chore(release): finalize v3.8.50 notes and credits (#8875)

CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

README.md

@@ -64,7 +64,7 @@
 |                           | v3.8.49 |        **v3.8.50**        | `v3.8.51+`  |
 | ------------------------- | :-----: | :-----------------------: | :---------: |
 | 🌐 Providers              |   290   |          **345**          | more queued |
-| 🧠 Unique chat model IDs  |  1185   |         **1273**          |      —      |
+| 🧠 Unique chat model IDs  |  1185   |         **1275**          |      —      |
 | 🖼️ Modality Bridge        |    —    | 🆕 vision + audio + video |      —      |
 | 📡 Radar free catalog     |    —    |         🆕 opt-in         |      —      |
 | ⚖️ Quota-aware scheduling |    —    |      🆕 Quota-Share       |      —      |
@@ -1466,9 +1466,9 @@ A heartfelt thank-you to the people who fund OmniRoute out of their own pocket
 
 </div>
 
-[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=635&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)
+[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=638&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)
 
-<sub>Audited at reconciled v3.8.50 candidate <code>aab9b946</code> on 2026-08-23: <b>635 normalized human Git identities</b> — 403 appear as commit authors, including the maintainer, and another 232 appear only in explicit <code>Co-authored-by</code> trailers. Formula: all commits reachable from the candidate head; e-mails are case-normalized, and numeric, non-numeric and malformed numeric GitHub noreply variants encoding the same handle are joined. Bots, agents, service accounts and placeholder identities are excluded. No <code>.mailmap</code> exists, and ordinary same-name identities with different e-mails are deliberately not merged, so this is a conservative, reproducible Git-metadata census rather than a count of verified unique people or GitHub profiles.</sub>
+<sub>Audited at reconciled v3.8.50 candidate <code>bf833936</code> on 2026-08-23: <b>638 normalized human Git identities</b> — 406 appear as commit authors, including the maintainer, and another 232 appear only in explicit <code>Co-authored-by</code> trailers. Formula: all commits reachable from the candidate head; e-mails are case-normalized, and numeric, non-numeric and malformed numeric GitHub noreply variants encoding the same handle are joined. Bots, agents, service accounts and placeholder identities are excluded. No <code>.mailmap</code> exists, and ordinary same-name identities with different e-mails are deliberately not merged, so this is a conservative, reproducible Git-metadata census rather than a count of verified unique people or GitHub profiles.</sub>
 
 ### How to Contribute
 

changelog.d/features/11283-traffic-inspector-purpose-header.md

@@ -1 +0,0 @@
-- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283))

changelog.d/features/11286-essentials-sidebar-preset.md

@@ -1 +0,0 @@
-- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286))

changelog.d/fixes/10815-kiro-social-multi-account.md

@@ -1 +0,0 @@
-- fix(oauth): stop treating the Kiro profile ARN as an account identity in `findKiroConnectionByIdentity()`, so a second Google/GitHub social login creates a new connection instead of overwriting the first — distinct Builder ID accounts share the same CodeWhisperer profile ARN, and the social token is not a JWT, so no e-mail was available to disambiguate them (#10815)

docs/i18n/ar/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ar/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/az/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/az/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/bg/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/bg/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/bn/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/bn/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/cs/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/cs/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/da/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/da/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/de/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/de/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/es/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/es/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/fa/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/fa/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/fi/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/fi/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/fr/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/fr/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/gu/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/gu/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/he/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/he/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/hi/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/hi/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/hu/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/hu/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/id/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/id/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/in/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/in/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/it/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/it/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/ja/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ja/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/ko/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ko/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/mr/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/mr/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/ms/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ms/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/nl/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/nl/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/no/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/no/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/phi/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/phi/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/pl/CHANGELOG.md

