.service";
|
||||
const LINUX_DESKTOP_NAME = "omniroute.desktop";
|
||||
|
||||
@@ -323,38 +324,101 @@ function isEnabledMac() {
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the absolute path to the Windows Startup folder
|
||||
* (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\),
|
||||
* or null when APPDATA is not set.
|
||||
*/
|
||||
function winStartupDir() {
|
||||
if (!process.env.APPDATA) return null;
|
||||
return join(process.env.APPDATA, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the full path to the VBS autostart script in the Startup folder,
|
||||
* or null when the Startup folder cannot be resolved.
|
||||
*/
|
||||
function winStartupPath() {
|
||||
const dir = winStartupDir();
|
||||
return dir ? join(dir, WIN_STARTUP_FILE) : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Builds the VBScript source that launches OmniRoute with WSH's Run method
|
||||
* using SW_HIDE (0) so no console window appears.
|
||||
*
|
||||
* 9Router uses the same pattern: a .vbs file in the Startup folder that calls
|
||||
* WScript.Shell.Run with window style 0 (hidden). This avoids the console
|
||||
* window flash that HKCU\Run causes for console-mode node.exe.
|
||||
*/
|
||||
function buildWinVbsContent(cliPath) {
|
||||
const execLine = buildServeExecLine(cliPath, { tray: true });
|
||||
// VBScript doubles `"` inside a string to escape them. The execLine already
|
||||
// contains quoted paths; escape each `"` to `""` so the VBS parser reads
|
||||
// them as literal quote characters in the command string passed to Run().
|
||||
const vbsSafe = execLine.replace(/"/g, '""');
|
||||
return [
|
||||
'Set WshShell = CreateObject("WScript.Shell")',
|
||||
`WshShell.Run "${vbsSafe}", 0, False`,
|
||||
"",
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
/**
|
||||
* Removes the legacy HKCU\Run registry value if present. Callers use this
|
||||
* during migration so stale Run entries don't linger after switching to the
|
||||
* VBS-based autostart.
|
||||
*/
|
||||
function cleanLegacyWinReg() {
|
||||
try {
|
||||
execSync(
|
||||
`reg delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /f 2>nul`,
|
||||
{ stdio: "ignore", windowsHide: true }
|
||||
);
|
||||
} catch {
|
||||
// entry did not exist or already removed — noop
|
||||
}
|
||||
}
|
||||
|
||||
function enableWin() {
|
||||
const cliPath = resolveCliPath();
|
||||
if (!cliPath) return false;
|
||||
const value = `"${process.execPath}" "${cliPath}" serve --tray --no-open`;
|
||||
try {
|
||||
execSync(
|
||||
`reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /t REG_SZ /d "${value}" /f`,
|
||||
{ stdio: "ignore", windowsHide: true }
|
||||
);
|
||||
return true;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
const vbsPath = winStartupPath();
|
||||
if (!vbsPath) return false;
|
||||
const dir = dirname(vbsPath);
|
||||
mkdirSync(dir, { recursive: true });
|
||||
writeFileSync(vbsPath, buildWinVbsContent(cliPath), { mode: 0o644 });
|
||||
// Migrate away from the legacy HKCU\Run entry — it launches node.exe with
|
||||
// a visible console window. The VBS approach is the replacement.
|
||||
cleanLegacyWinReg();
|
||||
return existsSync(vbsPath);
|
||||
}
|
||||
|
||||
function disableWin() {
|
||||
const vbsPath = winStartupPath();
|
||||
if (!vbsPath) return false;
|
||||
try {
|
||||
execSync(
|
||||
`reg delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /f`,
|
||||
{ stdio: "ignore", windowsHide: true }
|
||||
);
|
||||
return true;
|
||||
unlinkSync(vbsPath);
|
||||
} catch {
|
||||
return false;
|
||||
// already removed
|
||||
}
|
||||
// Also clean up any lingering legacy registry entry as a safety net.