@@ -304,6 +304,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1002,7 +1004,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1237,6 +1239,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1518,14 +1521,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1548,6 +1543,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1597,6 +1593,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1604,6 +1601,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1614,7 +1612,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1627,7 +1625,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1644,8 +1642,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/pl/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/pt-BR/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/pt-BR/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/pt/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/pt/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/ro/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ro/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/ru/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ru/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/sk/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/sk/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/sv/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/sv/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/sw/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/sw/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/ta/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ta/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/te/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/te/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/th/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/th/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/tr/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/tr/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/uk-UA/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/uk-UA/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/ur/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/ur/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/vi/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/vi/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/zh-CN/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/zh-CN/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

docs/i18n/zh-TW/CHANGELOG.md

@@ -302,6 +302,8 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path ([#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232), [#11252](https://github.com/diegosouzapw/OmniRoute/pull/11252) — thanks @maxmad64bis) (reported in [#7694](https://github.com/diegosouzapw/OmniRoute/issues/7694) — thanks @excessivechaos)
 - **feat(vertex):** discover Anthropic partner models from the Vertex AI Model Garden's PublisherModels API and route dynamically discovered `claude-*` IDs through the Claude translator for both `vertex` and `vertex-partner` ([#11279](https://github.com/diegosouzapw/OmniRoute/pull/11279) — thanks @maci0; integration test by @hartmark)
 - **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path; Pitch #03 is tracked in [#11167](https://github.com/diegosouzapw/OmniRoute/issues/11167) ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282) — thanks @ignamiranda)
+- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283) — thanks @ignamiranda)
+- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286) — thanks @ignamiranda)
 
 ### 🐛 Bug Fixes
 
@@ -1000,7 +1002,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(compression):** bump vendored GCF with numeric-domain and surplus fixes ([#10807](https://github.com/diegosouzapw/OmniRoute/pull/10807)) — thanks @blackwell-systems
 - **fix(zed-hosted):** add connection test support for Zed Hosted Models ([#10810](https://github.com/diegosouzapw/OmniRoute/pull/10810)) — thanks @Hsia97