|
||||
cleanLegacyWinReg();
|
||||
return !existsSync(vbsPath);
|
||||
}
|
||||
|
||||
function isEnabledWin() {
|
||||
const vbsPath = winStartupPath();
|
||||
if (!vbsPath) return false;
|
||||
// Primary check: VBS file exists in the Startup folder.
|
||||
if (existsSync(vbsPath)) return true;
|
||||
// Fallback check: legacy HKCU\Run entry (for users who enabled autostart
|
||||
// before the VBS migration). Treat it as enabled so the tray menu shows
|
||||
// the correct toggle state, and calling disable() will clean it up.
|
||||
try {
|
||||
const out = execSync(
|
||||
`reg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE}`,
|
||||
{ stdio: "pipe", windowsHide: true, encoding: "utf8" }
|
||||
{ stdio: "pipe", windowsHide: true, encoding: "utf8", timeout: 3000 }
|
||||
);
|
||||
return out.includes(WIN_REG_VALUE);
|
||||
} catch {
|
||||
|
||||
122
bin/cli/utils/ensureAndroidCacheDir.mjs
Normal file
122
bin/cli/utils/ensureAndroidCacheDir.mjs
Normal file
@@ -0,0 +1,122 @@
|
||||
/**
|
||||
* Next.js cache-dir prep for Android / Termux.
|
||||
*
|
||||
* Next.js `getCacheDirectory()` has no dedicated branch for
|
||||
* `process.platform === "android"`. On that path it only accepts a cache root
|
||||
* that *already* exists (`fs.existsSync` on `~/.cache` or a generic tmp dir).
|
||||
* If neither exists it prints `Unsupported platform: android` and exits — the
|
||||
* CLI can still look "running" while every request returns a bare HTTP 500
|
||||
* because the instrumentation hook never loads (and so neither does logging).
|
||||
*
|
||||
* Termux Node sometimes reports `platform === "android"` and sometimes
|
||||
* `"linux"` with Termux env signals (`TERMUX_VERSION` / `PREFIX`). Creating
|
||||
* `~/.cache` (and pointing `XDG_CACHE_HOME` at it when unset) makes the probe
|
||||
* succeed on both shapes.
|
||||
*
|
||||
* Call this *before* spawning or loading Next.js. Safe no-op on desktop
|
||||
* platforms that are not Termux.
|
||||
*/
|
||||
|
||||
import { existsSync, mkdirSync } from "node:fs";
|
||||
import { homedir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
|
||||
|
||||
/**
|
||||
* @param {string} [platform]
|
||||
* @param {NodeJS.ProcessEnv} [env]
|
||||
* @returns {boolean}
|
||||
*/
|
||||
export function needsAndroidCacheDirPrep(platform = process.platform, env = process.env) {
|
||||
return platform === "android" || isTermux(env);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {() => string} [homedirFn]
|
||||
* @param {NodeJS.ProcessEnv} [env]
|
||||
* @returns {string}
|
||||
*/
|
||||
export function resolveAndroidCacheDir(homedirFn = homedir, env = process.env) {
|
||||
if (typeof env.XDG_CACHE_HOME === "string" && env.XDG_CACHE_HOME.trim()) {
|
||||
return env.XDG_CACHE_HOME;
|
||||
}
|
||||
return join(homedirFn(), ".cache");
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure a writable cache directory exists for Next.js on Android/Termux.
|
||||
*
|
||||
* @param {object} [options]
|
||||
* @param {string} [options.platform]
|
||||
* @param {NodeJS.ProcessEnv} [options.env]
|
||||
* @param {() => string} [options.homedirFn]
|
||||
* @param {typeof mkdirSync} [options.mkdirSyncFn]
|
||||
* @param {typeof existsSync} [options.existsSyncFn]
|
||||
* @param {boolean} [options.setEnv] When true (default), set `XDG_CACHE_HOME` on `env`
|
||||
* if unset so child processes inherit a known-writable cache root.