 - **fix(admission):** reserve Responses and Messages bodies before clone ([#10814](https://github.com/diegosouzapw/OmniRoute/pull/10814)) — thanks @RaviTharuma
-- fix(db): disambiguate `createProviderConnection()`'s OAuth email dedup by `providerSpecificData.profileArn` in addition to `username`, so adding a second Kiro/AWS profile with the same email creates a new connection instead of silently merging into the first (#10815)
+- **fix(kiro/oauth):** prevent distinct Kiro accounts from overwriting one another on both persistence paths: same-email OAuth writes are disambiguated by `username`/`profileArn`, and the social-login matcher no longer treats a shared CodeWhisperer profile ARN alone as an account identity, accepting it only when the incoming identity also carries a non-conflicting `email` or `clientId` ([#10815](https://github.com/diegosouzapw/OmniRoute/issues/10815) — thanks @franciscojnneto for the report); persistence-path fix ([#10918](https://github.com/diegosouzapw/OmniRoute/pull/10918) — thanks @hartmark); social-flow follow-up ([#11287](https://github.com/diegosouzapw/OmniRoute/pull/11287) — thanks @engenhariaandrereis01-ai / @andrersreis-cyber)
 - **fix(images):** register OpenAI `dall-e-3` in the image registry so unprefixed `dall-e-3` (and `openai/dall-e-3`) route to OpenAI Images instead of Microsoft Designer Web, and so the chat catalog no longer lists `openai/dall-e-3` as a 128k chat model ([#10832](https://github.com/diegosouzapw/OmniRoute/issues/10832))
 - **fix(cli):** prevent DEP0190 child process spawn deprecation on Windows ([#10835](https://github.com/diegosouzapw/OmniRoute/pull/10835)) — thanks @adevwithpurpose
 - **fix(build):** ensure standalone package.json declares module type for Node 24 worker compatibility ([#10836](https://github.com/diegosouzapw/OmniRoute/pull/10836)) — thanks @adevwithpurpose
@@ -1235,6 +1237,7 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **fix(live-ws/dashboard):** accept the dev server's `http://0.0.0.0:20128` dashboard Origin without weakening the local-only default, stopping the `FORBIDDEN_ORIGIN` reconnect flood; render non-square provider and CLI logos at their intrinsic ratio so Next.js stops warning across the dashboard ([#11269](https://github.com/diegosouzapw/OmniRoute/pull/11269) — thanks @Minamaged18)
 - **fix(ollama):** preserve every capability advertised by self-hosted Ollama models and defer chat selection to read time, so embedding and image routes accept eligible models without leaking endpoint-only models into provider wildcards or Auto-Combo; image retries remain restricted to the connections that advertised the selected model ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271), corrected release-line port of [#11088](https://github.com/diegosouzapw/OmniRoute/pull/11088) for [#11087](https://github.com/diegosouzapw/OmniRoute/issues/11087) — thanks @yourspraveen)
 - **fix(providers):** clamp out-of-vocabulary `reasoning_effort` values to the nearest tier declared by the exact provider/model, so `opencode-go/ox-alpha-free` maps the `medium` default to `high` while undeclared models remain pass-through ([#11274](https://github.com/diegosouzapw/OmniRoute/pull/11274) — thanks @linhdmn and @hartmark); builds on the learned accepted-set clamp from [#11232](https://github.com/diegosouzapw/OmniRoute/pull/11232) by @maxmad64bis
+- **fix(security):** replace the GitHub Copilot correlation-ID fallback's `Math.random()` with CSPRNG bytes from `node:crypto` and make the Windows shell-argument test helper undo doubled backslashes and escaped quotes in one left-to-right pass, clearing CodeQL `js/insecure-randomness` and `js/double-escaping` while keeping `crypto.randomUUID()` as the primary path ([#11293](https://github.com/diegosouzapw/OmniRoute/pull/11293) — thanks @hartmark)
 
 ### 📝 Maintenance
 
@@ -1516,14 +1519,6 @@ _Living section — reconciled 2026-08-23 from all cycle commits (cycle open `ed
 - **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1,393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247) — thanks @maxmad64bis)
 - **docs(i18n):** add the complete Persian User Guide translation with commands, identifiers and relative links preserved ([#11254](https://github.com/diegosouzapw/OmniRoute/pull/11254) — thanks @crmbadesaba-commits)
 
-
-
-
-
-
-
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.50:
@@ -1546,6 +1541,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@alex-jordan547](https://github.com/alex-jordan547) | #9235, #9245, #9813 |
 | [@aliyosufi](https://github.com/aliyosufi) | #11159 |
 | [@amartinawi](https://github.com/amartinawi) | #10090, #10091, #10092, #10097, #10101 |
+| [@andrersreis-cyber](https://github.com/andrersreis-cyber) | #11287 |
 | [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #8888, #8889, #8890, #8891, #8892, #8893, #8894, #8895, #11081, #11082 |
 | [@AnhLead](https://github.com/AnhLead) | #9722 |
 | [@aniketshukla1](https://github.com/aniketshukla1) | #9148 |
@@ -1595,6 +1591,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@echoriver89](https://github.com/echoriver89) | #10717 |
 | [@Egorich-print](https://github.com/Egorich-print) | #9001, #9020, #9058, #10881, #10887, #11097 |
 | [@electrumguy](https://github.com/electrumguy) | #10774, #11149 |
+| [@engenhariaandrereis01-ai](https://github.com/engenhariaandrereis01-ai) | #11287 |
 | [@engmarcosjr](https://github.com/engmarcosjr) | #9993 |
 | [@epsilonode](https://github.com/epsilonode) | #8871 |
 | [@ervareza](https://github.com/ervareza) | direct commit / report |
@@ -1602,6 +1599,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@fajarhide](https://github.com/fajarhide) | #9191, #9198 |
 | [@farshidrezaei](https://github.com/farshidrezaei) | #10777 |
 | [@fenix007](https://github.com/fenix007) | #9618, #10016 |
+| [@franciscojnneto](https://github.com/franciscojnneto) | #10815 |
 | [@freudantunes](https://github.com/freudantunes) | #10623 |
 | [@Gecky2102](https://github.com/Gecky2102) | #9280 |
 | [@geek007git](https://github.com/geek007git) | #10441 |
@@ -1612,7 +1610,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@HaoNgo232](https://github.com/HaoNgo232) | direct commit / report |
 | [@Hariprajwal](https://github.com/Hariprajwal) | #9922 |
 | [@harkaranbrar7](https://github.com/harkaranbrar7) | #10281 |
-| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #11281 |
+| [@hartmark](https://github.com/hartmark) | #9635, #9704, #9708, #9711, #9712, #9727, #9734, #9735, #9738, #9741, #9744, #9745, #9822, #10025, #10034, #10037, #10038, #10041, #10121, #10217, #10262, #10263, #10330, #10331, #10739, #10918, #11281, #11293 |
 | [@Hdiaktoros](https://github.com/Hdiaktoros) | #8930 |
 | [@HectorBernstorff](https://github.com/HectorBernstorff) | direct commit / report |
 | [@HellFiveOsborn](https://github.com/HellFiveOsborn) | #9248 |
@@ -1625,7 +1623,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@Hsia97](https://github.com/Hsia97) | #10810 |
 | [@hydraxman](https://github.com/hydraxman) | #10137, #10572 |
 | [@Iammilansoni](https://github.com/Iammilansoni) | #9353, #9397 |
-| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282 |
+| [@ignamiranda](https://github.com/ignamiranda) | #11195, #11204, #11206, #11215, #11224, #11227, #11228, #11282, #11283, #11286 |
 | [@ikelvingo](https://github.com/ikelvingo) | #8591, #8872, #9053 |
 | [@im-ecorp](https://github.com/im-ecorp) | #11244 |
 | [@infinit-X](https://github.com/infinit-X) | #9095 |
@@ -1642,8 +1640,7 @@ Thanks to everyone whose work landed in v3.8.50:
 | [@jonlwheat2-gif](https://github.com/jonlwheat2-gif) | #10610, #10709, #11194, #11201 |
 | [@JoshimOfficial](https://github.com/JoshimOfficial) | #9011 |
 | [@jowimila](https://github.com/jowimila) | #9325 |
-| [@jxnlexn](https://github.com/jxnlexn) | #10927 |
-| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608 |
+| [@JxnLexn](https://github.com/JxnLexn) | #8933, #8940, #8944, #8949, #10422, #10608, #10927 |
 | [@Kaedo17](https://github.com/Kaedo17) | #8922 |
 | [@KaspaPulse](https://github.com/KaspaPulse) | #10362 |
 | [@khoazero123](https://github.com/khoazero123) | #9272 |

docs/i18n/zh-TW/llm.txt

@@ -367,7 +367,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

llm.txt

@@ -363,7 +363,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 14 search, 12 audio-only, 2 upstream proxy, 3 cloud-agent, and 1 system provider. These
 categories are disjoint in the current static catalog.
 
-**Core model registry:** 264 provider entries, 2,510 provider-model registrations, and 1,273
+**Core model registry:** 264 provider entries, 2,526 provider-model registrations, and 1,275
 distinct unqualified model IDs. These are static-code counts and exclude live upstream discovery,
 custom providers, dynamic provider nodes, and database overrides.
 