|
||||
* @returns {{ prepared: boolean, cacheDir: string | null, created: boolean }}
|
||||
*/
|
||||
export function ensureAndroidCacheDir(options = {}) {
|
||||
const {
|
||||
platform = process.platform,
|
||||
env = process.env,
|
||||
homedirFn = homedir,
|
||||
mkdirSyncFn = mkdirSync,
|
||||
existsSyncFn = existsSync,
|
||||
setEnv = true,
|
||||
} = options;
|
||||
|
||||
if (!needsAndroidCacheDirPrep(platform, env)) {
|
||||
return { prepared: false, cacheDir: null, created: false };
|
||||
}
|
||||
|
||||
const cacheDir = resolveAndroidCacheDir(homedirFn, env);
|
||||
let created = false;
|
||||
if (!existsSyncFn(cacheDir)) {
|
||||
mkdirSyncFn(cacheDir, { recursive: true });
|
||||
created = true;
|
||||
}
|
||||
|
||||
if (setEnv && !(typeof env.XDG_CACHE_HOME === "string" && env.XDG_CACHE_HOME.trim())) {
|
||||
env.XDG_CACHE_HOME = cacheDir;
|
||||
}
|
||||
|
||||
return { prepared: true, cacheDir, created };
|
||||
}
|
||||
|
||||
/**
|
||||
* Detect Next.js instrumentation-hook failures that leave the server looking
|
||||
* "up" while requests get silent HTTP 500s (typical when the Android cache
|
||||
* probe failed before logging started).
|
||||
*
|
||||
* @param {string} text
|
||||
* @returns {boolean}
|
||||
*/
|
||||
export function isFatalInstrumentationHookFailure(text) {
|
||||
if (!text) return false;
|
||||
return (
|
||||
/Unsupported platform:\s*android/i.test(text) ||
|
||||
/error occurred while loading instrumentation hook/i.test(text)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Operator-facing hint when that instrumentation failure shows up in child
|
||||
* output — defense in depth if prep was skipped or a future Next.js probe
|
||||
* regresses.
|
||||
*
|
||||
* @param {string} [cacheDir]
|
||||
* @returns {string}
|
||||
*/
|
||||
export function formatAndroidInstrumentationFailureHint(cacheDir) {
|
||||
const dir = cacheDir || join(homedir(), ".cache");
|
||||
return (
|
||||
`\n\x1b[31m✖ Next.js instrumentation failed on Android/Termux (likely missing cache dir).\x1b[0m\n` +
|
||||
` OmniRoute tried to create a writable cache at:\n` +
|
||||
` \x1b[36m${dir}\x1b[0m\n` +
|
||||
` Manual workaround (survives reinstalls — do NOT patch dist/server.js):\n` +
|
||||
` \x1b[36mmkdir -p ~/.cache\x1b[0m\n` +
|
||||
` then restart: \x1b[36momniroute serve\x1b[0m\n` +
|
||||
` See: docs/guides/TERMUX_GUIDE.md → Troubleshooting → Unsupported platform: android\n`
|
||||
);
|
||||
}
|
||||
25
bin/cli/utils/versionFastPath.mjs
Normal file
25
bin/cli/utils/versionFastPath.mjs
Normal file
@@ -0,0 +1,25 @@
|
||||
/**
|
||||
* Decide whether a CLI invocation is a bare `--version`/`-V` query that should
|
||||
* short-circuit BEFORE the runtime polyfill import, env-file loading, and
|
||||
* Commander's command registration (~70 command modules) are loaded.
|
||||
*
|
||||
* Scope is intentionally narrow — only a single, unambiguous `--version`/`-V`
|
||||
* argument fast-paths. Anything else (extra args, a subcommand, `--help`,
|
||||
* global options like `--lang`/`--output` alongside it) falls through to the
|
||||
* normal Commander flow. Unlike `--version`, OmniRoute's `--help` output is
|
||||
* generated dynamically from every registered subcommand, so skipping
|
||||
* registration would change (truncate) the help text — that flag is
|
||||
* deliberately NOT fast-pathed here.
|
||||
*
|
||||
* Mirrors the intent of upstream 9router PR #2414 (fast-path help/version
|
||||
* before expensive self-heal hooks), adapted to OmniRoute's Commander-based
|
||||
* CLI where the equivalent expensive work is eager command registration
|
||||
* rather than npm-install-based runtime self-healing.
|
||||
*
|
||||
* @param {string[]} argv - process.argv (node + script + args).
|
||||
* @returns {boolean}
|
||||
*/
|
||||
export function isVersionFastPath(argv) {
|
||||
const args = Array.isArray(argv) ? argv.slice(2) : [];
|
||||
return args.length === 1 && (args[0] === "--version" || args[0] === "-V");
|
||||
}
|
||||
47
bin/cli/utils/winShellArgs.mjs
Normal file
47
bin/cli/utils/winShellArgs.mjs
Normal file
@@ -0,0 +1,47 @@
|
||||
/**
|
||||
* Argument escaping for child processes spawned with `shell: true` on Windows.
|
||||
*
|
||||
* The launchers (`omniroute launch`, `omniroute launch-codex`) must go through
|
||||
* cmd.exe on win32 because the target binaries are npm `.cmd` shims that Node
|
||||
* cannot exec directly (CVE-2024-27980). With `shell: true` Node joins argv with
|
||||
* plain spaces and no escaping at all (the DEP0190 warning), so anything with a
|
||||
* space, a quote or a cmd metacharacter reaches the child mangled.
|
||||
*/
|
||||
|
||||
/** cmd.exe metacharacters that stay live inside a quoted argument. */
|
||||
const WIN_META_CHARS = /([()\][%!^"`<>&|;, *?])/g;
|
||||
|
||||
/**
|
||||
* Escape one argument for a cmd.exe command line built by `shell: true`.
|
||||
*
|
||||
* Two layers, in order:
|
||||
* 1. the CRT argv rules the target binary parses (double the backslashes that
|
||||
* precede a quote, escape embedded quotes, wrap in quotes);
|
||||
* 2. cmd.exe's metacharacters, caret-escaped — applied TWICE because the
|
||||
* target is an npm `.cmd` shim that forwards `%*` to node, so the line is
|
||||
* parsed by cmd a second time. Single-escaping truncated any argument at
|
||||
* the first `&` or `|`. (Same rule as cross-spawn's doubleEscapeMetaChars.)
|
||||
*
|
||||
* @param {unknown} arg
|
||||
* @returns {string}
|
||||
*/
|
||||
export function escapeWindowsShellArg(arg) {
|
||||
const s = String(arg);
|
||||
if (s === "") return '""';
|
||||
let out = s.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1");
|
||||
out = `"${out}"`;
|
||||
return out.replace(WIN_META_CHARS, "^$1").replace(WIN_META_CHARS, "^$1");
|
||||
}
|
||||
|
||||
/**
|
||||
* Escape a whole argv for the `shell: true` path. Off Windows there is no shell,
|
||||
* so argv is passed through untouched.
|
||||
*
|
||||
* @param {string[]} args
|
||||
* @param {NodeJS.Platform|string} platform
|
||||
* @returns {string[]}
|
||||
*/
|
||||
export function quoteShellArgs(args, platform) {
|
||||
const list = [...(args ?? [])];
|
||||
return platform === "win32" ? list.map(escapeWindowsShellArg) : list;
|
||||
}
|
||||
@@ -4,6 +4,9 @@
|
||||
* OmniRoute CLI entry point.