scripts/release/gen-contributors.mjs

@@ -60,10 +60,27 @@ export function extractVersionSection(changelog, version) {
  */
 export function parseContributors(sectionText) {
   const agg = new Map(); // handle -> Set(refs)
+  const canonicalHandles = new Map(); // lower-case GitHub login -> displayed login
   const add = (handle, refs) => {
-    if (NOISE_HANDLES.has(handle) || handle === MAINTAINER) return;
-    if (!agg.has(handle)) agg.set(handle, new Set());
-    for (const r of refs) agg.get(handle).add(r);
+    const normalized = handle.toLowerCase();
+    if (NOISE_HANDLES.has(normalized) || normalized === MAINTAINER) return;
+
+    let canonical = canonicalHandles.get(normalized);
+    if (!canonical) {
+      canonical = handle;
+      canonicalHandles.set(normalized, canonical);
+      agg.set(canonical, new Set());
+    } else if (canonical === normalized && handle !== normalized) {
+      // GitHub logins are case-insensitive. Prefer a later cased spelling over an all-lowercase
+      // occurrence while preserving every ref already collected for that account.
+      const existingRefs = agg.get(canonical);
+      agg.delete(canonical);
+      canonical = handle;
+      canonicalHandles.set(normalized, canonical);
+      agg.set(canonical, existingRefs);
+    }
+
+    for (const r of refs) agg.get(canonical).add(r);
   };
   // A slash is a contributor separator only when another @handle follows it. This prevents
   // GitHub App identities such as `@app/dependabot` from being truncated and credited as `@app`.
@@ -147,12 +164,17 @@ export function injectContributors(changelog, version, table) {
   const nextIdx = rest.search(/\n## \[/);
   const bodyEnd = nextIdx === -1 ? changelog.length : headerEnd + nextIdx;
   let body = changelog.slice(headerEnd, bodyEnd);
-  // strip an existing Contributors section (idempotent re-run)
-  body = body.replace(/\n### 🙌 Contributors[\s\S]*?(?=\n---\n|$)/, "\n");
-  // insert before the trailing `---` (or append if none)
+  // Strip an existing Contributors section and its leading blank lines. Repeated injection must
+  // be byte-idempotent instead of growing whitespace before the generated table on every run.
+  body = body.replace(/\n+### 🙌 Contributors[\s\S]*?(?=\n---\n|$)/, "");
+  // Insert before the trailing `---` (or append if none), with one blank line on each side.
   const idx = body.lastIndexOf("\n---");
-  const insertion = `\n${table}\n`;
-  body = idx >= 0 ? body.slice(0, idx) + insertion + body.slice(idx) : `${body}${insertion}\n---\n`;
+  if (idx >= 0) {
+    const prefix = body.slice(0, idx).replace(/\s+$/, "");
+    body = `${prefix}\n\n${table}\n${body.slice(idx)}`;
+  } else {
+    body = `${body.replace(/\s+$/, "")}\n\n${table}\n\n---\n`;
+  }
   return changelog.slice(0, headerEnd) + body + changelog.slice(bodyEnd);
 }
 

tests/unit/gen-contributors.test.ts

@@ -82,6 +82,17 @@ test("GitHub App identities are not truncated in extracted-from credits", () =>
   assert.equal(agg.size, 0);
 });
 
+test("GitHub logins are deduplicated case-insensitively without losing refs", () => {
+  const agg = parseContributors(`
+- **fix:** first spelling ([#105](https://github.com/x/y/pull/105) — thanks @exampleuser)
+- **fix:** canonical spelling ([#106](https://github.com/x/y/pull/106) — thanks @ExampleUser)
+`);
+
+  assert.equal(agg.size, 1);
+  assert.ok(!agg.has("exampleuser"));
+  assert.deepEqual([...agg.get("ExampleUser")], [105, 106]);
+});
+
 test("renderContributors emits an alphabetical table with maintainer last", () => {
   const agg = parseContributors(extractVersionSection(FIXTURE, "3.9.0"));
   const table = renderContributors("3.9.0", agg);
@@ -115,4 +126,5 @@ test("injectContributors inserts before the closing --- and is idempotent", () =
   );
   const count = (twice.match(/### 🙌 Contributors/g) || []).length;
   assert.equal(count, 1, "no duplicate Contributors section on re-run");
+  assert.equal(twice, once, "re-injection is byte-idempotent");
 });