|
||||
*
|
||||
* Special bypasses (handled before Commander):
|
||||
* --version / -V (alone) Fast-path: print the version and exit, skipping the
|
||||
* tsx/esm + polyfill imports, env-file loading, and
|
||||
* Commander's ~70-command registration entirely.
|
||||
* --mcp Start MCP server over stdio
|
||||
* reset-encrypted-columns Recovery tool for broken encrypted credentials
|
||||
* reset-password Reset the admin/management password
|
||||
@@ -11,7 +14,7 @@
|
||||
* All other commands are routed through Commander (bin/cli/program.mjs).
|
||||
*/
|
||||
|
||||
import { existsSync, readFileSync } from "node:fs";
|
||||
import { existsSync, readFileSync, writeFileSync } from "node:fs";
|
||||
import { join, dirname } from "node:path";
|
||||
import { fileURLToPath, pathToFileURL } from "node:url";
|
||||
import updateNotifier from "update-notifier";
|
||||
@@ -19,6 +22,26 @@ import { isNativeBinaryCompatible } from "../scripts/build/native-binary-compat.
|
||||
import { getNodeRuntimeSupport, getNodeRuntimeWarning } from "./nodeRuntimeSupport.mjs";
|
||||
import { getDefaultDataDir } from "./cli/data-dir.mjs";
|
||||
import { shouldProvisionStorageKey } from "./cli/utils/storageKeyProvision.mjs";
|
||||
import { isVersionFastPath } from "./cli/utils/versionFastPath.mjs";
|
||||
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
const __dirname = dirname(__filename);
|
||||
const ROOT = join(__dirname, "..");
|
||||
|
||||
// Fast-path a bare `--version`/`-V` query BEFORE the tsx/esm registration, the
|
||||
// polyfill import, env-file loading, or Commander's command registration (~70
|
||||
// modules — DB, providers, OAuth, etc.) run. None of that work is needed to answer
|
||||
// "what version is this" — mirrors upstream 9router PR #2414 (fast-path help/version
|
||||
// ahead of expensive self-heal hooks), adapted to OmniRoute's Commander CLI where the
|
||||
// equivalent expensive work is eager command registration rather than npm-install-based
|
||||
// runtime self-healing. `--help` is intentionally NOT fast-pathed here: its output is
|
||||
// generated dynamically from every registered subcommand, so skipping registration
|
||||
// would truncate the help text instead of just speeding it up.
|
||||
if (isVersionFastPath(process.argv)) {
|
||||
const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
|
||||
console.log(pkg.version);
|
||||
process.exit(0);
|
||||
}
|
||||
|
||||
// Register tsx so dynamic imports of .ts source files (referenced as .js per
|
||||
// TypeScript conventions) resolve correctly. The build never emits .js for
|
||||
@@ -26,9 +49,14 @@ import { shouldProvisionStorageKey } from "./cli/utils/storageKeyProvision.mjs";
|
||||
await import("tsx/esm");
|
||||
await import("../open-sse/utils/setupPolyfill.ts");
|
||||
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
const __dirname = dirname(__filename);
|
||||
const ROOT = join(__dirname, "..");
|
||||
// #7791: tsx's tsconfig-path resolution does not apply when OmniRoute is
|
||||
// installed globally (files live under node_modules/omniroute/), so bare
|
||||
// `@/...` specifiers (declared in tsconfig.json paths as `@/* → ./src/*`)
|
||||
// fail with ERR_MODULE_NOT_FOUND. Register an ESM resolve hook that maps
|
||||
// `@/...` to absolute file URLs under <ROOT>/src/. Safe no-op in dev checkout
|
||||
// (paths already resolve via tsconfig) and when ROOT has no `src/` dir.
|
||||
const { registerAliasResolver } = await import("./aliasResolver.mjs");
|
||||
await registerAliasResolver(ROOT);
|
||||
|
||||
// MCP stdio transport uses stdout exclusively for JSON-RPC messages.
|
||||
// Redirect console.log/warn to stderr early (before loadEnvFile and DB init)
|
||||
@@ -40,6 +68,28 @@ if (process.argv.includes("--mcp")) {
|
||||
console.warn = stderrConsole.warn.bind(stderrConsole);
|
||||
}
|
||||
|
||||
// Electron persists secrets (JWT_SECRET, API_KEY_SECRET, STORAGE_ENCRYPTION_KEY) to
|
||||
// `<DATA_DIR>/server.env` (electron/main.js), never `.env`. Migrating an existing
|
||||
// install (storage.sqlite + server.env) to the CLI left those secrets undiscoverable —
|
||||
// the CLI only ever looked for `.env`, so the STORAGE_ENCRYPTION_KEY needed to decrypt
|
||||
// the migrated database was silently dropped (#7302). One-time, one-directory migration:
|
||||
// if `<dataDir>/.env` is absent but `<dataDir>/server.env` is present, copy it to `.env`
|
||||
// so it flows through the normal env-loading path below. Never overwrites an existing
|
||||
// `.env` — an explicit `.env` always wins over a legacy `server.env`.
|
||||
function migrateElectronServerEnv(dataDir) {
|
||||
try {
|
||||
const envPath = join(dataDir, ".env");
|
||||
const serverEnvPath = join(dataDir, "server.env");
|
||||
if (existsSync(envPath) || !existsSync(serverEnvPath)) return;
|
||||
writeFileSync(envPath, readFileSync(serverEnvPath, "utf-8"), "utf-8");
|
||||
console.log(
|
||||
` \x1b[2m♻ Migrated Electron secrets from ${serverEnvPath} to ${envPath}\x1b[0m`
|
||||
);
|
||||
} catch {
|
||||
// Ignore errors migrating server.env — fall back to normal env loading below.
|
||||
}
|
||||
}
|
||||
|
||||
function loadEnvFile() {
|
||||
const envPaths = [];
|
||||
const loadedEnvPaths = [];
|
||||
@@ -50,6 +100,8 @@ function loadEnvFile() {
|
||||
envPaths.push(envPath);
|
||||
};
|
||||
|
||||
migrateElectronServerEnv(process.env.DATA_DIR || getDefaultDataDir());
|
||||
|
||||
if (process.env.DATA_DIR) {
|
||||
addEnvPath(join(process.env.DATA_DIR, ".env"));
|
||||
}
|
||||
@@ -93,6 +145,15 @@ function loadEnvFile() {
|
||||
|
||||
loadEnvFile();
|
||||
|
||||
// Next.js has no android branch in getCacheDirectory(): if ~/.cache (and tmp)
|
||||
// do not already exist it aborts the instrumentation hook, and every request
|
||||
// then returns a silent HTTP 500 even though the CLI still looks "running".
|
||||
// Create the cache dir (and set XDG_CACHE_HOME when unset) before serve/Next.
|
||||
{
|
||||
const { ensureAndroidCacheDir } = await import("./cli/utils/ensureAndroidCacheDir.mjs");
|
||||
ensureAndroidCacheDir();
|
||||
}
|
||||
|
||||
// Generate STORAGE_ENCRYPTION_KEY if not set (persisted to ~/.omniroute/.env)
|
||||
// This ensures the key survives across upgrades and is not regenerated on each install.
|
||||
// See: https://github.com/diegosouzapw/OmniRoute/issues/1622
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
|
||||
@@ -1 +0,0 @@
|
||||
- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
|
||||
@@ -1 +0,0 @@
|
||||
- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
|
||||
@@ -1 +0,0 @@
|
||||
- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
|
||||
@@ -1 +0,0 @@
|
||||
- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
|
||||
@@ -1,2 +0,0 @@
|
||||
- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
|
||||
- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
|
||||
@@ -1 +0,0 @@
|
||||
- **Homologation suite**: new `npm run homolog` runs the full release-homologation battery against the deployed VPS — health/version parity, API + real SSE streaming with an ephemeral API key (created and revoked by the run), minimal-cost real-provider smoke (promptfoo generated from the live catalog), and a Playwright sweep that loads every dashboard route and exercises the API-key UI flow — emitting a unified CTRF report that backs the release STOP #2 checklist
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(api):** Vercel Relay deploy now checks the Deployment Protection (SSO) PATCH response and surfaces `ssoProtectionWarning` when Vercel rejects it, instead of silently activating a relay that later returns an undiagnosed `403 Access denied`. (thanks @ricatix)
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(combo):** streaming Claude responses whose content block opens (`content_block_start`) and closes with no usable text/tool_use — a shape some upstreams return for tool-heavy requests on HTTP 200 — are now detected by `validateResponseQuality`'s SSE peek and trigger combo failover instead of being forwarded to the client as a silent empty completion (thanks @heishen6).
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(codex):** strip regex `pattern` lookaround (lookahead/lookbehind) from tool JSON Schemas on the Codex/OpenAI native passthrough path — previously only the translated-request path coerced tool schemas, so a `pattern` like `^(?=.*@).+$` reached OpenAI unmodified and was rejected with `regex lookaround is not supported`. (thanks @evinjohnn) (#7100)
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(cli):** `stopMitm()` now removes /etc/hosts DNS-spoof entries before killing the MITM server process, closing the window where a client's DNS still resolved a target host to `127.0.0.1` while nothing was listening there — the cause of `connect ECONNREFUSED 127.0.0.1:443` right after stopping the MITM proxy (thanks @dionisius95).
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(sse):** Cursor Composer/Auto tool calls that separate the arg name and value with a space instead of a newline (e.g. `path /Users/.../test`) no longer produce empty-valued, malformed argument keys, fixing silent no-op Write/tool calls. (thanks @way-art)
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(dashboard):** the "Custom Models" add/edit form now has a "Vision capable" toggle so a custom OpenAI-compatible model can be manually flagged as vision-capable when the provider's discovery metadata doesn't report an image input modality (thanks @nguyenphi37)
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(combos):** fusion combos now reject an oversized panel (>40 models by default, tunable via `fusionTuning.maxPanel`) with a clean 400 before fanning out, instead of buffering dozens of concurrent full responses in memory and OOM-crashing the whole container. (thanks @fontvu)
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(providers):** the OpenAI-compatible "Check" validation flow now surfaces a warning when the chat-completions probe returns `404` (e.g. `model_not_found`) instead of silently passing as `Valid` — a bogus/non-standard model id (Featherless/OpenRouter-style `vendor/model` typos) previously went undetected at Check time and only surfaced once a real request tripped the per-model lockout. (thanks @advane204f)
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(executors):** forward agent-supplied `X-Session-ID`/`X-Title` metadata headers to upstream providers — previously dropped for every client outside the `x-opencode-*` allowlist. (thanks @chitholian) (#7104)
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(sse):** Antigravity streaming requests that hit a non-ok upstream response (e.g. a 403) no longer pipe the raw upstream bytes straight through to the client — a binary/non-UTF8 error body (observed as gzip-magic-byte garbage) is now routed through the same sanitized `buildAntigravityUpstreamError()` path the non-streaming branch already used, instead of corrupting the client-visible error message. Regression guard: `tests/unit/antigravity-streaming-error-body-sanitized-2461.test.ts` — thanks @Duongkhanhtool
|
||||
@@ -1 +0,0 @@
|
||||
- **fix(cli):** the runtime self-heal now verifies a cached `better-sqlite3` native binary actually loads for the running Node before trusting it — the old check only inspected the file's magic bytes (ELF/Mach-O/PE header), so a binary built for a different Node ABI passed validation and segfaulted the process on first use instead of triggering a rebuild. (thanks @mrprohack) (#7105)
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user